24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 59:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Agent Sample 0c40b71d79c7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0c40b71d79c7…. Malware family: Trojan.Agent. Threat score 100/100. 20/26 AV engines flagged this file. 11 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2","keywords":["Malicious","Trojan.Agent","malware analysis","sandbox report","threat intelligence","0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2"],"about":{"@type":"SoftwareApplication","name":"0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Agent","antivirusDetections":{"malicious":20,"total":26},"behavioralIndicators":{"malicious":11,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Ta80,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReleaseComObject" in "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "GetBuffer" in "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "Dispose" in "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "WriteTo" in "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Capacity" in "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "Edge.exe.bin"26:Te1f,Found reference to "PbeSha1_RC2_40" (Indicator: "RC2"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin") Found reference to "RC2_CBC_40" (Indicator: "RC2"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin") Found reference to "SRTP_NULL_HMAC_SHA1_80" (Indicator: "HMAC"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin") Found reference to "SRTP_AES128_CM_HMAC_SHA1_80" (Indicator: "HMAC"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin") Found reference to "HMAC_SHA1" (Indicator: "HMAC"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin") Found reference to "EncryptionECDsaWithSha1" (Indicator: "ECDsa"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin") Found reference to "TRAILER_SHA512" (Indicator: "SHA512"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin") Found reference to "ecka_eg_X963kdf_SHA512" (Indicator: "SHA512"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin") Found reference to "sphincs256_with_SHA512" (Indicator: "SHA512"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin") Found reference to "xmss_with_SHA512" (Indicator: "SHA512"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin") Found reference to "xmss_mt_with_SHA512" (Indicator: "SHA512"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin") Found reference to "ecdsa_plain_SHA512" (Indicator: "SHA512"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin") Found reference to "EncryptionECDsaWithSha512" (Indicator: "ECDsa"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin") Found reference to "SRTP_NULL_HMAC_SHA1_32" (Indicator: "HMAC"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin") Found reference to "SRTP_AES128_CM_HMAC_SHA1_32" (Indicator: "HMAC"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin") Found reference to "Aes192" (Indicator: "Aes"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin") Found reference to "ECDsaWithSha2" (Indicator: "ECDsa"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin") Found reference to "TRAILER_SHA512_224" (Indicator: "SHA512"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin") Found reference to "EncryptionECDsaWithSha224" (Indicator: "ECDsa"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin") Found reference to "RC2_64" (Indicator: "RC2"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin") Found reference to "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin") Found reference to "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin") Found reference to "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin") Found reference to "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin") Found reference to "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin")27:T4a8,"9iqmgvw,czcthawte," - Source: "00000000-00005184.00000001.225416.1D3F2000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005184.00000001.225416.1D3F2000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005184.00000001.225416.1D3F2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005184.00000001.225416.1D3F2000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*linternet1verisign," - Source: "00000000-00005184.00000001.225416.1D3F2000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005184.00000001.225416.1D3F2000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005184.00000001.225416.1D3F2000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005184.00000001.225416.1D3F2000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;washington1redmond1microsoft" - Source: "00000000-00005184.00000001.225416.1D3F2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005184.00000001.225416.1D3F2000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005184.00000001.225416.1D3F2000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005184.00000001.225416.1D3F2000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005184.00000001.225416.1D3F2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00005184.00000001.225416.1D3F2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005184.00000001.225416.1D3F2000.00000004.mdmp") Found URL "http://www.microsoft.com0e66fgnan3e:aitt'qc1.3.6.1.4.1.311.10.1250826195646z0" - Source: "00000000-00005184.00000001.225416.1D570000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00005184.00000001.225416.1D770000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005184.00000001.225416.1D770000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lcorporat.u[r9iqmgvw,czcthawte," - Source: "00000000-00005184.00000002.227338.1D3F2000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005184.00000002.227338.1D3F2000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005184.00000002.227338.1D3F2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005184.00000002.227338.1D3F2000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*linternet1verisign," - Source: "00000000-00005184.00000002.227338.1D3F2000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005184.00000002.227338.1D3F2000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005184.00000002.227338.1D3F2000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005184.00000002.227338.1D3F2000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;washington1redmond1microsoft" - Source: "00000000-00005184.00000002.227338.1D3F2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005184.00000002.227338.1D3F2000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005184.00000002.227338.1D3F2000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005184.00000002.227338.1D3F2000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005184.00000002.227338.1D3F2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00005184.00000002.227338.1D3F2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005184.00000002.227338.1D3F2000.00000004.mdmp") Found URL "http://www.microsoft.com0e66fgnan3e:aitt'qc1.3.6.1.4.1.311.10.1250826195646z0" - Source: "00000000-00005184.00000002.227338.1D570000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00005184.00000002.227338.1D770000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005184.00000002.227338.1D770000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lcorporat.u[r>) at 1424a8fcd5aa3daf7d0d2f6926da1892-60001d3-_~_","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network adapter information (Dotnet)","description":"Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin\"\n Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"Edge.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-137","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"Gma.System.MouseKeyHook.WinApi.KeyboardNativeMethods::GetKeyboardLayout(System.Int32) at 1424a8fcd5aa3daf7d0d2f6926da1892-6000980-KeyboardNativeMethods~GetActiveKeyboard","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"tlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00002892.00000000.233152.02FD0000.00000004.mdmp\")\n Found reference to API \"SMBIOS|CSMBios|GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00005184.00000001.225416.1D570000.00000004.mdmp, 00000000-00005184.00000002.227338.1D570000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"Edge.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Security\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Security.dll\" at 00000000-00005184-00000C17-2493409459\n \"Edge.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Data.SqlXml\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.SqlXml.dll\" at 00000000-00005184-00000C17-2493640036\n \"Edge.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\SMDiagnostics\\v4.0_4.0.0.0__b77a5c561934e089\\SMDiagnostics.dll\" at 00000000-00005184-00000C17-2498337408\n \"Edge.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ServiceModel.Internals\\v4.0_4.0.0.0__31bf3856ad364e35\\System.ServiceModel.Internals.dll\" at 00000000-00005184-00000C17-2498354677\n \"Edge.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Web\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Web.dll\" at 00000000-00005184-00000C17-2537988622","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\" HTTP/1.1 200 OK\nDate: Sat\n 28 Mar 2026 03:43:28 GMT\nContent-Type: application/json; charset=utf-8\nContent-Length: 954\nConnection: keep-alive\nAccept-Ranges: bytes\nAccess-Control-Allow-Origin: *\ncf-cache-status: EXPIRED\nServer: cloudflare\nCF-RAY: 9e33a179bdde15bc-SJC\nalt-svc: h3=\":443\"; ma=86400 with response body ==>7B0A20202020226970223A202236342E3132342E31322E313632222C0A202020202273756363657373223A20747275652C0A202020202274797065223A202249.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\" nuldel /a /q /f \"\" (Indicator: \"ping -\"; File: \"0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin\"), Found string \"@echo off\\r\\nchcp 65001\\r\\necho DONT CLOSE THIS WINDOW!\\r\\nping -n 10 localhost > nul\\r\\ndel /a /q /f \\\"\" (Indicator: \"ping -\"; File: \"0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin\")\n Found string \"@echo off\\r\\nchcp 65001\\r\\necho DONT CLOSE THIS WINDOW!\\r\\nping -n 10 localhost > nul\\r\\nstart \\\"\\\" \\\"\" (Indicator: \"ping -\"; File: \"0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-5070","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files (.NET)","description":"Observed dotnet function \"WebRequest.GetResponse\" in \"0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin\"\n Observed dotnet function \"WebResponse.GetResponseStream\" in \"0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin\"\n Observed dotnet function \"WebRequest.GetResponse\" in \"Edge.exe.bin\"\n Observed dotnet function \"WebResponse.GetResponseStream\" in \"Edge.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":7,"id":"static-201","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00005184.00000001.225416.1D570000.00000004.mdmp, 00000000-00005184.00000002.227338.1D570000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00005184-00000C2C-2494174815\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTPS web server (GET/POST requests)","description":"Found requests in header \"GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive\"; in File: \"SSL\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-505","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"$45","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005184-00000C2C-2494153289\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00005184-00000C2C-2496759586\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00005184-00000C2C-2497008434\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00005184-00000C2C-2497008462\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00005184-00000C2C-2498155831\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"$46","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicates via socket (possible C&C communication)","description":"$47","origin":"Static Parser","mitre_attack_id":"T1071","relevance":1,"id":"static-151","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin\"\n Observed namespace \"System.Net.Sockets\" in \"0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin\"\n Observed namespace \"System.Net.Security\" in \"0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin\"\n Observed namespace \"System.Net.NetworkInformation\" in \"0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00005184-00000C2C-2494153289\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"Decrypted SSL network traffic","description":"$48","origin":"File/Memory","mitre_attack_id":"T1573","relevance":3,"id":"string-102","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"fq%umx.0y0\" [Source: 00000000-00005184.00000001.225416.1D3F2000.00000004.mdmp\n 00000000-00005184.00000001.225416.1D570000.00000004.mdmp\n 00000000-00005184.00000001.225416.1D770000.00000004.mdmp\n 00000000-00005184.00000002.227338.1D3F2000.00000004.mdmp\n 00000000-00005184.00000002.227338.1D570000.00000004.mdmp\n 00000000-00005184.00000002.227338.1D770000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$49","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4b","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive\" (Indicator: \"HTTP/1.1\"; File: \"SSL\")\n file/memory contains long string with (Indicator: \"HTTP/1.1\"; File: \"SSL\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005184.00000001.225416.02DE0000.00000004.mdmp, 00000000-00005184.00000002.227338.02DE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET / HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0\nHost: ipwho.is\nConnection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: c12f54a3f91dc7bafd92cb59fe009a35\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://ipwho.is\"\n Found HTTPS url \"https://stackoverflow.com\"\n Found HTTPS url \"https://api.ipify.org\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://ipwho.is/","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"ipwho.is\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.20.44.133\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"\n YARA signature for AES encryption matched on file \"Edge.exe.1829791162\"\n YARA signature for AES encryption matched on file \"Edge.exe.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CreateDC\" (Indicator: \"CreateDC\"; File: \"0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4e","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"[Esc]

\" (Indicator: \"[esc]\"; File: \"0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"GetMac\" (Indicator: \"getmac\"; File: \"0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin\")\n Found string \"HostName\" (Indicator: \"hostname\"; File: \"0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin\")\n Found string \"hostname\" (Indicator: \"hostname\"; File: \"0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin\")\n Found string \"'name' is not a HostName string\" (Indicator: \"hostname\"; File: \"0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin\")\n Found string \"/K CHCP {0}\" (Indicator: \"chcp\"; File: \"0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00005184.00000001.225416.1D570000.00000004.mdmp, 00000000-00005184.00000002.227338.1D570000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$51","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$52","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"\"del /a /q /f \"\" (Indicator: \"\"del \") in Source: 0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00002892.00000000.233152.02FD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Edge.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$53","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$54","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00005184.00000001.225416.1D770000.00000004.mdmp, 00000000-00005184.00000002.227338.1D770000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"2026-03-28 has high entropy\"","origin":"Binary File","mitre_attack_id":"T1027.013","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin.exe.log]- [targetUID: 00000000-00007128]\n Dropped file: \"77EC63BDA74BD0D0E0426DC8F8008506\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00005184]\n Dropped file: \"2026-03-28\" - Location: [%APPDATA%\\Logs\\2026-03-28]- [targetUID: 00000000-00005184]\n Dropped file: \"77EC63BDA74BD0D0E0426DC8F8008506\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00005184]\n Dropped file: \"Edge.exe\" - Location: [%APPDATA%\\SubDir\\Edge.exe]- [targetUID: 00000000-00005184]\n Dropped file: \"Edge.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\Edge.exe.log]- [targetUID: 00000000-00002892]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"DeleteDC\" (Source: 0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin, API is part of module: GDI32.DLL)\n Found string \"CryptHashData\" (Source: 0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin, API is part of module: CRYPTSP.DLL)\n Found string \"GetCurrentThreadId\" (Source: 0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin, API is part of module: KERNELBASE.DLL)\n Found string \"GetWindowThreadProcessId\" (Source: 0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin, API is part of module: USER32.DLL)\n Found string \"shutdown\" (Source: 0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin, API is part of module: WS2_32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"0c40b71d79c7c5ecad48ea57a2ca577195c4c03e0b62c8000d151459e2a07ca2.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"Edge.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69c74e397f8f0c0ec70d5089"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"