21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 5a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T428,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 38c2bbdb43b9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 38c2bbdb43b9…. Threat score 100/100. 0/26 AV engines flagged this file. 6 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0"],"about":{"@type":"SoftwareApplication","name":"agent.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":26},"behavioralIndicators":{"malicious":6,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:Tc2d,"" (Indicator: "password"; Source: "00000000-00000368.00000001.152308.7DBC3000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00000368.00000001.152308.A44B0000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00000368.00000001.152308.A44F0000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00000368.00000001.152308.A44F0000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00000368.00000001.152308.A4550000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00000368.00000001.152308.A4590000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00000368.00000001.152308.A4590000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00000368.00000001.152308.A4590000.00000004.mdmp") file/memory contains long string with (Indicator: "secret"; Source: "00000000-00005772.00000000.151058.3EF40000.00000002.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00005772.00000000.151058.3EF40000.00000002.mdmp") Found string "stratesecretar" (Indicator: "secret"; Source: "00000000-00005772.00000000.151058.3EF40000.00000002.mdmp")2a:Tbca,"svc.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "svc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")2b:T7c4,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0.bin") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0.bin") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00000368.00000000.151816.187B2000.00000002.mdmp, 00000000-00000368.00000001.152308.243EA000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00000368.00000000.151816.187B2000.00000002.mdmp, 00000000-00000368.00000001.152308.243EA000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00005772.00000000.151058.3EF40000.00000002.mdmp, 00000000-00005772.00000001.152980.002C0000.00000002.mdmp, 00000000-00005772.00000001.152980.02E80000.00000002.mdmp, 00000000-00005772.00000001.152980.02F30000.00000002.mdmp, 00000000-00005772.00000001.152980.02F50000.00000002.mdmp, 00000000-00005772.00000001.152980.02F80000.00000002.mdmp, 00000000-00005772.00000001.152980.02FC0000.00000002.mdmp, 00000000-00005772.00000001.152980.03040000.00000002.mdmp, 00000000-00005772.00000001.152980.03550000.00000002.mdmp, 00000000-00005772.00000001.152980.03920000.00000002.mdmp, 00000000-00005772.00000002.154900.00240000.00000002.mdmp, 00000000-00005772.00000002.154900.00500000.00000002.mdmp, 00000000-00005772.00000002.154900.00600000.00000002.mdmp, 00000000-00005772.00000002.154900.00630000.00000002.mdmp, 00000000-00005772.00000002.154900.02E10000.00000002.mdmp, 00000000-00005772.00000002.154900.03010000.00000002.mdmp, 00000000-00005772.00000002.154900.038D0000.00000002.mdmp, 00000000-00005772.00000002.154900.038E0000.00000002.mdmp, 00000000-00005772.00000002.154900.03900000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005772.00000000.151058.3EF40000.00000002.mdmp")2c:T46b,"" - Source: "00000000-00000368.00000000.151816.187B2000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^" - Source: "00000000-00000368.00000000.151816.644D0000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00000368.00000000.151816.644D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^" - Source: "00000000-00000368.00000000.151816.7D480000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e" - Source: "00000000-00000368.00000000.151816.7D480000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000368.00000000.151816.7D480000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000368.00000000.151816.7D480000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]@" - Source: "00000000-00000368.00000000.151816.7D480000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000368.00000000.151816.7D480000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c30rk" - Source: "00000000-00000368.00000000.151816.7D480000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00000368.00000000.151816.7D480000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00000368.00000000.151816.7D480000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00000368.00000000.151816.7D480000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000368.00000000.151816.7D480000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00000368.00000000.151816.7D480000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00000368.00000000.151816.7D480000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000368.00000000.151816.7D480000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/defa&$vkt7" - Source: "00000000-00000368.00000000.151816.7D480000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00000368.00000000.151816.7D9A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00000368.00000000.151816.7D9A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000368.00000000.151816.7D9A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^" - Source: "00000000-00000368.00000001.152308.64567000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00000368.00000001.152308.64587000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^" - Source: "00000000-00000368.00000001.152308.7D480000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e" - Source: "00000000-00000368.00000001.152308.7D480000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000368.00000001.152308.7D480000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000368.00000001.152308.7D480000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]@" - Source: "00000000-00000368.00000001.152308.7D480000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000368.00000001.152308.7D480000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c30rk" - Source: "00000000-00000368.00000001.152308.7D480000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00000368.00000001.152308.7D480000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00000368.00000001.152308.7D480000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00000368.00000001.152308.7D480000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000368.00000001.152308.7D4F5000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00000368.00000001.152308.7D4F5000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00000368.00000001.152308.7D4F5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0b" - Source: "00000000-00000368.00000001.152308.7D4F5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000368.00000001.152308.7D4F5000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/defa&$vkt7" - Source: "00000000-00000368.00000001.152308.7D4F5000.00000004.mdmp") Found URL "http://www.apache.org/licenses/license-2.0.html" - Source: "00000000-00000368.00000001.152308.7D9EE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00000368.00000001.152308.7D9EE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" - Source: "00000000-00000368.00000001.152308.7D9EE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/prol1k" - Source: "00000000-00000368.00000001.152308.7DAA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!washington1redmond1microsoft" - Source: "00000000-00000368.00000001.152308.7DB35000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00000368.00000001.152308.7DB35000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00000368.00000001.152308.7DB53000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.micrhdc)o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/ce" - Source: "00000000-00000368.00000001.152308.7DB53000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000368.00000001.152308.7DB53000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f" - Source: "00000000-00005772.00000001.152980.03180000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^" - Source: "00000000-00005772.00000001.152980.031EC000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e" - Source: "00000000-00005772.00000001.152980.031EC000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005772.00000001.152980.031EC000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00005772.00000001.152980.031EC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005772.00000001.152980.031EC000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0root" - Source: "00000000-00005772.00000001.152980.031EC000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005772.00000001.152980.031EC000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysgeotrust" - Source: "00000000-00005772.00000001.152980.031EC000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005772.00000001.152980.031EC000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005772.00000001.152980.031EC000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005772.00000001.152980.031EC000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005772.00000001.152980.0325F000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005772.00000001.152980.0325F000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005772.00000001.152980.0325F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005772.00000001.152980.0325F000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005772.00000001.152980.0325F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005772.00000001.152980.0325F000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005772.00000001.152980.0325F000.00000004.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00005772.00000001.152980.03550000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00005772.00000001.152980.03550000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00005772.00000001.152980.03550000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00005772.00000001.152980.03920000.00000002.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00005772.00000001.152980.03920000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00005772.00000001.152980.03920000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005772.00000001.152980.7FCE0000.00000004.mdmp") Found URL "http://162.33.179.72:4444/wswinhttp.dllhttp://162.33.179.72:4444/162.33.179.72162.33.179.72:4444ws2_32.dllws2_32.dllnamesystem.net.socketssocketstelemetrysystem.net.socketssystem.net.socketsstsmen.tes.coekstnamesystem.net.socketsws2_32.dllws2_32.dllkernel32.dllws2_32.dllws2_32.dllws2_32.dllws2_32.dllws2_32.dllwebsocketupgrade53fv15undnkn9tnp1wljyxjfplg=rmm-auth-2026-secret-tokentzres.dll.mui2a" - Source: "00000000-00005772.00000001.152980.82800000.00000004.mdmp") Found URL "http://api.ipify.org:443/api.ipify.orgws2_32.dllkernel32.dllnamesystem.net.nameresolutionnameresolutiontelemetrysystem.net.nameresolutionsystem.net.nameresolutionnamesystem.net.nameresolutionws2_32.dllnameprivate.internaldiagnostics.system.net.securityneteventsourceprivate.internaldiagnostics.system.net.securityprivate.internaldiagnostics.system.net.securityci.systsmen.tes.cerutinameprivate.internaldiagnostics.system.net.securitynamesystem.net.securitynetsecuritytelemetrysystem.net.securitysystem.net.securitystsmen.tes.cerutinamesystem.net.securityws2_32.dllnamesystem.collections.concurrent.concurrentcollectionseventsourceguid35167f8e-49b2-4b96-ab86-435b59336b5ecdscollectionetwbclprovidernamesystem.collections.concurrent.concurrentcollectionseventsourceguid35167f8e-49b2-4b96-ab86-435b59336b5eeventsourceattribute.set_guidinvokestub_eventsourceattribute.set_guideventsourceattribute.invokestub_eventsourceattribute.set_guidkernel32.dlladvapi32.dllkernel32.dlladvapi32.dllkernel32.dlladvapi32.dllsspicli.dllsspicli.dll=<5/sspicli.dllsspicli.dllcrypt32.dllcrypt32.dll(utc)" - Source: "00000000-00005772.00000001.152980.82800000.00000004.mdmp") Found URL "https://socks4:/" - Source: "00000000-00005772.00000001.152980.DF5F0000.00000020.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00005772.00000002.154900.00240000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00005772.00000002.154900.00240000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00005772.00000002.154900.002E0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00005772.00000002.154900.002E0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows_cordllmainmscoree.dll!this" - Source: "00000000-00005772.00000002.154900.00500000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows_cordllmainmscoree.dll" - Source: "00000000-00005772.00000002.154900.00500000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00005772.00000002.154900.005F0000.00000002.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00005772.00000002.154900.005F0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00005772.00000002.154900.005F0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00005772.00000002.154900.005F0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows_cordllmainmscoree.dll" - Source: "00000000-00005772.00000002.154900.00600000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows_cordllmainmscoree.dll!this" - Source: "00000000-00005772.00000002.154900.00630000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00005772.00000002.154900.00630000.00000002.