26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T506,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 23f44bfb503a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 23f44bfb503a…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 8/27 AV engines flagged this file. 11 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523"],"about":{"@type":"SoftwareApplication","name":"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":8,"total":27},"behavioralIndicators":{"malicious":11,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T99b,Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt32" in "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadIntPtr" in "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt16" in "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadByte" in "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringUni" in "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StringToHGlobalUni" in "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt64" in "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin"28:T1906,Found reference to "HMACSHA1" (Indicator: "HMAC"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "HMACSHA512" (Indicator: "HMAC"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "HMACSHA512" (Indicator: "HMACSHA512"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "HMACSHA512" (Indicator: "SHA512"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "Rijndael" (Indicator: "Rijndael"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "CryptographicException" (Indicator: "CryptographicException"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "SHA1CryptoServiceProvider" (Indicator: "SHA1CryptoServiceProvider"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "RNGCryptoServiceProvider" (Indicator: "RNGCryptoServiceProvider"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to "HMACSHA1" (Indicator: "HMAC"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp, 00000000-00002492.00000000.171886.05340000.00000004.mdmp, 00000000-00002492.00000001.173806.05340000.00000004.mdmp") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp, 00000000-00002492.00000000.171886.05340000.00000004.mdmp, 00000000-00002492.00000001.173806.05340000.00000004.mdmp") Found reference to "HMACSHA512" (Indicator: "HMAC"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp, 00000000-00002492.00000000.171886.05340000.00000004.mdmp, 00000000-00002492.00000001.173806.05340000.00000004.mdmp") Found reference to "HMACSHA512" (Indicator: "HMACSHA512"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp, 00000000-00002492.00000000.171886.05340000.00000004.mdmp, 00000000-00002492.00000001.173806.05340000.00000004.mdmp") Found reference to "HMACSHA512" (Indicator: "SHA512"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp, 00000000-00002492.00000000.171886.05340000.00000004.mdmp, 00000000-00002492.00000001.173806.05340000.00000004.mdmp") Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp, 00000000-00002492.00000000.171886.05340000.00000004.mdmp, 00000000-00002492.00000001.173806.05340000.00000004.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp, 00000000-00002492.00000000.171886.05340000.00000004.mdmp, 00000000-00002492.00000001.173806.05340000.00000004.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found reference to "Rijndael" (Indicator: "Rijndael"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp, 00000000-00002492.00000000.171886.05340000.00000004.mdmp, 00000000-00002492.00000001.173806.05340000.00000004.mdmp")29:T4d3,"" (Indicator: "enumchildwindows"; Source: "00000000-00002492.00000000.171886.030E0000.00000004.mdmp, 00000000-00002492.00000001.173806.030E0000.00000004.mdmp, 00000000-00002492.00000002.175726.030E0000.00000004.mdmp, 00000000-00002492.00000003.181233.030E0000.00000004.mdmp") Found reference to API "sendMessageChannelCache" (Indicator: "sendmessage"; Source: "00000000-00002492.00000000.171886.05340000.00000004.mdmp, 00000000-00002492.00000001.173806.05340000.00000004.mdmp") Found reference to API "System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00002492.00000000.171886.05340000.00000004.mdmp, 00000000-00002492.00000001.173806.05340000.00000004.mdmp")31:Teec,"9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00002492.00000001.173806.086A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002492.00000001.173806.086A0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00002492.00000001.173806.086A0000.00000004.mdmp") Found URL "http://osoft.com0'6*l1.3.132.0.35@eckp" - Source: "00000000-00002492.00000001.173806.086A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00002492.00000001.173806.086A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00002492.00000001.173806.086A0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00002492.00000001.173806.086A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00002492.00000001.173806.086A0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002492.00000001.173806.086A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0com1" - Source: "00000000-00002492.00000001.173806.086A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_201crt0t<" - Source: "00000000-00002492.00000001.173806.086A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/product=lceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002492.00000001.173806.086A0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002492.00000002.175726.030E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00002492.00000002.175726.031C3000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00002492.00000002.175726.031C3000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwu\0digicert" - Source: "00000000-00002492.00000002.175726.031C3000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002492.00000002.175726.086A0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002492.00000002.175726.086A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002492.00000002.175726.086A0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002492.00000002.175726.086A0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002492.00000002.175726.086A0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?emgvw,czc%wvfglobalsign" - Source: "00000000-00002492.00000002.175726.086A0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002492.00000002.175726.086A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002492.00000002.175726.086A0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00002492.00000002.175726.086A0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00002492.00000002.175726.086A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002492.00000002.175726.086A0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00002492.00000002.175726.086A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00002492.00000002.175726.086A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00002492.00000002.175726.086A0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00002492.00000002.175726.086A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00002492.00000002.175726.086A0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002492.00000002.175726.086A0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002492.00000003.181233.030E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00002492.00000003.181233.031C3000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00002492.00000003.181233.031C3000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwu\0digicert" - Source: "00000000-00002492.00000003.181233.031C3000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002492.00000003.181233.086A0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002492.00000003.181233.086A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002492.00000003.181233.086A0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002492.00000003.181233.086A0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002492.00000003.181233.086A0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?emgvw,czc%wvfglobalsign" - Source: "00000000-00002492.00000003.181233.086A0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002492.00000003.181233.086A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002492.00000003.181233.086A0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00002492.00000003.181233.086A0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00002492.00000003.181233.086A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002492.00000003.181233.086A0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00002492.00000003.181233.086A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00002492.00000003.181233.086A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00002492.00000003.181233.086A0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00002492.00000003.181233.086A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00002492.00000003.181233.086A0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002492.00000003.181233.086A0000.00000004.mdmp")48:T46f,Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00002492.00000000.171886.030E0000.00000004.mdmp, 00000000-00002492.00000001.173806.030E0000.00000004.mdmp, 00000000-00002492.00000002.175726.030E0000.00000004.mdmp, 00000000-00002492.00000003.181233.030E0000.00000004.mdmp") Found string "+ncalrpc:[OLEB7C35084A078EC9CD706043D476F]" (Indicator: "ncalrpc"; Source: "00000000-00002492.00000000.171886.030E0000.00000004.mdmp, 00000000-00002492.00000001.173806.030E0000.00000004.mdmp, 00000000-00002492.00000002.175726.030E0000.00000004.mdmp, 00000000-00002492.00000003.181233.030E0000.00000004.mdmp") Found string "+ncalrpc:[OLE797E44A142F12EFF6871B892C05A]" (Indicator: "ncalrpc"; Source: "00000000-00002492.00000000.171886.030E0000.00000004.mdmp, 00000000-00002492.00000001.173806.030E0000.00000004.mdmp, 00000000-00002492.00000002.175726.030E0000.00000004.mdmp, 00000000-00002492.00000003.181233.030E0000.00000004.mdmp") Found string "B+ncalrpc:[OLEB7C35084A078EC9CD706043D476F]" (Indicator: "ncalrpc"; Source: "00000000-00002492.00000000.171886.030E0000.00000004.mdmp")49:T484,Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00002492.00000000.171886.030E0000.00000004.mdmp, 00000000-00002492.00000001.173806.030E0000.00000004.mdmp, 00000000-00002492.00000001.173806.05340000.00000004.mdmp, 00000000-00002492.00000002.175726.031C3000.00000004.mdmp, 00000000-00002492.00000003.181233.031C3000.00000004.mdmp") Found string ":\WINDOWS\SysWOW64\Kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00002492.00000001.173806.030E0000.00000004.mdmp, 00000000-00002492.00000002.175726.031C3000.00000004.mdmp, 00000000-00002492.00000003.181233.031C3000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00002492.00000001.173806.030E0000.00000004.mdmp, 00000000-00002492.00000002.175726.031C3000.00000004.mdmp, 00000000-00002492.00000003.181233.031C3000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00002492.00000001.173806.030E0000.00000004.mdmp, 00000000-00002492.00000001.173806.05340000.00000004.mdmp, 00000000-00002492.00000002.175726.031C3000.00000004.mdmp, 00000000-00002492.00000003.181233.031C3000.00000004.mdmp")4a:T9e4,"" (Indicator: "base64"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found string "Pass encoding="base64">" (Indicator: "base64"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found string "BCRYPT_AES_ALGORITHM" (Indicator: "aes"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found string "RijndaelManaged" (Indicator: "rijndael"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found string "Rijndael" (Indicator: "rijndael"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp, 00000000-00002492.00000000.171886.05340000.00000004.mdmp, 00000000-00002492.00000001.173806.05340000.00000004.mdmp") Found string "CryptoStream" (Indicator: "cryptostream"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found string "RNGCryptoServiceProvider" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp")4c:Tbe3,Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002492.00000000.171886.030E0000.00000004.mdmp, 00000000-00002492.00000001.173806.030E0000.00000004.mdmp, 00000000-00002492.00000002.175726.030E0000.00000004.mdmp, 00000000-00002492.00000003.181233.030E0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002492.00000000.171886.030E0000.00000004.mdmp, 00000000-00002492.00000001.173806.030E0000.00000004.mdmp, 00000000-00002492.00000002.175726.030E0000.00000004.mdmp, 00000000-00002492.00000003.181233.030E0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002492.00000000.171886.030E0000.00000004.mdmp, 00000000-00002492.00000001.173806.030E0000.00000004.mdmp, 00000000-00002492.00000002.175726.030E0000.00000004.mdmp, 00000000-00002492.00000003.181233.030E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002492.00000000.171886.030E0000.00000004.mdmp, 00000000-00002492.00000001.173806.030E0000.00000004.mdmp, 00000000-00002492.00000002.175726.030E0000.00000004.mdmp, 00000000-00002492.00000003.181233.030E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002492.00000000.171886.030E0000.00000004.mdmp, 00000000-00002492.00000001.173806.030E0000.00000004.mdmp, 00000000-00002492.00000002.175726.030E0000.00000004.mdmp, 00000000-00002492.00000003.181233.030E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002492.00000000.171886.030E0000.00000004.mdmp, 00000000-00002492.00000001.173806.030E0000.00000004.mdmp, 00000000-00002492.00000002.175726.030E0000.00000004.mdmp, 00000000-00002492.00000003.181233.030E0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002492.00000000.171886.030E0000.00000004.mdmp, 00000000-00002492.00000001.173806.030E0000.00000004.mdmp, 00000000-00002492.00000002.175726.030E0000.00000004.mdmp, 00000000-00002492.00000003.181233.030E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002492.00000000.171886.030E0000.00000004.mdmp, 00000000-00002492.00000001.173806.030E0000.00000004.mdmp, 00000000-00002492.00000002.175726.030E0000.00000004.mdmp, 00000000-00002492.00000003.181233.030E0000.00000004.mdmp")4d:T4ae,Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp")4e:Tcba,Found string "k__BackingField" (Indicator: "password"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found string "get_password" (Indicator: "password"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found string "set_password" (Indicator: "password"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found string "passwordVaultPtr" (Indicator: "password"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found string "" (Indicator: "password"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found string "" (Indicator: "password"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found string "syncpassword" (Indicator: "password"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found string "" (Indicator: "password"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found string "" (Indicator: "password"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found string "password-check" (Indicator: "password"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found string "password_value" (Indicator: "password"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found string "\\passwordstorerc" (Indicator: "password"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found string "password=" (Indicator: "password"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found string "password" (Indicator: "password"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found string ".*\"password\":\"(.*?)\"" (Indicator: "password"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found string "passwordstorerc" (Indicator: "password"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found string "*"password":"(.*?)"" (Indicator: "password"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found string "server_user_password>" (Indicator: "password"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found string "/server_user_password>" (Indicator: "password"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found string "yncpassword" (Indicator: "password"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found string "password>" (Indicator: "password"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found string "/password>" (Indicator: "password"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found string "k__BackingField" (Indicator: "password"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found string "get_password" (Indicator: "password"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp") Found string "set_password" (Indicator: "password"; Source: "00000000-00002492.00000000.171886.00B62000.00000002.mdmp")4f:T9ef,"Software\Microsoft\Office\11.0\Outlook\Profiles" in Source: 23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin "Software\Microsoft\Office\12.0\Outlook\Profiles" in Source: 23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin "Software\Microsoft\Office\14.0\Outlook\Profiles" in Source: 23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin "Software\Microsoft\Office\15.0\Outlook\Profiles" in Source: 23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin "Software\Microsoft\Office\16.0\Outlook\Profiles" in Source: 23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin "\VirtualStore\Program Files\Foxmail\mail" in Source: 23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin "\VirtualStore\Program Files (x86)\Foxmail\mail" in Source: 23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin "\Opera Mail\Opera Mail\wand.dat" in Source: 23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin "\Thunderbird\" in Source: 23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin "\Postbox\" in Source: 23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin "\\Claws-mail" in Source: 600009b-cPs8D~Grab "Software\\Microsoft\\Office\\11.0\\Outlook\\Profiles" in Source: 60000f8-e4dn67nq5l7~Grab "Software\\Microsoft\\Office\\12.0\\Outlook\\Profiles" in Source: 60000f8-e4dn67nq5l7~Grab "Software\\Microsoft\\Office\\14.0\\Outlook\\Profiles" in Source: 60000f8-e4dn67nq5l7~Grab "Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles" in Source: 60000f8-e4dn67nq5l7~Grab "Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles" in Source: 60000f8-e4dn67nq5l7~Grab "\\Opera Mail\\Opera Mail\\wand.dat" in Source: 6000106-72CF8egH~Grab "\\Pocomail\\accounts.ini" in Source: 600010c-0s5HDZiqdxd~Grab "\\Thunderbird\\" in Source: 6000179-Xh225CH~2QoCY "\\Postbox\\" in Source: 6000179-Xh225CH~2QoCY "oftware\Microsoft\Office\11.0\Outlook\Profiles" in Source: 00000000-00002492.00000000.171886.00B62000.00000002.mdmp "oftware\Microsoft\Office\12.0\Outlook\Profiles" in Source: 00000000-00002492.00000000.171886.00B62000.00000002.mdmp "oftware\Microsoft\Office\14.0\Outlook\Profiles" in Source: 00000000-00002492.00000000.171886.00B62000.00000002.mdmp "oftware\Microsoft\Office\15.0\Outlook\Profiles" in Source: 00000000-00002492.00000000.171886.00B62000.00000002.mdmp "oftware\Microsoft\Office\16.0\Outlook\Profiles" in Source: 00000000-00002492.00000000.171886.00B62000.00000002.mdmp50:T85f,"\VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftp commander") "\VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftplist.txt") "\FTPGetter\servers.xml" (Indicator: "\ftpgetter") "quick.dat" (Indicator: "quick.dat") "FTP Navigator" (Indicator: "ftp navigator") "\\FTP Navigator\\Ftplist.txt" (Indicator: "ftp navigator") "\\FTP Navigator\\Ftplist.txt" (Indicator: "ftplist.txt") "\\Program Files (x86)\\FTP Commander\\Ftplist.txt" (Indicator: "ftp commander") "\\Program Files (x86)\\FTP Commander\\Ftplist.txt" (Indicator: "ftplist.txt") "\\Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt" (Indicator: "ftp commander") "\\Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt" (Indicator: "ftplist.txt") "\\VirtualStore\\Program Files (x86)\\FTP Commander\\Ftplist.txt" (Indicator: "ftp commander") "\\VirtualStore\\Program Files (x86)\\FTP Commander\\Ftplist.txt" (Indicator: "ftplist.txt") "\\cftp\\Ftplist.txt" (Indicator: "ftplist.txt") "\\VirtualStore\\Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt" (Indicator: "ftp commander") "\\VirtualStore\\Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt" (Indicator: "ftplist.txt") "\\FTPGetter\\servers.xml" (Indicator: "\ftpgetter") "FTP Navigator\Ftplist.txt" (Indicator: "ftp navigator") "FTP Navigator\Ftplist.txt" (Indicator: "ftplist.txt") "Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftp commander") "Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftplist.txt") "Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftp commander") "Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftplist.txt") "VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftp commander") "VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftplist.txt") "cftp\Ftplist.txt" (Indicator: "ftplist.txt") "VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftp commander") "VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftplist.txt")51:T59a,Found string "\Device\LanmanRedirector\" (Indicator: "\Device\"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found string "\\Device\\LanmanRedirector\\" (Indicator: "\Device\"; File: "23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002492.00000000.171886.030E0000.00000004.mdmp, 00000000-00002492.00000001.173806.030E0000.00000004.mdmp, 00000000-00002492.00000002.175726.030E0000.00000004.mdmp, 00000000-00002492.00000003.181233.030E0000.00000004.mdmp") Found string "Win32API|System Information Functions|GetSystemDirectory|\drivers\etc\lmhosts" (Indicator: "\drivers\"; Source: "00000000-00002492.00000001.173806.030E0000.00000004.mdmp, 00000000-00002492.00000002.175726.031C3000.00000004.mdmp, 00000000-00002492.00000003.181233.031C3000.00000004.mdmp") Found string "%SystemRoot%\System32\drivers\etc" (Indicator: "\drivers\"; Source: "00000000-00002492.00000001.173806.030E0000.00000004.mdmp, 00000000-00002492.00000002.175726.031C3000.00000004.mdmp, 00000000-00002492.00000003.181233.031C3000.00000004.mdmp") Found string "%SystemRoot%\System32\drivers\etc" (Indicator: "system32\drivers"; Source: "00000000-00002492.00000001.173806.030E0000.00000004.mdmp, 00000000-00002492.00000002.175726.031C3000.00000004.mdmp, 00000000-00002492.00000003.181233.031C3000.00000004.mdmp")52:T802,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002492.00000000.171886.030E0000.00000004.mdmp, 00000000-00002492.00000001.173806.030E0000.00000004.mdmp, 00000000-00002492.00000002.175726.030E0000.00000004.mdmp, 00000000-00002492.00000003.181233.030E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00002492.00000001.173806.05340000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00002492.00000001.173806.05340000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\root\\cimv2; Source: \"00000000-00002492.00000000.171886.030E0000.00000004.mdmp, 00000000-00002492.00000001.173806.030E0000.00000004.mdmp, 00000000-00002492.00000002.175726.030E0000.00000004.mdmp, 00000000-00002492.00000003.181233.030E0000.00000004.mdmp\")\n Found string - \\\\.