24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 55:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4e4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSILHeracles.Generic Sample 1bfdad645130… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1bfdad645130…. Malware family: MSILHeracles.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 13 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1bfdad6451307a77867f50311e9b209f5378d69972a8efafb29cbfda88bced1f","keywords":["Malicious","MSILHeracles.Generic","malware analysis","sandbox report","threat intelligence","1bfdad6451307a77867f50311e9b209f5378d69972a8efafb29cbfda88bced1f"],"about":{"@type":"SoftwareApplication","name":"1bfdad6451307a77867f50311e9b209f5378d69972a8efafb29cbfda88bced1f.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"1bfdad6451307a77867f50311e9b209f5378d69972a8efafb29cbfda88bced1f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSILHeracles.Generic","antivirusDetections":{"malicious":10,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T40a,Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00007720.00000001.131154.6F5B1000.00000020.mdmp, 00000000-00007720.00000001.131154.71E11000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007720.00000001.131154.6F641000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00007720.00000001.131154.6F641000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00007720.00000001.131154.6F641000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00007720.00000001.131154.6F641000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007720.00000001.131154.6F641000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00007720.00000001.131154.6F641000.00000002.mdmp")26:T6a8,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007720.00000000.129231.071C0000.00000004.mdmp, 00000000-00007720.00000001.131154.6F641000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007720.00000001.131154.6F641000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007720.00000001.131154.6F641000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007720.00000001.131154.6F641000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007720.00000001.131154.6F641000.00000002.mdmp, 00000000-00007720.00000002.131602.71E25000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007720.00000001.131154.6F641000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007720.00000001.131154.6F641000.00000002.mdmp, 00000000-00007720.00000002.131602.71E25000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00007720.00000001.131154.6F641000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00007720.00000001.131154.6F641000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00007720.00000001.131154.6F641000.00000002.mdmp")27:T41c,Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00007720.00000000.129231.071C0000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007720.00000001.131154.6F641000.00000002.mdmp, 00000000-00007720.00000002.131602.71E25000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007720.00000001.131154.6F641000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007720.00000001.131154.6F641000.00000002.mdmp, 00000000-00007720.00000002.131602.71E25000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007720.00000001.131154.6F641000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00008088.00000000.131596.00400000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00008088.00000000.131596.00400000.00000040.mdmp")28:T116c,Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00007720.00000000.129231.071C0000.00000004.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00007720.00000000.129231.071C0000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00007720.00000000.129231.071C0000.00000004.mdmp, 00000000-00007720.00000001.131154.09590000.00000004.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00007720.00000000.129231.071C0000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00007720.00000000.129231.071C0000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00007720.00000000.129231.071C0000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00007720.00000000.129231.071C0000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00007720.00000000.129231.071C0000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00007720.00000000.129231.071C0000.00000004.mdmp") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; Source: "00000000-00007720.00000000.129231.071C0000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00007720.00000000.129231.071C0000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00007720.00000000.129231.071C0000.00000004.mdmp, 