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00005772.00000002.154900.02E10000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00005772.00000002.154900.02E10000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00005772.00000002.154900.02E10000.00000002.mdmp") Found URL "https://docs.microsoft.com/dotnet/api/system.text.json.serialization.jsonnumberhandling).stream" - Source: "00000000-00005772.00000002.154900.02E10000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00005772.00000002.154900.02E10000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00005772.00000002.154900.03010000.00000002.mdmp") Found URL "https://aka.ms/binaryformatter" - Source: "00000000-00005772.00000002.154900.03010000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00005772.00000002.154900.03010000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00005772.00000002.154900.03010000.00000002.mdmp") Found URL "http://www.microsoft.com0'6*lqsoppm0&)?azh7500s01013000p01032400e1mp001013100y>" - Source: "00000000-00005772.00000002.154900.03180000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^" - Source: "00000000-00005772.00000002.154900.031EC000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e" - Source: "00000000-00005772.00000002.154900.031EC000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005772.00000002.154900.031EC000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00005772.00000002.154900.031EC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005772.00000002.154900.031EC000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0root" - Source: "00000000-00005772.00000002.154900.031EC000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005772.00000002.154900.031EC000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysgeotrust" - Source: "00000000-00005772.00000002.154900.031EC000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005772.00000002.154900.031EC000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005772.00000002.154900.031EC000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005772.00000002.154900.031EC000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005772.00000002.154900.0325F000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005772.00000002.154900.0325F000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005772.00000002.154900.0325F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005772.00000002.154900.0325F000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005772.00000002.154900.0325F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005772.00000002.154900.0325F000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005772.00000002.154900.0325F000.00000004.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00005772.00000002.154900.038D0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00005772.00000002.154900.038D0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00005772.00000002.154900.038D0000.00000002.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00005772.00000002.154900.038E0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00005772.00000002.154900.038E0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00005772.00000002.154900.038E0000.00000002.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00005772.00000002.154900.03900000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00005772.00000002.154900.03900000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00005772.00000002.154900.03900000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005772.00000002.154900.7FCE0000.00000004.mdmp") Found URL "http://162.33.179.72:4444/wswinhttp.dllhttp://162.33.179.72:4444/162.33.179.72162.33.179.72:4444ws2_32.dllws2_32.dllnamesystem.net.socketssocketstelemetrysystem.net.socketssystem.net.socketsstsmen.tes.coekstnamesystem.net.socketsws2_32.dllws2_32.dllkernel32.dllws2_32.dllws2_32.dllws2_32.dllws2_32.dllws2_32.dllwebsocketupgrade53fv15undnkn9tnp1wljyxjfplg=rmm-auth-2026-secret-tokentzres.dll.mui2a" - Source: "00000000-00005772.00000002.154900.82800000.00000004.mdmp") Found URL "http://api.ipify.org:443/api.ipify.orgws2_32.dllkernel32.dllnamesystem.net.nameresolutionnameresolutiontelemetrysystem.net.nameresolutionsystem.net.nameresolutionnamesystem.net.nameresolutionws2_32.dllnameprivate.internaldiagnostics.system.net.securityneteventsourceprivate.internaldiagnostics.system.net.securityprivate.internaldiagnostics.system.net.securityci.systsmen.tes.cerutinameprivate.internaldiagnostics.system.net.securitynamesystem.net.securitynetsecuritytelemetrysystem.net.securitysystem.net.securitystsmen.tes.cerutinamesystem.net.securityws2_32.dllnamesystem.collections.concurrent.concurrentcollectionseventsourceguid35167f8e-49b2-4b96-ab86-435b59336b5ecdscollectionetwbclprovidernamesystem.collections.concurrent.concurrentcollectionseventsourceguid35167f8e-49b2-4b96-ab86-435b59336b5eeventsourceattribute.set_guidinvokestub_eventsourceattribute.set_guideventsourceattribute.invokestub_eventsourceattribute.set_guidkernel32.dlladvapi32.dllkernel32.dlladvapi32.dllkernel32.dlladvapi32.dllsspicli.dllsspicli.dll=<5/sspicli.dllsspicli.dllcrypt32.dllcrypt32.dll(utc)" - Source: "00000000-00005772.00000002.154900.82800000.00000004.mdmp") Found URL "https://aka.ms/dotnet/downloadlearn" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "https://aka.ms/dotnet/infoglobal.json" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failedto" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "https://aka.ms/dotnet/sdk-not-founddownload" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "https://aka.ms/dotnet/download%s%sinstall" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?architecture:" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-faileddownload" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failedwould" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "http://dictionaryperceptionrevolutionfoundationpx;height:successfulsupportersmillenniumhis" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "http://mathematicsmargin-top:eventually" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "http://descriptionrelatively" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "http://applicationslink" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "http://navigation" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "http://px;" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "https://www.world" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "http://www.years" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "http://interested" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "http://familiar" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "https://was" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "https://ain" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "http://whether" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "http://interpreted" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "http://);" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "http://addeventlistenerresponsible" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "http://.jpg" - Source: "00000000-00006844.00000000.150198.9D3D0000.00000002.mdmp") Found URL "http://http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0tx*:qi!!wmicrosoft" - Source: "00000000-00006844.00000001.151273.9D5A8000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20code%20signing%20pca%202024.crl0wk0i0g[http://www.microsoft.com/pkiops/certs/microsoft%20windows%20code%20signing%20pca%202024.crt0e" - Source: "00000000-00006844.00000001.151273.9D5A8000.00000002.mdmp") Found URL "http://www.microsoft.com06au63+s" - Source: "00000000-00006844.00000001.151273.9D5A8000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006844.00000001.151273.9D5A8000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt00" - Source: "00000000-00006844.00000001.151273.9D5A8000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00006844.00000001.151273.9D5A8000.00000002.mdmp")2f:T1a5d,Heuristic match: "system.gc.name" Pattern match: "https://aka.ms/dotnet/download" Pattern match: "https://aka.ms/dotnet/info" Pattern match: "https://aka.ms/dotnet/app-launch-failedto" Pattern match: "https://aka.ms/dotnet/sdk-not-found" Pattern match: "https://aka.ms/dotnet-core-applaunch" Pattern match: "https://aka.ms/dotnet/app-launch-failed" Pattern match: "https://aka.ms/dotnet/app-launch-failedwould" Heuristic match: "dns.question.name" Heuristic match: "api.ipify.org" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.digicert.com1" Pattern match: "0www.entrust.net/cps" Pattern match: "microsoft.net/assembly/gac_64/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Heuristic match: "ntrust.net" Heuristic match: "ystem.management.automation.re" Heuristic match: "nt.in" Pattern match: "www.digicert.com1$0" Pattern match: "http://cybertrust.omniroot.com/repository.cfm0" Pattern match: "http://ocsp.omniroot.com/baltimoreroot0" Pattern match: "cdp1.public-trust.com/crl/omniroot2025.crl0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1+0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Heuristic match: "ement.au" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/defa&" Pattern match: "http://www.microsoft.com/windows" Pattern match: "crl.microsoft.com/pki/crl/products/mi" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "5.cat" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0x" Pattern match: "http://www.microsoft.com/pki/certs/microsofttimestamppca.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0" Pattern match: "http://www.apache.org/licenses/license-2.0.html" Heuristic match: "ystem.windows.fo" Pattern match: "soft.com/pkiops/" Pattern match: "www.micro" Heuristic match: "osoft.co" Pattern match: "crl.microsoft.com/pki/crl/pro" Heuristic match: "01.ck" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Heuristic match: "stem.xml.lv" Pattern match: "https://go.microsoft.com/fwlink/?linkid=390787" Heuristic match: "cim_system.name" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "http://www.micr" Pattern match: "http://www.microsoft.com/pki/ce" Pattern match: "soft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Heuristic match: ":\windows\microsoft.net\assembly\gac_64\microsoft.mv" Pattern match: "birthpopuptypesapplyimagebeinguppernoteseveryshowsmeansextramatchtrackknownearlybegansuperpapernorthlearngivennamedendedtermspartsgroupbrandusingwomanfalsereadyaudiotakeswhile.com/livedcasesdailychildgreatjudgethoseunitsneverbroadcoastcoverapplefilescycles" Pattern match: "tos.org/ladvisedpenaltysimple:if" Pattern match: "http://dictionaryperceptionrevolutionfoundationpx;height:successfulsupportersmillenniumhis" Pattern match: "http://mathematicsmargin-top:eventually" Pattern match: "http://descriptionrelatively" Pattern match: "http://applicationslink" Pattern match: "www.googleorganizationautocompleterequirementsconservative" Pattern match: "http://navigation" Pattern match: "http://px" Pattern match: "www.world" Pattern match: "http://www.years" Pattern match: "http://interested" Pattern match: "http://familiar" Pattern match: "https://was" Pattern match: "https://ain" Pattern match: "http://whether" Pattern match: "http://interpreted" Pattern match: "http://addeventlistenerresponsible" Pattern match: "http://.jpg|right|thumb|.js" Pattern match: "http://according" Pattern match: "http://www.interpretation" Pattern match: "http://s;text-align:centerfont-weight" Pattern match: "http://style=float:left;concerned" Pattern match: "w3.org/1999/xhtml" Pattern match: "http://www.wencodeuricomponent" Pattern match: "http://encoding=utf-8" Pattern match: "http://www.icon" Pattern match: "http://imenglish" Pattern match: "http://www" Pattern match: "http://www.hortcut" Pattern match: "http://iparticipation" Pattern match: "http://xt/css" Pattern match: "http://www.text-decoration:underthe" Pattern match: "http://option" Pattern match: "http://.css" Pattern match: "http://www.css" Pattern match: "http://ator" Pattern match: "http://www-//w3c//dtd" Pattern match: "http://www.c//dtd"30:T4b3,Process svc.exe created mutex with name "\BaseNamedObjects\netfxeventlog.1.0" Process svc.exe created mutex with name "\BaseNamedObjects\Global\netfxeventlog.1.0" Process svc.exe created mutex with name "\BaseNamedObjects\Local\SM0:5772:304:WilStaging_02" Process WMIC.exe created mutex with name "\BaseNamedObjects\SM0:7988:120:WilError_01" Process WMIC.exe created mutex with name "\BaseNamedObjects\SM0:7988:304:WilStaging_02" Process WMIC.exe created mutex with name "\BaseNamedObjects\Local\SM0:7988:304:WilStaging_02" Process powershell.exe created mutex with name "\BaseNamedObjects\Local\SM0:368:304:WilStaging_02" Process powershell.exe created mutex with name "\BaseNamedObjects\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\BaseNamedObjects\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "\BaseNamedObjects\SM0:368:120:WilError_01" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\BaseNamedObjects\SM0:368:304:WilStaging_02" Process powershell.exe created mutex with name "\BaseNamedObjects\Local\SM0:368:120:WilError_01"31:T5ba,Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0.bin") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0.bin") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00000368.00000000.151816.187B2000.00000002.mdmp, 00000000-00000368.00000001.152308.243EA000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00000368.00000000.151816.187B2000.00000002.mdmp, 00000000-00000368.00000001.152308.243EA000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00000368.00000000.151816.187B2000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00000368.00000001.152308.243EA000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00000368.00000001.152308.243EA000.00000002.mdmp") Found reference to API "tlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004208.00000000.150961.E9850000.00000004.mdmp, 00000000-00004208.00000001.151254.E9850000.00000004.mdmp") Found reference to API "AssemblyNative_GetVersion" (Indicator: "GetVersion"; Source: "00000000-00005772.00000000.151058.3EF40000.00000002.mdmp")32:T56f8,"d__198" (Indicator: "base64"; Source: "00000000-00000368.00000000.151816.A45B0000.00000004.mdmp, 00000000-00000368.00000001.152308.A45B0000.00000004.mdmp") Found string "d__148" (Indicator: "base64"; Source: "00000000-00000368.00000000.151816.A45B0000.00000004.mdmp, 00000000-00000368.00000001.152308.A45B0000.00000004.mdmp") Found string "d__151" (Indicator: "base64"; Source: "00000000-00000368.00000000.151816.A45B0000.00000004.mdmp, 00000000-00000368.00000001.152308.A45B0000.00000004.mdmp") Found string "d__484" (Indicator: "base64"; Source: "00000000-00000368.00000000.151816.A45B0000.00000004.mdmp, 00000000-00000368.00000001.152308.A45B0000.00000004.mdmp") Found string "d__110" (Indicator: "base64"; Source: "00000000-00000368.00000000.151816.A45B0000.00000004.mdmp, 00000000-00000368.00000001.152308.A45B0000.00000004.mdmp")56:T406,Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0.bin") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000368.00000000.151816.187B2000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000368.00000000.151816.187B2000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000368.00000000.151816.187B2000.00000002.mdmp, 00000000-00000368.00000001.152308.243EA000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00000368.00000000.151816.187B2000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00000368.00000001.152308.243EA000.00000002.mdmp") Found reference to API "LoadResource error: %x" (Indicator: "LoadResource"; Source: "00000000-00005772.00000000.151058.3EF40000.00000002.mdmp")57:T9c9,Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0.bin") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000368.00000000.151816.187B2000.00000002.mdmp, 00000000-00000368.00000001.152308.243EA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000368.00000000.151816.187B2000.00000002.mdmp, 00000000-00000368.00000001.152308.243EA000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00000368.00000001.152308.243EA000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000368.00000001.152308.243EA000.00000002.mdmp")58:T8fa,Found PE header "MZ" - Source: "00000000-00005772.00000001.152980.002C0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.152980.00520000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.152980.005B0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.152980.005E0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.152980.00610000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.152980.00620000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.152980.02E60000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.152980.02E80000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.152980.02F10000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.152980.02F30000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.152980.02F50000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.152980.02F70000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.152980.02F80000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.152980.02FC0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.152980.03040000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.152980.03550000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.152980.03920000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000002.154900.00240000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000002.154900.002E0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000002.154900.00500000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000002.154900.005F0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000002.154900.00600000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000002.154900.00630000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000002.154900.02E10000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000002.154900.03010000.00000002.mdmp")59:T421,Process "sc.exe" (UID: 00000000-00007404) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A"" Process "sc.exe" (UID: 00000000-00007404) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "svc.exe" (UID: 00000000-00005772) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP, NUMBER_OF_PROCESSORS" Process "svc.exe" (UID: 00000000-00005772) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, USERDNSDOMAIN, HOMEPATH, HOMEDRIVE" Process "cmd.exe" (UID: 00000000-00005884) was launched with new environment variables: "USERDNSDOMAIN="WORKGROUP"" Process "cmd.exe" (UID: 00000000-00005884) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "WMIC.exe" (UID: 00000000-00007988) was launched with new environment variables: "PROMPT="$P$G"" Process "powershell.exe" (UID: 00000000-00000368) was launched with missing environment variables: "PROMPT"18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":["evasive"],"file_activity":{"dropped_files":[],"extracted_files":[{"name":"svc.exe","sha256":"ee83173b77b27b529a716ae4b6161d87db4151a6fd2363b4c49d4e9a985db355","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"verdict":"undetected"},{"name":"powershell.exe.log","sha256":"ef045fea402025c5e6098c5f510bdc77e349e88d8b2a10829ad42faf8a1e22c8","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"verdict":"undetected"},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"verdict":"undetected"},{"name":"svc.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[{"path":"%WINDIR%\\Temp\\__PSScriptPolicyTest_vvd3o24n.m4v.psm1","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,static","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,System.Diagnostics.EventLog","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,System.ServiceProcess.ServiceController,8.0.1","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,System.ServiceProcess.ServiceController","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"path":"%WINDIR%\\Temp\\__PSScriptPolicyTest_yo5py1a1.xe2.ps1","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,static,8.0.25","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,System.Diagnostics.EventLog,8.0.1","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\UpdateService\\svc.exe","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\UpdateService\\svc.exe:Zone.Identifier","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\Local\\SM0:7988:304:WilStaging_02","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:368:304:WilStaging_02","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"name":"\\BaseNamedObjects\\SM0:368:304:WilStaging_02","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"name":"\\BaseNamedObjects\\Global\\netfxeventlog.1.0","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:5772:304:WilStaging_02","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"name":"\\BaseNamedObjects\\ZonesCacheCounterMutex","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"name":"\\BaseNamedObjects\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"name":"\\BaseNamedObjects\\SM0:368:120:WilError_01","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:368:120:WilError_01","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"name":"\\BaseNamedObjects\\netfxeventlog.1.0","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"name":"\\BaseNamedObjects\\SM0:7988:120:WilError_01","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"name":"\\BaseNamedObjects\\SM0:7988:304:WilStaging_02","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[{"address":"162.33.179.72","country":"United