26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4cc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 31e865593612… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 31e865593612…. Malware family: Trojan.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 16 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/31e865593612d7aaaf78295fbcac8bbb765349eafa691fdf4fd624e0d2880a37","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","31e865593612d7aaaf78295fbcac8bbb765349eafa691fdf4fd624e0d2880a37"],"about":{"@type":"SoftwareApplication","name":"31e865593612d7aaaf78295fbcac8bbb765349eafa691fdf4fd624e0d2880a37.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"31e865593612d7aaaf78295fbcac8bbb765349eafa691fdf4fd624e0d2880a37","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":12,"total":27},"behavioralIndicators":{"malicious":16,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T952,Found string "policy.3.0.System.Management.Automation.resources" (Source: "00000000-00007660.00000000.126620.00F87000.00000004.mdmp, 00000000-00007660.00000001.127290.0796A000.00000004.mdmp, 00000000-00007660.00000001.127290.07B6B000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00007660.00000000.126620.034A0000.00000004.mdmp, 00000000-00007660.00000001.127290.034A0000.00000004.mdmp, 00000000-00007660.00000001.127290.0357D000.00000004.mdmp, 00000000-00007660.00000001.127290.07D10000.00000004.mdmp, 00000000-00007660.00000001.127290.09810000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\" (Source: "00000000-00007660.00000000.126620.034A0000.00000004.mdmp") Found string "ile:///C:/Windows/SysWOW64/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources.EXE" (Source: "00000000-00007660.00000000.126620.034A0000.00000004.mdmp") Found string "ile:///C:/Windows/SysWOW64/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources.DLL" (Source: "00000000-00007660.00000000.126620.034A0000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" (Source: "00000000-00007660.00000000.126620.034A0000.00000004.mdmp") Found string "2,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",0" (Source: "00000000-00007660.00000000.126620.034A0000.00000004.mdmp, 00000000-00007660.00000001.127290.034A0000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00007660.00000000.126620.034A0000.00000004.mdmp, 00000000-00007660.00000001.127290.034A0000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00007660.00000001.127290.0357D000.00000004.mdmp, 00000000-00007660.00000001.127290.096C0000.00000004.mdmp") Found string "policy.3.0.System.Management.Automation.resources_en-US_31bf3856ad364e35" (Source: "00000000-00007660.00000001.127290.0796A000.00000004.mdmp, 00000000-00007660.00000001.127290.07B6B000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00007660.00000001.127290.0796A000.00000004.mdmp")28:T441,Found reference string ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\31e865593612d7aaaf78295fbcac8bbb76" (Indicator: "add-mppreference"; Source: "00000000-00004396-00000C46-13866146187"), Found reference string "Add-MpPreference -ExclusionPath "C:\31e865593612d7aaaf78295fbcac8bbb765349eafa691fdf4fd624e0d2880a37.bin.exe"" (Indicator: "add-mppreference"; File: "powershell.exe"), Found reference string ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\31e865593612d7aaaf78295fbcac8bbb765349eafa691fdf4fd624e0d2880a37.bin.exe"" (Indicator: "add-mppreference"; Source: "00000000-00007660.00000000.126620.034A0000.00000004.mdmp 00000000-00007660.00000001.127290.034A0000.00000004.mdmp"), Found reference string "HostApplication=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\31e865593612d7aaaf78295fbcac8bbb765349eafa691fdf4fd624e0d2880a37.bin.exe" (Indicator: "add-mppreference"; Source: "00000000-00007660.00000001.127290.07D10000.00000004.mdmp")29:T22c8,Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.00400000.00000040.