00000000-00007720.00000001.131154.09590000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00007720.00000000.129231.071C0000.00000004.mdmp, 00000000-00007720.00000001.131154.09590000.00000004.mdmp") Found reference to "PasswordDeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00007720.00000001.131154.09590000.00000004.mdmp") Found reference to "PasswordDeriveBytes" (Indicator: "PasswordDeriveBytes"; Source: "00000000-00007720.00000001.131154.09590000.00000004.mdmp") Found reference to "Rijndael" (Indicator: "Rijndael"; Source: "00000000-00007720.00000001.131154.09590000.00000004.mdmp") Found reference to "daQDCAes0YexbQowUD1JreiI8ie" (Indicator: "Aes"; Source: "00000000-00007720.00000001.131154.09590000.00000004.mdmp") Found reference to "TripleDES" (Indicator: "TripleDES"; Source: "00000000-00008088.00000000.131596.00400000.00000040.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00008088.00000000.131596.00400000.00000040.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00008088.00000000.131596.00400000.00000040.mdmp") Found reference to "AesGcm" (Indicator: "Aes"; Source: "00000000-00008088.00000000.131596.00400000.00000040.mdmp") Found reference to "AesGcm" (Indicator: "AesGcm"; Source: "00000000-00008088.00000000.131596.00400000.00000040.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00008088.00000000.131596.00400000.00000040.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00008088.00000000.131596.00400000.00000040.mdmp") Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "00000000-00008088.00000000.131596.00400000.00000040.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00008088.00000000.131596.00400000.00000040.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; Source: "00000000-00008088.00000000.131596.00400000.00000040.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; Source: "00000000-00008088.00000000.131596.00400000.00000040.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; Source: "00000000-00008088.00000000.131596.00400000.00000040.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp, 00000000-00008088.00000003.138576.02F60000.00000004.mdmp")29:T6b6," HTTP/1.1 200 OK Date: Thu 16 Apr 2026 08:47:00 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Thu 16 Apr 2026 08:47:00 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET /xml/64.124.12.162 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 16 Apr 2026 08:47:01 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 289122 Accept-Ranges: bytes last-modified: Mon 13 Apr 2026 00:28:19 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=kqzXESI6MQxqpBfuVt4kb2bZUDG4NIRFJqSiIjEnW9CHHlTdMUgLUS5%2BC4H4CkVO06OCMxoXtUFYshrhQ%2Fw9KkY4ARKAutVyvhLg8sFvOx2bZl4mBtq7Qx29rD4WXBvax67tfV9j"}]} CF-RAY: 9ed1ec44aacc6cb7-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Thu 16 Apr 2026 08:47:02 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Thu 16 Apr 2026 08:47:02 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 289122 Accept-Ranges: bytes last-modified: Mon 13 Apr 2026 00:28:19 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=%2FMgO%2BCfG3lN%2Ba8JAF2XDSY9oKZbtQ82zsQUYIueZNuR1jHlIe2Yte67wXZQ%2BYo290Aomf1D%2FqOZ9IFx%2FQrrlYsjOfngiv9IhStaiXwKPV%2BlSkcXU2fuVOa5CAYRtz5tOmegRYT5e"}]} CF-RAY: 9ed1ec471edc6cb7-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET /xml/64.124.12.162 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 16 Apr 2026 08:47:02 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 289123 Accept-Ranges: bytes last-modified: Mon 13 Apr 2026 00:28:19 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ojigz8n%2BiULycq8EFwzvYJTo9UbXk4n4WSm%2B292jkvm6klAB7446R8G1BoyJK2nOvowbDcoeZzBk0QJSSuS7mrYbZyEv4nY6JXqf5QqEUbT7NNcLtosaH3FnHUMyDYyuf34gxiH6"}]} CF-RAY: 9ed1ec4ac82bebe7-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 16 Apr 2026 08:47:03 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET /xml/64.124.12.162 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 16 Apr 2026 08:47:03 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 289124 Accept-Ranges: bytes last-modified: Mon 13 Apr 2026 00:28:19 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=BxmcuLKBx7hRtvCQIhXXiZ%2FP5%2BeveGMteE3JGvpRxMMb6G5c4Vz2TVb3Q2Pds%2Bs7c6go%2FLh6NHOeSy7aeTJbmoEn1e3U2CniU3LhERaWPZU1SuNMl1HCMCsgLjA9yH6CjvZ58WA6"}]} CF-RAY: 9ed1ec4ea8f1f3e8-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 16 Apr 2026 08:47:04 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Thu 16 Apr 2026 08:47:04 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 289124 Accept-Ranges: bytes last-modified: Mon 13 Apr 2026 00:28:19 