States","port":4444,"protocol":"TCP","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"address":"104.26.13.205","port":443,"protocol":"TCP","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]}],"dns_resolutions":[{"address":"104.26.13.205","country":"-","domain":"api.ipify.org","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"ttl":300}],"http_requests":[{"header":"GET /ws HTTP/1.1\nHost: 162.33.179.72:4444\nConnection: Upgrade\nUpgrade: websocket\nSec-WebSocket-Key: ruX+RJC7bkqmcYnJ9N7cPA==\nSec-WebSocket-Version: 13","host":"162.33.179.72:4444","host_ip":"162.33.179.72:4444","method":"GET","response_code":"101","response_phrase":"Switching Protocols","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"url":"/ws"},{"header":"GET / HTTP/1.1","host":"api.ipify.org","host_ip":"104.26.13.205:443","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"url":"/"}]},"process_activity":{"all_imported_dlls":["mscorlib.ni.dll","wshext.dll","MSOXMLMF.DLL","profapi.dll","Microsoft.Management.Infrastructure.CimCmdlets.ni.dll","wmidcom.dll","System.Management.ni.dll","icuuc.dll","normaliz.dll","nsi.dll","imm32.dll","rsaenh.dll","mskeyprotect.dll","clbcatq.dll","wldp.dll","msasn1.dll","msvcr90.dll","msisip.dll","apphelp.dll","Microsoft.Management.Infrastructure.ni.dll","BCP47Langs.dll","windows.storage.dll","kernel.appcore.dll","ws2_32.dll","winnsi.dll","atl.dll","System.Data.ni.dll","ncrypt.dll","psapi.dll","ucrtbase_clr0400.dll","slc.dll","System.Management.Automation.ni.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","dpapi.dll","ntdll.dll","icuin.dll","wbemcomn.dll","Microsoft.AppV.AppvClientComConsumer.dll","clr.dll","wintrust.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","SHCore.dll","HaIpMN9X.dll","OnDemandConnRouteHelper.dll","sspicli.dll","dhcpcsvc6.dll","System.Transactions.dll","fastprox.dll","msvcrt.dll","bcrypt.dll","schannel.dll","cryptbase.dll","oleaut32.dll","AppxSip.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","System.Core.ni.dll","ntasn1.dll","System.Configuration.ni.dll","ntmarta.dll","Microsoft.Management.Infrastructure.Native.ni.dll","rasadhlp.dll","Microsoft.PowerShell.Security.ni.dll","powrprof.dll","xmllite.dll","bcryptprimitives.dll","rpcrt4.dll","wmiutils.dll","FWPUCLNT.DLL","System.Xml.ni.dll","coml2.dll","pnrpnsp.dll","framedynos.dll","ole32.dll","System.ni.dll","cryptnet.dll","System.Configuration.Install.ni.dll","userenv.dll","msvcp_win.dll","clrjit.dll","System.Transactions.ni.dll","gdi32full.dll","sechost.dll","fltLib.dll","mscoree.dll","KernelBase.dll","mi.dll","nlaapi.dll","propsys.dll","NapiNSP.dll","Microsoft.AppV.AppVClientPowerShell.dll","kernel32.dll","System.Data.dll","VxSSL64.dll","shell32.dll","cfgmgr32.dll","wmi2xml.dll","ucrtbase.dll","mscoreei.dll","sppc.dll","System.Numerics.ni.dll","pwrshsip.dll","cryptsp.dll","Windows.Globalization.dll","crypt32.dll","combase.dll","urlmon.dll","dhcpcsvc.dll","vcruntime140_clr0400.dll","ncryptsslp.dll","win32u.dll","amsi.dll","secur32.dll","OpcServices.dll","wbemsvc.dll","MpClient.dll","user32.dll","imagehlp.dll","msIso.dll","gpapi.dll","dnsapi.dll","winhttp.dll","MpOAV.dll","System.DirectoryServices.ni.dll","iertutil.dll","shlwapi.dll","miutils.dll","msxml6.dll","mswsock.dll","gdi32.dll","wbemprox.dll","advapi32.dll","wininet.dll","IPHLPAPI.DLL","version.dll","winrnr.dll"],"processes":[{"command_line":"","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","name":"38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0.bin.exe","normalized_path":"C:\\38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0.bin.exe","pid":6844,"ppid":0,"sha256":"38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0","uid":"00000000-00006844"},{"command_line":"create WinUpdateSvc binPath= \"\\\"%ALLUSERSPROFILE%\\Microsoft\\UpdateService\\svc.exe\\\"\" start= auto DisplayName= \"Windows Update Service\"","name":"sc.exe","normalized_path":"%WINDIR%\\SYSTEM32\\sc.exe","parent_uid":"00000000-00006844","pid":7404,"ppid":6844,"sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","uid":"00000000-00007404"},{"command_line":"description WinUpdateSvc \"Manages Windows Update components\"","name":"sc.exe","normalized_path":"%WINDIR%\\SYSTEM32\\sc.exe","parent_uid":"00000000-00006844","pid":4592,"ppid":6844,"sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","uid":"00000000-00004592"},{"command_line":"start WinUpdateSvc","name":"sc.exe","normalized_path":"%WINDIR%\\SYSTEM32\\sc.exe","parent_uid":"00000000-00006844","pid":4208,"ppid":6844,"sha256":"34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f908","uid":"00000000-00004208"},{"command_line":"","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","name":"svc.exe","normalized_path":"%ALLUSERSPROFILE%\\Microsoft\\UpdateService\\svc.exe","pid":5772,"ppid":0,"sha256":"38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0","uid":"00000000-00005772"},{"command_line":"/c wmic process where ProcessId=5772 get ParentProcessId /value","name":"cmd.exe","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00005772","pid":5884,"ppid":5772,"sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","uid":"00000000-00005884"},{"command_line":"wmic process where ProcessId=5772 get ParentProcessId /value","name":"WMIC.exe","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","parent_uid":"00000000-00005884","pid":7988,"ppid":5884,"sha256":"a23c1b94d193ebe3d4cf647c653e41f63ba7b6d996c9a3de6380408c7e4a812e","uid":"00000000-00007988"},{"command_line":"-NoProfile -NonInteractive -Command \"Get-CimInstance Win32_Processor | Select-Object Name | Format-List; Get-CimInstance Win32_VideoController | Select-Object Name,AdapterRAM | Format-List; Get-CimInstance Win32_PhysicalMemory | Measure-Object Capacity -Sum | Select-Object Sum | Format-List; Get-CimInstance Win32_ComputerSystem | Select-Object Model,Manufacturer,TotalPhysicalMemory | Format-List; Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber | Format-List; Get-CimInstance Win32_DiskDrive | Select-Object Model,Size | Format-List\"","name":"powershell.exe","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005772","pid":368,"ppid":5772,"sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","uid":"00000000-00000368"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EVENTLOG\\APPLICATION\\WINUPDATESVC\\","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]}],"keys_deleted":[],"keys_modified":[]},"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"analysis_start_time":"2026-04-09T08:50:29+00:00","contacted_countries":["USA"],"environment_description":"Windows 10 64 bit","environment_id":160,"id":"69d76852451cbf11aa0e00a8","indicators_count":{"informative":227,"malicious":8,"suspicious":48},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0.bin","tags":["Multi-Process","Network Traffic","Extracted Files"],"threat_score":100,"verdict":"malicious"}],"stats":{"contacted_hosts_count":2,"contacted_urls_count":2,"dns_resolutions_count":1,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":4,"files_deleted_count":0,"files_written_count":16,"http_requests_count":2,"imported_dlls_count":135,"injected_processes_count":0,"mutex_created_count":13,"process_count":8,"registry_keys_created_count":5,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"script_calls_count":0,"spawned_processes_count":8}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{},"av_detections":{"engines":{"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"aurora":{"data_source":"MetaDefender","name":"Aurora","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"cmc":{"data_source":"MetaDefender","name":"CMC","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"filseclab":{"data_source":"MetaDefender","name":"Filseclab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"gridinsoft":{"data_source":"MetaDefender","name":"Gridinsoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"lionic":{"data_source":"MetaDefender","name":"Lionic","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sentinelone":{"data_source":"MetaDefender","name":"SentinelOne","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trellix":{"data_source":"MetaDefender","name":"Trellix","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"xcitium":{"data_source":"MetaDefender","name":"Xcitium","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"}}},"incidents":[{"details":[{"detail":"Found a string that may be used as part of an injection method"}],"details_count":1,"name":"Spyware","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns many processes"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"details_count":4,"name":"Persistence","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"details":[{"detail":"Queries kernel debugger information"},{"detail":"Attempts to identify external IP address"},{"detail":"Queries sensitive IE security settings"},{"detail":"Reads system information using WMIC"}],"details_count":4,"name":"Fingerprint","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"details":[{"detail":"Marks file for deletion"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"details_count":2,"name":"Evasive","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"details":[{"detail":"Contacts 1 domain and 1 host"}],"details_count":1,"name":"Network Behavior","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Location Discovery"},{"attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Protocols"},{"attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Internal Proxy"},{"attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"},{"type":"informative","value":"Modifies data representation using PowerShell"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Manipulation"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"References to WMI query strings used to retrieve disk information"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Attempts to get system information using PowerShell"},{"type":"informative","value":"Tries to enumerate objects using PowerShell"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Disable or Modify Tools"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"PCAP contains base64 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Data Encoding"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"},{"attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Resource Development","technique":"Domains"},{"attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Evasion"},{"attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Collection","technique":"Email Collection"},{"attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Non-Standard Port"},{"attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Command and Control","technique":"DNS"},{"attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Persistence","technique":"Boot or Logon Autostart Execution"},{"attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Debugger Evasion"},{"attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"User Activity Based Checks"},{"attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Asymmetric Cryptography"},{"attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Discovery","technique":"Device Driver Discovery"},{"attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Steal Web Session Cookie"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Code Signing"},{"attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Execution","technique":"Scheduled Task/Job"},{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection"},{"attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Bypass User Account Control"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Management Instrumentation"},{"attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Able to build PowerShell events through modules contained in the .NET code"},{"type":"informative","value":"Executes PowerShell with command line"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Execution","technique":"PowerShell"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"malicious","value":"PE file contains executable resources"},{"type":"informative","value":"YARA signature match – Embedded PE executable"},{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Embedded Payloads"},{"attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Collection","technique":"Local Data Staging"},{"attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Collection","technique":"Automated Collection"},{"attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft"},{"attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Local System"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Persistence","technique":"Modify