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMAC" (Indicator: "HMAC"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp")2a:T613,"x@rrx*.sr" Heuristic match: "^g.md" Heuristic match: "to.gb" Heuristic match: "o]}.zw" Heuristic match: "ip-api.com" Heuristic match: "$this.name" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "web.co" Pattern match: "microsoft.net/assembly/gac_msil/system/v4.0_4.0.0.0__b77a5c561934e089/system.dll" Heuristic match: "m.web.se" Heuristic match: "mt@.mt" Heuristic match: "cim_system.name" Heuristic match: "m.name" Heuristic match: "mb.bn" Heuristic match: "/.net/netclasses/httpwebrequest/connect__group$$/" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315#withcomments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#withcomments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/tr/1999/rec-xpath-19991116" Pattern match: "http://www.w3.org/tr/1999/rec-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#xml" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://schemas.microsoft.com/.netconfiguration/v2.0" Pattern match: "system.web/anonymousidentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browsercaps" Pattern match: "system.web/clienttarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customerrors" Pattern match: "system.web/deployment" Pattern match: "system.web/devicefilters" Pattern match: "system.web/fulltrustassemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthmonitoring" Pattern match: "system.web/hostingenvironment" Pattern match: "system.web/httpcookies" Pattern match: "system.web/httphandlers" Pattern match: "system.web/httpmodules" Pattern match: "system.web/httpruntime" Pattern match: "system.web/identity" Pattern match: "system.web/machinekey" Pattern match: "system.web/membership" Pattern match: "system.web/mobilecontrols" Pattern match: "system.web/pages" Pattern match: "system.web/partialtrustvisibleassemblies" Pattern match: "system.web/processmodel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/rolemanager" Pattern match: "system.web/securitypolicy" Pattern match: "system.web/sessionpagestate" Pattern match: "system.web/sessionstate" Pattern match: "system.web/sitemap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlmappings" Pattern match: "system.web/webcontrols" Pattern match: "system.web/webparts" Pattern match: "system.web/webservices" Pattern match: "system.web/xhtmlconformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputcache" Pattern match: "system.web/caching/outputcachesettings" Pattern match: "system.web/caching/sqlcachedependency" Heuristic match: "ftp://ftp.duct-master.com" Heuristic match: "mohammedddxxx@duct-master.com" Pattern match: "http://schemas.microsoft.com/clr/" Pattern match: "http://schemas.microsoft.com/clr/assem/" Pattern match: "http://schemas.microsoft.com/clr/ns/" Pattern match: "http://schemas.microsoft.com/clr/nsassem/" Pattern match: "http://ip-api.com/line/?fields=hosting" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Heuristic match: "ell32.dz" Pattern match: "https://ms" Heuristic match: "tp://ftp.duct-master.com" Heuristic match: "ohammedddxxx@duct-master.com" Pattern match: "ip-api.com/line/?fields=hosting" Heuristic match: "rivateinternetaccess.com" Heuristic match: "altalk.com" Heuristic match: "rillian.im" Heuristic match: "iscord.com" Pattern match: "http://ip-api.com" Heuristic match: "trillian.im" Pattern match: "http://ip-ap0" Heuristic match: "host: ip-api.com" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Heuristic match: "ntrust.net" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "http://www.microsoft.com0" Pattern match: "l.microsoft.com/pki/crl/products/miccerl" Pattern match: "www.microsoft.com/pk" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_202" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "16299.15.cat" Heuristic match: "windows-defender-management-powershell-group-wow64-package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: ".15.cat" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0x" Pattern match: "http://www.microsoft.com/pki/certs/microsofttimestamppca.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\windows-defender-management-powershell-group-wow64-package~31bf3856ad364e35~amd64~~10.0.16299.15.cat"4e:T4061,Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp") Found URL "https://mslocal" - Source: "00000000-00007132.00000001.128590.034C8000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007660.00000000.126620.034A0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007660.00000000.126620.034A0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007660.00000000.126620.034A0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e8;;=sb;=sgreater" - Source: "00000000-00007660.00000000.126620.0357D000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007660.00000000.126620.0357D000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007660.00000000.126620.0357D000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007660.00000000.126620.0357D000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007660.00000000.126620.0357D000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00007660.00000000.126620.0357D000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc46" - Source: "00000000-00007660.00000000.126620.0357D000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007660.00000000.126620.07D10000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_202.crt07ya'4ypd" - Source: "00000000-00007660.00000000.126620.07D10000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007660.00000000.126620.6EE61000.00000020.