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=%2BokKsPELbo6j6tu8F52IFYkkb%2BbrjicqEQdhAsA%2B61t1DV0M08gMup8t565yX%2B3wwvjOQxeM4%2F70fzp9bQ66RMYcP3xb9JR8jVT9KdQLW1NqiH4bc%2FltdRdY543%2BC2LPPWlHdvVZ"}]} CF-RAY: 9ed1ec545eeb545f-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 16 Apr 2026 08:47:05 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Thu 16 Apr 2026 08:47:06 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 289126 Accept-Ranges: bytes last-modified: Mon 13 Apr 2026 00:28:19 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=QGhpBBMZ4bjbn6nL%2BuJ0l4qz3p8h0Ypa%2FUdqEZE2oDxfF312oPCSMUKHHJCDaie9OOxGuENHdPzA6IKK3ok6GaGbmTdd1JP42MkNbH2S73JpCdu4xn1mCy2lJVpqc7GtOnFCgpib"}]} CF-RAY: 9ed1ec5e89511692-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 16 Apr 2026 08:47:07 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET /xml/64.124.12.162 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 16 Apr 2026 08:47:07 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 289127 Accept-Ranges: bytes last-modified: Mon 13 Apr 2026 00:28:19 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Ke8iIkP7gDYfpkTWOFR7OLsMsoOngHrEXwAvMGsEy4H9et48HqaWsyjk0Q7VSMWF7WnSPyb2SGBfqqji%2FJQGc6Vx%2FAIieCXdr%2BHN3WlDV0RzXszWVs8qnh0QJ6K5%2BS3i2XBNHcS3"}]} CF-RAY: 9ed1ec675de16ad1-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 16 Apr 2026 08:47:08 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET /xml/64.124.12.162 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 16 Apr 2026 08:47:09 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 289129 Accept-Ranges: bytes last-modified: Mon 13 Apr 2026 00:28:19 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=giGtz6XB9R4cudzLmGaspSGWRenmCm%2BiFJBJYSGLXVysMvVq8C9WXbc%2FMhIhCG4nYCaDjdTZ%2B9N701H6X5Uj7FiqmNTB2IFPxGS2mycZ8SjyWdQtQ5MKqkM8lFRGaFXZMMPD2IN8"}]} CF-RAY: 9ed1ec7209c1e16d-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 16 Apr 2026 08:47:09 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET /xml/64.124.12.162 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 16 Apr 2026 08:47:09 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 289130 Accept-Ranges: bytes last-modified: Mon 13 Apr 2026 00:28:19 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=XyAVe1NMuNAAzkRRMHQ7xBVuJ1dmVY00z1O%2FTHQXZeFGS54ZFqXf6srP%2BrFQXRsj27XaKq1KrkmvxUr9qH6z6m%2BiGV%2FvOPQrHPzQ9l9jMZ92kw%2FW%2BGcPVHliyaS1024R7BXGP%2Bu4"}]} CF-RAY: 9ed1ec76fc7e37c1-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465.......3d:T1832,"64.124.12.162USUnited StatesMIMichiganOkemos48864America/Detroit64.124.12.162"46:Td50,Heuristic match: "s@.er" Heuristic match: "ac.tl" Heuristic match: "tsx0w.my" Heuristic match: "checkip.dyndns.org" Heuristic match: "get / http/1.1user-agent: mozilla/4.0 (compatible; msie 6.0; windows nt 5.2; .net clr1.0.3705;)host: checkip.dyndns.org" Heuristic match: "reallyfreegeoip.org" Heuristic match: "api.telegram.org" Heuristic match: "hosting2.ro.hostsailor.com" Pattern match: "microsoft.net/framework/v4.0.30319/" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "00..td" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "http://ns.adobe.com/xap/1.0/" Pattern match: "ns.adobe.com/xap/1.0/rig" Pattern match: "http://ns.a" Pattern match: "http://ns.adobe.com/xa" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "http://purl.org/dc/elements/1.1/" Pattern match: "http://ns.adobe.com/xmp/identifier/qual/1.0/" Pattern match: "http://ns.adobe.com/xap/1.0/rights/" Pattern match: "http://ns.adobe.com/xap/1.0/mm/" Pattern match: "http://ns.adobe.com/xap/1.0/bj/" Pattern match: "http://ns.adobe.com/xap/1.0/t/pg/" Pattern match: "http://ns.adobe.com/pdf/1.3/" Pattern match: "http://ns.adobe.com/photoshop/1.0/" Pattern match: "http://ns.adobe.com/tiff/1.0/" Pattern match: "http://ns.adobe.com/exif/1.0/" Pattern match: "http://ns.adobe.com/xap/1.0/stype/dimensions#" Pattern match: "http://ns.adobe.com/xap/1.0/g/img/" Pattern match: "http://ns.adobe.com/xap/1.0/stype/resourceevent#" Pattern match: "http://ns.adobe.com/xap/1.0/stype/resourceref#" Pattern match: "http://ns.adobe.com/xap/1.0/stype/version#" Pattern match: "http://ns.adobe.com/xap/1.0/stype/job#" Pattern match: "http://ns.adobe.com/exif/1.0/aux/" Pattern match: "http://ns.adobe.com/camera-raw-settings/1.0/" Pattern match: "http://ns.adobe.com/xmp/1.0/dynamicmedia/" Pattern match: "http://iptc.org/std/iptc4xmpcore/1.0/xmlns/" Pattern match: "http://ns.microsoft.com/photo/1.0/" Pattern match: "http://ns.microsoft.com/photo/1.2/" Pattern match: "http://ns.microsoft.com/photo/1.2/t/regioninfo#" Pattern match: "http://ns.microsoft.com/photo/1.2/t/region#" Heuristic