\\root\\cimv2; Source: \"00000000-00002492.00000000.171886.05340000.00000004.mdmp, 00000000-00002492.00000001.173806.05340000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002492.00000000.171886.05340000.00000004.mdmp, 00000000-00002492.00000001.173806.05340000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002492.00000000.171886.05340000.00000004.mdmp, 00000000-00002492.00000001.173806.05340000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\"\n Observed function \"ToBase64String\" in \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; File: \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\")\n Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; File: \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\")\n Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00002492.00000000.171886.00B62000.00000002.mdmp\")\n Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00002492.00000000.171886.00B62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; File: \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\")\n Found api reference \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00002492.00000000.171886.00B62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00002492.00000000.171886.00B62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/decrypt data using TripleDES","description":"Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; File: \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\")\n Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00002492.00000000.171886.00B62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-486","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES cryptographic operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-167","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; File: \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00002492.00000000.171886.00B62000.00000002.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002492.00000000.171886.00B62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002492.00000000.171886.05340000.00000004.mdmp, 00000000-00002492.00000001.173806.05340000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002492.00000000.171886.05340000.00000004.mdmp, 00000000-00002492.00000001.173806.05340000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\"\n Observed namespace \"System.Security.Cryptography.TripleDESCryptoServiceProvider\" and TypeReference \".ctor\" in \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\"\n Observed namespace \"System.Security.Cryptography.DESCryptoServiceProvider\" and TypeReference \".ctor\" in \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\"\n Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\"\n Observed namespace \"System.Security.Cryptography.Rijndael\" and TypeReference \"Create\" in \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains symmetric decryption functionality in .NET code","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Cryptographic Related","name":"Dotnet code contains ability to generate random numbers","description":"Observed namespace \"System.Security.Cryptography.RandomNumberGenerator\" and TypeReference \"GetBytes\" in \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\"\n Observed namespace \"System.Security.Cryptography.RNGCryptoServiceProvider\" and TypeReference \".ctor\" in \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-150","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"Keep\" in header \"GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2f","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002492-00000C2C-1626834348\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002492.00000000.171886.00B62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetFiles\" in \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\"\n Observed dotnet function \"GetDirectories\" in \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"get_UserName\" (Source: \"00000000-00002492.00000000.171886.00B62000.00000002.mdmp\")\n Found string \"get_OSVersion\" (Source: \"00000000-00002492.00000000.171886.00B62000.00000002.mdmp\")\n Found string \"GetLogicalDrives\" (Source: \"00000000-00002492.00000000.171886.00B62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002492-00000C2C-1626834348\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002492.00000000.171886.00B62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; File: \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00002492.00000000.171886.00B62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00002492-00000C2C-1660617752\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00002492-00000C2C-1625653441\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002492-00000C2C-1625653957\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002492-00000C2C-1630418525\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"NtQuerySystemInformation\" in file \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\"\n Found system information discovery API: \"NtQuerySystemInformation\" in \"00000000-00002492.00000000.171886.00B62000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00002492.00000000.171886.00B62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" HTTP/1.1 200 OK\nDate: Tue\n 17 Feb 2026 09:22:56 GMT\nContent-Type: text/plain\nContent-Length: 13\nConnection: keep-alive\nServer: cloudflare\nVary: Origin\ncf-cache-status: DYNAMIC\nCF-RAY: 9cf4391d69f32855-SJC with response body ==>36342E3132342E31322E313632.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002492.00000000.171886.05340000.00000004.mdmp, 00000000-00002492.00000001.173806.05340000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueEx\" in file \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\"\n Found registry query API: \"RegOpenKeyEx\" in file \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\"\n Found registry query API: \"RegQueryValueEx\" in \"00000000-00002492.00000000.171886.00B62000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyEx\" in \"00000000-00002492.00000000.171886.00B62000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"23f44bfb503aecff7ee5862f7ea2e0df70f019518086baa6ab8848c333b22523.bin\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00002492.00000000.171886.00B62000.00000002.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00002492.00000000.171886.00B62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"get_ProcessName\" (Source: \"00000000-00002492.00000000.171886.00B62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6994334c208eecf93401d5fb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"