Registry"},{"attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion"},{"attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credentials from Password Stores"},{"attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Credential Access","technique":"OS Credential Dumping"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Detected file retrieval based on search patterns"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Proxy"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Dynamic API Resolution"},{"attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Owner/User Discovery"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API used to retrieve process information"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Persistence","technique":"Component Object Model Hijacking"},{"attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"ListPlanting"},{"attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"System Checks"},{"attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to create a named pipe"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Lateral Tool Transfer"},{"attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Scheduled Transfer"},{"attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Command Shell"},{"attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"malicious","value":"Starts service using SC.exe"},{"type":"suspicious","value":"Opened the service control manager"},{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Able to access control system service controller"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Execution","technique":"Service Execution"},{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Reflective Code Loading"},{"attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerading"},{"attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Encrypted/Encoded File"},{"attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Attempts to identify external IP address"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Configuration Discovery"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"},{"attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Persistence","technique":"Socket Filters"},{"attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve instances of WMI objects (Powershell command string)"},{"type":"informative","value":"Retrieves instances of WMI objects using PowerShell"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Discovery","technique":"Security Software Discovery"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Impact","technique":"System Shutdown/Reboot"},{"attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Encrypted for Impact"},{"attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hide Artifacts"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal from Tools"},{"attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Execution","technique":"Inter-Process Communication"},{"attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Execution","technique":"Command and Scripting Interpreter"},{"attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call"},{"attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Local Storage"},{"attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Reconnaissance","technique":"IP Addresses"},{"attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Access Token Manipulation"},{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets"},{"attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Discovery","technique":"Remote System Discovery"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Collection","technique":"Archive via Library"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve type of COM object"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Execution","technique":"Component Object Model"},{"attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Time Discovery"}],"rule_matches":{},"sandbox_signatures":[{"category":"General","description":"\"19001a000000000040c71232f97f0000@ntdll.dll\"\n \"220023000000000018c71232f97f0000@ntdll.dll\"\n \"19001a005c00000040c71232f97f0000@ntdll.dll\"\n \"\"#\\@ntdll.dll\"","id":"api-8","level":"informative","mitre_attack_id":"T1129","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","origin":"API Call","relevance":1,"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"category":"General","description":"\"38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0.bin\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x1405c32e4,add\trsp, 0x28,jmp\t0x1405c2c6c,int3\t,int3\t,sub\trsp, 0x28,call\t0x1402b4a70,jmp\t0x1405c2e11,xor\teax, eax,add\trsp, 0x28,ret\t,int3\t,int3\t,mov\tqword ptr [rsp + 0x10], rbx,mov\tqword ptr [rsp + 0x18], rbp,mov\tqword ptr [rsp + 0x20], rsi,push\trdi,sub\trsp, 0x10,xor\teax, eax,xor\tecx, ecx,cpuid\t,xor\tecx, 0x6c65746e,xor\tedx, 0x49656e69,or\tedx, ecx,mov\tebp, eax,mov\teax, 1,xor\tebx, 0x756e6547,or\tedx, ebx,lea\tecx, [rax - 1],cpuid\t,\"","id":"static-96","level":"informative","name":"PE file entrypoint instructions","origin":"Static Parser","sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$22","id":"registry-172","level":"informative","mitre_attack_id":"T1012","name":"Queries registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$23","id":"api-161","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (non-executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"handle:{0}, setsockopt():{1}\" (Indicator: \"setsockopt\"; File: \"38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0.bin\")\n Found reference to API \"handle:{0} setsockopt():{1}\" (Indicator: \"setsockopt\"; File: \"38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0.bin\")\n Found reference to API \"SetSockOpt returns errorCode:{0}\" (Indicator: \"setsockopt\"; File: \"38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0.bin\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00005772-00000C2B-1338313226\")","id":"string-879","level":"informative","mitre_attack_id":"T1205.002","name":"Able to monitor socket connection","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"category":"General","description":"\" HTTP/1.1 101 Switching Protocols\nUpgrade: websocket\nConnection: Upgrade\nSec-WebSocket-Accept: 53fv15unDnKN9TnP1wLjyXjfplg= with no response body\n \"GET / HTTP/1.1\" Response ==> HTTP/1.1 200 OK\nDate: Thu\n 09 Apr 2026 08:51:16 GMT\nContent-Type: text/plain\nContent-Length: 13\nConnection: keep-alive\nServer: cloudflare\nVary: Origin\ncf-cache-status: DYNAMIC\nCF-RAY: 9e9844da48758f74-SJC with response body ==>36342E3132342E31322E313632.......","id":"network-2","level":"informative","mitre_attack_id":"T1071.001","name":"GETs files from a web server (PE files)","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"69d76852451cbf11aa0e00a8","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"