match: "pedfoliaz.my" Heuristic match: "]8.an" Pattern match: "https://fs.microsoft.com/fs/windows/config.json" Pattern match: "https://fs.microsoft.com/fs/windows/config.json,config,0" Heuristic match: "/o.ca" Heuristic match: "kmecrdysokoownlg9vjlsdona.my" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "http://aborters.duckdns.org:8081,http://anotherarmy.dns.army:8081" Pattern match: "reallyfreegeoip.org/xml/" Pattern match: "api.telegram.org/bot" Heuristic match: "remington.my" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "http://cheallyfreegeoip.org/" Heuristic match: "geoip.org" Heuristic match: "ntrust.net" Pattern match: "www.microsoft.com/pkiops" Pattern match: "www.api.telegram.org0" Pattern match: "www.digicert.com1+0"47:T5329,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007720.00000000.129231.027C0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportmdataoft\winfender\ows" - Source: "00000000-00007720.00000000.129231.04700000.00000004.mdmp") Found URL "http://ns.adobe.com/xap/1.0/xmpid8bimiplogscrdescimgdesciccp/www.w3.org/1999/02/22-r/xap/1.0/ns.adobe.com/xap/1.0/rig1.0/bj/photoshophttp://ns.a.adobe.com/http://ns.adobe.com/xa://ns.adobeapp1exifunknowninteropapp0app13iptc8bimiptc8bimresinfo8bimiptcdigestthumbtextxmpstructxmpbagxmpseqxmpaltlogscrdescimgdescgrctlextappextcommentextchrominanceluminancegamabkgditxtchrmhisticcpsrgbtimeddsinfotiffwmphotoadnghttp://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00007720.00000000.129231.07080000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json04/16" - Source: "00000000-00007720.00000000.129231.07B80000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,004/16" - Source: "00000000-00007720.00000000.129231.07B80000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007720.00000001.131154.027C0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportmdataoft\winfender\ows" - Source: "00000000-00007720.00000001.131154.04700000.00000004.mdmp") Found URL "http://ns.adobe.com/xap/1.0/xmpid8bimiplogscrdescimgdesciccp/www.w3.org/1999/02/22-r/xap/1.0/ns.adobe.com/xap/1.0/rig1.0/bj/photoshophttp://ns.a.adobe.com/http://ns.adobe.com/xa://ns.adobeapp1exifunknowninteropapp0app13iptc8bimiptc8bimresinfo8bimiptcdigestthumbtextxmpstructxmpbagxmpseqxmpaltlogscrdescimgdescgrctlextappextcommentextchrominanceluminancegamabkgditxtchrmhisticcpsrgbtimeddsinfotiffwmphotoadnghttp://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00007720.00000001.131154.070BF000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00007720.00000001.131154.6F5B1000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00007720.00000001.131154.6F5B1000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00007720.00000001.131154.6F5B1000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007720.00000001.131154.71E11000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007720.00000002.131602.027C0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportmdataoft\winfender\dows" - Source: "00000000-00007720.00000002.131602.04700000.00000004.mdmp") Found URL "http://ns.adobe.com/xap/1.0/xmpidbj*+" - Source: "00000000-00007720.00000002.131602.070D5000.00000004.mdmp") Found URL "http://aborters.duckdns.org:8081,http://anotherarmy.dns.army:8081srokyichvpfhakipzaxnnchkmgklnaizhgmyrnjfulidgkftkrtelinhfklkjrkdexmvkeucxukugr$hash" - Source: "00000000-00008088.00000000.131596.00400000.00000040.mdmp") Found URL "http://cheallyfreegeoip.org/reallyfreegeoip.org1000" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops2058-11e1f-8f6e6wmtxpmt" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiopsasycpa+w" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;globalsign" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czceysweyr" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl02.23.42.7.0fw4=k%[" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?geotrust" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00008088.00000002.133465.02F60000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008088.00000002.133465.08C20000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00008088.00000002.133465.08C20000.00000004.mdmp") Found URL "http://cheallyfreegeoip.org/reallyfreegeoip.org1000" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops2058-11e1f-8f6e6wmtxpmt" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiopsasycpa+w" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;globalsign" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czceysweyr" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl02.23.42.7.0fw4=k%[" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?geotrust" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00008088.00000003.138576.02F60000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008088.00000003.138576.08C20000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00008088.00000003.138576.08C20000.00000004.mdmp")48:T97e,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007720.00000000.129231.027C0000.00000004.mdmp, 