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007660.00000001.127290.034A0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007660.00000001.127290.034A0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007660.00000001.127290.034A0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e8;;=sb;=sgreater" - Source: "00000000-00007660.00000001.127290.0357D000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007660.00000001.127290.0357D000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007660.00000001.127290.0357D000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007660.00000001.127290.0357D000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007660.00000001.127290.0357D000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00007660.00000001.127290.0357D000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc46" - Source: "00000000-00007660.00000001.127290.0357D000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007660.00000001.127290.07D10000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007660.00000001.127290.07D10000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007660.00000001.127290.07D10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00007660.00000001.127290.07D10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0p" - Source: "00000000-00007660.00000001.127290.07D10000.00000004.mdmp")4f:T579,Found string "+ncalrpc:[OLE6A7C019EB93D6440BBD91E636D4E]" (Indicator: "ncalrpc"; Source: "00000000-00007132.00000000.126669.033E0000.00000004.mdmp, 00000000-00007132.00000001.128590.033E0000.00000004.mdmp, 00000000-00007132.00000001.128590.034A1000.00000004.mdmp, 00000000-00007132.00000002.130510.033E0000.00000004.mdmp, 00000000-00007132.00000002.130510.034A1000.00000004.mdmp") Found string "+ncalrpc:[OLE495A7EC68BDCDE6B48D451F26AB2]" (Indicator: "ncalrpc"; Source: "00000000-00007132.00000000.126669.033E0000.00000004.mdmp, 00000000-00007132.00000001.128590.033E0000.00000004.mdmp, 00000000-00007132.00000002.130510.033E0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00007132.00000000.126669.033E0000.00000004.mdmp, 00000000-00007132.00000001.128590.033E0000.00000004.mdmp, 00000000-00007132.00000002.130510.033E0000.00000004.mdmp") Found string "B+ncalrpc:[OLE6A7C019EB93D6440BBD91E636D4E]" (Indicator: "ncalrpc"; Source: "00000000-00007132.00000000.126669.033E0000.00000004.mdmp, 00000000-00007132.00000001.128590.033E0000.00000004.mdmp, 00000000-00007132.00000002.130510.033E0000.00000004.mdmp") Found string "+ncalrpc:[OLE812F79C43D347336AF98C48B5F98]" (Indicator: "ncalrpc"; Source: "00000000-00007660.00000000.126620.034A0000.00000004.mdmp, 00000000-00007660.00000001.127290.034A0000.00000004.mdmp")50:T9e4,"" (Indicator: "password"; Source: "00000000-00007132.00000000.126669.05040000.00000004.mdmp") Found string "passwordstorerc" (Indicator: "password"; Source: "00000000-00007132.00000002.130510.00400000.00000040.mdmp") Found string "*"password":"(.*?)"" (Indicator: "password"; Source: "00000000-00007132.00000002.130510.00400000.00000040.mdmp") Found string "server_user_password>" (Indicator: "password"; Source: "00000000-00007132.00000002.130510.00400000.00000040.mdmp") Found string "/server_user_password>" (Indicator: "password"; Source: "00000000-00007132.00000002.130510.00400000.00000040.mdmp") Found string "yncpassword" (Indicator: "password"; Source: "00000000-00007132.00000002.130510.00400000.00000040.mdmp") Found string "password>" (Indicator: "password"; Source: "00000000-00007132.00000002.130510.00400000.00000040.mdmp") Found string "/password>" (Indicator: "password"; Source: "00000000-00007132.00000002.130510.00400000.00000040.mdmp") Found string "k__BackingField" (Indicator: "password"; Source: "00000000-00007132.00000002.130510.00400000.00000040.mdmp") Found string "get_password" (Indicator: "password"; Source: "00000000-00007132.00000002.130510.00400000.00000040.mdmp") Found string "set_password" (Indicator: "password"; Source: "00000000-00007132.00000002.130510.00400000.00000040.mdmp") Found string "passwordVaultPtr" (Indicator: "password"; Source: "00000000-00007132.00000002.130510.00400000.00000040.mdmp") Found string "password_value" (Indicator: "password"; Source: "00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found string "syncpassword" (Indicator: "password"; Source: "00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found string "\passwordstorerc" (Indicator: "password"; Source: "00000000-00007132.00000002.130510.05040000.00000004.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found string "password_notes" (Indicator: "password"; Source: "00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found string "sqlite_autoindex_password_notes_1" (Indicator: "password"; Source: "00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found string "CREATE INDEX foreign_key_index_notes ON password_notes (parent_id)" (Indicator: "password"; Source: "00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found string "password_element VARCHAR" (Indicator: "password"; Source: "00000000-00007132.00000002.130510.05040000.00000004.mdmp")55:Tc35,"??\C:\Users\HAPUBWS\AppData\Local\VirtualStore\Program Files\Foxmail\mail" in Source: 00000000-00007132.00000001.128590.034A1000.00000004.mdmp 00000000-00007132.00000002.130510.034A1000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Pocomail\accounts.ini" in Source: 00000000-00007132.00000001.128590.034C8000.00000004.mdmp 00000000-00007132.00000002.130510.034C8000.00000004.mdmp "oftware\Microsoft\Office\11.0\Outlook\Profiles" in Source: 00000000-00007132.00000002.130510.00400000.00000040.mdmp "oftware\Microsoft\Office\12.0\Outlook\Profiles" in Source: 00000000-00007132.00000002.130510.00400000.00000040.mdmp "oftware\Microsoft\Office\14.0\Outlook\Profiles" in Source: 00000000-00007132.00000002.130510.00400000.00000040.mdmp "oftware\Microsoft\Office\15.0\Outlook\Profiles" in Source: 00000000-00007132.00000002.130510.00400000.00000040.mdmp "oftware\Microsoft\Office\16.0\Outlook\Profiles" in Source: 00000000-00007132.00000002.130510.00400000.00000040.mdmp "VirtualStore\Program Files\Foxmail\mail" in Source: 00000000-00007132.00000002.130510.00400000.00000040.mdmp "VirtualStore\Program Files (x86)\Foxmail\mail" in Source: 00000000-00007132.00000002.130510.00400000.00000040.mdmp "Opera Mail\Opera Mail\wand.dat" in Source: 00000000-00007132.00000002.130510.00400000.00000040.mdmp "\Postbox\" in Source: 00000000-00007132.00000002.130510.05040000.00000004.mdmp "\Thunderbird\" in Source: 00000000-00007132.00000002.130510.05040000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\" in Source: 00000000-00007132.00000002.130510.05040000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Postbox\" in Source: 00000000-00007132.00000002.130510.05040000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\profiles.ini" in Source: 00000000-00007132.00000002.130510.05040000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\profile" in Source: 00000000-00007132.00000002.130510.05040000.00000004.mdmp "Could not find a part of the path 'C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\profiles.ini'." in Source: 00000000-00007132.00000002.130510.05040000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Postbox\profiles.ini" in Source: 00000000-00007132.00000002.130510.05040000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Postbox\profile" in Source: 00000000-00007132.00000002.130510.05040000.00000004.mdmp "Could not find a part of the path 'C:\Users\HAPUBWS\AppData\Roaming\Postbox\profiles.ini'." in Source: 00000000-00007132.00000002.130510.05040000.00000004.mdmp "Software\Microsoft\Office\11.0\Outlook\Profiles" in Source: 00000000-00007132.00000002.130510.05040000.00000004.mdmp "Software\Microsoft\Office\12.0\Outlook\Profiles" in Source: 00000000-00007132.00000002.130510.05040000.00000004.mdmp "Software\Microsoft\Office\14.0\Outlook\Profiles" in Source: 00000000-00007132.00000002.130510.05040000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles" in Source: 00000000-00007132.00000002.130510.05040000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles" in Source: 00000000-00007132.00000002.130510.05040000.00000004.mdmp56:T404,Found string "Select * from Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00007132.00000001.128590.033E0000.00000004.mdmp, 00000000-00007132.00000002.130510.033E0000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp") Found string "elect * from Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00007132.00000002.130510.00400000.00000040.mdmp") Found string "ELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00007132.00000002.130510.00400000.00000040.mdmp") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00007132.00000002.130510.00400000.00000040.mdmp") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00007132.00000002.130510.00400000.00000040.mdmp") Found string "SELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00007132.00000002.130510.05040000.00000004.mdmp")57:T5ee,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007132.00000000.126669.033E0000.00000004.mdmp, 00000000-00007132.00000001.128590.033E0000.00000004.mdmp, 00000000-00007132.00000002.130510.033E0000.00000004.mdmp") Found string "%SystemRoot%\System32\drivers\etc" (Indicator: "\drivers\"; Source: "00000000-00007132.00000000.126669.033E0000.00000004.mdmp, 00000000-00007132.00000001.128590.033E0000.00000004.mdmp, 00000000-00007132.00000001.128590.034C8000.00000004.mdmp, 00000000-00007132.00000002.130510.033E0000.00000004.mdmp, 00000000-00007132.00000002.130510.034C8000.00000004.mdmp") Found string "%SystemRoot%\System32\drivers\etc" (Indicator: "system32\drivers"; Source: "00000000-00007132.00000000.126669.033E0000.00000004.mdmp, 00000000-00007132.00000001.128590.033E0000.00000004.mdmp, 00000000-00007132.00000001.128590.034C8000.00000004.mdmp, 00000000-00007132.00000002.130510.033E0000.00000004.mdmp, 00000000-00007132.00000002.130510.034C8000.00000004.mdmp") Found string "Win32API|System Information Functions|GetSystemDirectory|\drivers\etc\lmhosts" (Indicator: "\drivers\"; Source: "00000000-00007132.00000000.126669.033E0000.00000004.mdmp, 00000000-00007132.00000001.128590.034C8000.00000004.mdmp, 00000000-00007132.00000002.130510.034C8000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007660.00000000.126620.034A0000.00000004.mdmp, 00000000-00007660.00000001.127290.034A0000.00000004.mdmp")58:T791," HTTP/1.1 200 OK\nDate: Mon\n 08 Jun 2026 10:48:17 GMT\nContent-Type: text/plain; charset=utf-8\nContent-Length: 6\nAccess-Control-Allow-Origin: *\nX-Ttl: 60\nX-Rl: 44 with response body ==>66616C73650A.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6a269dcec6e2f6f997097de4"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a269dcec6e2f6f997097de4"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00007132.00000000.126669.05040000.00000004.mdmp, 00000000-00007132.00000002.130510.05040000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6a269dcec6e2f6f997097de4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueEx\" in \"00000000-00007132.00000002.130510.00400000.00000040.mdmp\"\n Found registry query API: \"RegOpenKeyEx\" in \"00000000-00007132.00000002.130510.00400000.00000040.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00007660.00000001.127290.01271000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00007660.00000001.127290.01271000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00007660.00000001.127290.01271000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00007660.00000001.127290.01271000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a269dcec6e2f6f997097de4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00007132.00000002.130510.00400000.00000040.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00007132.00000002.130510.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a269dcec6e2f6f997097de4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00007132.00000002.130510.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a269dcec6e2f6f997097de4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"get_ProcessName\" (Source: \"00000000-00007132.00000002.130510.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6a269dcec6e2f6f997097de4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"Win32API|System Information Functions|GetUserName\" (Indicator: \"GetUserName\"; Source: \"00000000-00007132.00000001.128590.08854000.00000004.mdmp, 00000000-00007132.00000002.130510.08854000.00000004.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007132.00000002.130510.00400000.00000040.mdmp\")\n Found reference to API \"NtQueryObject\" (Indicator: \"NtQueryObject\"; Source: \"00000000-00007132.00000002.130510.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a269dcec6e2f6f997097de4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a269dcec6e2f6f997097de4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"