00000000-00007720.00000001.131154.027C0000.00000004.mdmp, 00000000-00007720.00000002.131602.027C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007720.00000000.129231.027C0000.00000004.mdmp, 00000000-00007720.00000001.131154.027C0000.00000004.mdmp, 00000000-00007720.00000002.131602.027C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007720.00000000.129231.027C0000.00000004.mdmp, 00000000-00007720.00000001.131154.027C0000.00000004.mdmp, 00000000-00007720.00000002.131602.027C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007720.00000000.129231.027C0000.00000004.mdmp, 00000000-00007720.00000001.131154.027C0000.00000004.mdmp, 00000000-00007720.00000002.131602.027C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007720.00000000.129231.027C0000.00000004.mdmp, 00000000-00007720.00000001.131154.027C0000.00000004.mdmp, 00000000-00007720.00000002.131602.027C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007720.00000000.129231.027C0000.00000004.mdmp, 00000000-00007720.00000001.131154.027C0000.00000004.mdmp, 00000000-00007720.00000002.131602.027C0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007720.00000000.129231.027C0000.00000004.mdmp, 00000000-00007720.00000001.131154.027C0000.00000004.mdmp, 00000000-00007720.00000002.131602.027C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007720.00000000.129231.027C0000.00000004.mdmp, 00000000-00007720.00000001.131154.027C0000.00000004.mdmp, 00000000-00007720.00000002.131602.027C0000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00008088.00000000.131596.00400000.00000040.mdmp")49:T9e4,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007720.00000000.129231.027C0000.00000004.mdmp, 00000000-00007720.00000001.131154.027C0000.00000004.mdmp, 00000000-00007720.00000002.131602.027C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00007720.00000000.129231.027C0000.00000004.mdmp\n 00000000-00007720.00000001.131154.027C0000.00000004.mdmp\n 00000000-00007720.00000002.131602.027C0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007720.00000000.129231.071C0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007720.00000001.131154.09590000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008088.00000000.131596.00400000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00008088-00000C2C-1012622375\")\n Found reference to API \"CryptUnprotectDataW\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00008088-00000C2C-1012622406\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00008088.00000000.131596.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00007720.00000000.129231.071C0000.00000004.mdmp, 00000000-00007720.00000001.131154.09590000.00000004.mdmp\")\n Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00007720.00000001.131154.09580000.00000004.mdmp, 00000000-00007720.00000002.131602.09580000.00000004.mdmp\")\n Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00008088.00000000.131596.00400000.00000040.mdmp\")\n Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00008088.00000000.131596.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00008088.00000000.131596.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00007720.00000000.129231.071C0000.00000004.mdmp, 00000000-00007720.00000001.131154.09590000.00000004.mdmp\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00008088.00000000.131596.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/decrypt data using TripleDES","description":"Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00008088.00000000.131596.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-486","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00007720.00000000.129231.071C0000.00000004.mdmp\")\n Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00007720.00000001.131154.09570000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to retrieve key from a password using PBKDF1 algorithm","description":"Found reference to API \"PasswordDeriveBytes\" (Indicator: \"PasswordDeriveBytes\"; Source: \"00000000-00007720.00000001.131154.09590000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-487","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00008088.00000002.133465.02F60000.00000004.mdmp, 00000000-00008088.00000003.138576.02F60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2e","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2f","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$30","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007720-00000C2C-960962936\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007720-00000C2C-961596300\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"get_MachineName\" (Source: \"00000000-00008088.00000000.131596.00400000.00000040.mdmp, 00000000-00008088.00000003.138576.00842000.00000002.mdmp\")\n Found string \"get_UserName\" (Source: \"00000000-00008088.00000000.131596.00400000.00000040.mdmp, 00000000-00008088.00000003.138576.00842000.00000002.mdmp\")\n Found string \"set_UserName\" (Source: \"00000000-00008088.00000000.131596.00400000.00000040.mdmp\")\n Found string \"get_OSVersion\" (Source: \"00000000-00008088.00000000.131596.00400000.00000040.mdmp\")\n Found string \"GetDrives\" (Source: \"00000000-00008088.00000000.131596.00400000.00000040.mdmp, 00000000-00008088.00000003.138576.00842000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007720-00000C2C-960962936\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007720-00000C2C-961596300\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using web history","description":"$31","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-662","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00007720-00000C2C-961358228\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007720-00000C2C-959188339\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007720-00000C2C-959188825\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007720.00000001.131154.6F641000.00000002.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007720.00000001.131154.6F641000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007720.00000001.131154.6F641000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus\" (Source: \"00000000-00007720.00000001.131154.6F641000.00000002.mdmp\")\n Found string \"QueryServiceConfigW\" (Source: \"00000000-00007720.00000001.131154.6F641000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00008088-00000C2C-1000742652\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in \"00000000-00007720.00000001.131154.6F641000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00007720.00000001.131154.6F641000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00007720.00000001.131154.6F641000.00000002.mdmp, 00000000-00007720.00000002.131602.71E25000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00008088.00000000.131596.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00007720-00000C2C-999783104\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00007720-00000C2C-999783137\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007720.00000000.129231.027C0000.00000004.mdmp, 00000000-00007720.00000001.131154.027C0000.00000004.mdmp, 00000000-00007720.00000002.131602.027C0000.00000004.mdmp\")\n Found reference to API \"sendMessage?chat_id=\" (Indicator: \"sendmessage\"; Source: \"00000000-00008088.00000000.131596.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00008088.00000002.133465.02F60000.00000004.mdmp, 00000000-00008088.00000003.138576.02F60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00007720.00000001.131154.6F641000.00000002.mdmp\"\n Found registry query API: \"RegEnumValueW\" in \"00000000-00007720.00000001.131154.6F641000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00007720.00000001.131154.6F641000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00007720.00000001.131154.6F641000.00000002.mdmp\"\n Found registry query API: \"RegQueryInfoKeyW\" in \"00000000-00007720.00000001.131154.6F641000.00000002.mdmp\"\n Found registry query API: \"RegNotifyChangeKeyValue\" in \"00000000-00007720.00000001.131154.6F641000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00008088.00000000.131596.00400000.00000040.mdmp\")\n Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00008088.00000000.131596.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"get_ProcessName\" (Source: \"00000000-00007720.00000000.129231.071C0000.00000004.mdmp\")\n Found string \"GetProcessById\" (Source: \"00000000-00007720.00000001.131154.09590000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"00000000-00007720.00000001.131154.09590000.00000004.mdmp\")\n Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00007720.00000001.131154.6F641000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00007720.00000001.131154.6F641000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$49","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69e0a1a58e978bd06801f6de"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"