24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dump:Generic.Dacic.18086 Sample 4da4b163522c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4da4b163522c…. Malware family: Dump:Generic.Dacic.18086. Threat score 100/100. 13/27 AV engines flagged this file. 5 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6","keywords":["Malicious","Dump:Generic.Dacic.18086","malware analysis","sandbox report","threat intelligence","4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6"],"about":{"@type":"SoftwareApplication","name":"Xeno_1.3.6.0.exe","applicationCategory":["peexe","executable"],"identifier":"4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dump:Generic.Dacic.18086","antivirusDetections":{"malicious":13,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T973,"Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\WIN32") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\WIN32") "Xeno_1.3.6.0.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\WIN32") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\WIN32") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\INTERFACE\{027947E1-D731-11CE-A357-000000000001}") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{027947E1-D731-11CE-A357-000000000001}") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\INTERFACE\{027947E1-D731-11CE-A357-000000000001}\PROXYSTUBCLSID32") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{027947E1-D731-11CE-A357-000000000001}\PROXYSTUBCLSID32") "Xeno_1.3.6.0.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{027947E1-D731-11CE-A357-000000000001}\PROXYSTUBCLSID32") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{027947E1-D731-11CE-A357-000000000001}\PROXYSTUBCLSID32") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\INPROCSERVER32") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\INPROCSERVER32") "Xeno_1.3.6.0.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\INPROCSERVER32") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\INPROCSERVER32")26:T772,"Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1084272371 [PID: 7288] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1084297329 [PID: 7288] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1084527338 [PID: 7288] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1084535661 [PID: 7288] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1085086904 [PID: 7288] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1085095221 [PID: 7288] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1085353437 [PID: 7288] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1085362190 [PID: 7288] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1085989982 [PID: 7288] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1085998304 [PID: 7288] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1086245758 [PID: 7288] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1086254431 [PID: 7288] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1086543037 [PID: 7288] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1086552262 [PID: 7288] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1088334071 [PID: 7288] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1088342144 [PID: 7288] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1129752581 [PID: 7288] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00007288-00000C15-1129760007 [PID: 7288]27:T1266,Contains base64 string in header "http" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 354Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 354Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 354Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 354Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 354Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 354Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 354Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "http" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "POST" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "orbs" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "http" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "client/2" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "0Content" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "Type" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip"28:T3750,Found XOR loop in file "sample.bin" at offset 5464; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 186449; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 262159; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 359882; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 382573; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 421186; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 501561; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 534090; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 565201; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 592968; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 706656; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 708358; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 762602; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 851398; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 859705; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 953030; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1028970; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1066041; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1121122; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1190350; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1390243; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1484105; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1591588; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1679557; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1695266; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1699816; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1712323; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1775957; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1794419; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1870421; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1888631; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1894456; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1924059; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1993881; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2109434; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2125882; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2141790; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2187380; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2202162; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2252946; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2365968; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2459718; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2581431; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2593471; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2764137; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2798180; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2888141; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2997867; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2997984; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3009623; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3111048; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3118697; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3147319; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3215083; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3365877; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3369995; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3464230; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3477139; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3499606; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3509765; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3512927; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3533818; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3542150; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3574582; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 65055; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 87292; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 173180; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 320530; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 500595; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 646673; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 682247; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 816099; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 817493; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 922332; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 956425; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 985294; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1115002; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1162378; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1204793; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1216527; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1232383; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1239118; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1312480; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1330008; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1367100; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1387016; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1389015; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1405527; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1407523; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1418384; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1453566; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1455052; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1486974; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1493605; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1497183; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1549948; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1652462; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1693659; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1728118; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1788867; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1822319; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1850554; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1918202; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1948708; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1991224; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2022832; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2070898; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2208299; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2344190; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2497634; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2635632; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2675739; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2694145; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2709952; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2725387; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2826455; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2848494; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2932365; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2949176; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3004697; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3038361; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3174839; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3222696; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3252173; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3280416; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3415235; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3480453; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3526692; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3530553; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3567694; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 50064; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 87885; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 163316; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 336356; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 435032; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 464190; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 534328; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 614845; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 623577; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 660833; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 711376; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 944457; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1024690; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1070125; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1084635; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1088485; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1201085; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1257533; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1340563; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1371498; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1388338; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1408760; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1449547; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1452088; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1598895; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1659800; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1701560; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1842080; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1875091; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1875630; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1879922; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1929796; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1939271; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2064029; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2065357; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2068814; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2110302; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2145433; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2175222; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2183361; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2191997; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2214819; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2219119; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2268857; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2316631; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2324747; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2583595; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2628820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2721629; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2725644; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2745007; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2876851; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2917241; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2929787; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2946779; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3039992; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3089149; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3423146; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3503823; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3537316; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3558935; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3561018; code bytes = 803029:T1162,"Xeno_1.3.6.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0000009e29437720bdab030000000028000000240000000000aa03f0ed8f010000000000000000000000000000000000000000d007910330000000000000000c0000000000910300000000660000000000000000000000b8baab03b8b0aa030c000000000000002000000000009103d00191033c0c910300000000380c910300000000e8ed8f0150f5427720bdab0350ee8f019cee8f01 (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000897600000000d0b1857680ebe0265cbc85763000ac03000000003dbc8576bdc1696874ab8d76fddb8c763dc669680000000060db8c765261857698b9ae0348869d760000000001c3696894ece026c79686760000000098b9ae0348869d760118000094ece026d2968676d82f7f76501e8676f996867600000000d82f7f767cdbab0304ede02698b9ae0388ebe02600000000e0f2e02600a88d7675e61538fefffffffddb8c76b702867624839d763000ac03e05a8d766dfa8576cceee0263000ac03ccfa8576000000003000ac03e0f0e0260000000050377f760000000000010000000000000000cf6da887ae0300000000000000000000000000000000 (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000897600000000d0b1857668e8e0265cbc85769004ac03000000003dbc857655c2696874ab8d76fddb8c76d5c269680000000060db8c7652618576f80bb00348869d760000000019cc69687ce9e026c796867600000000f80bb00348869d76011800007ce9e026d2968676d82f7f76501e8676f996867600000000d82f7f76bcdbab03ece9e026f80bb00370e8e02600000000c8efe02600a88d7675e61538fefffffffddb8c76b702867624839d769004ac03e05a8d766dfa8576b4ebe0269004ac03ccfa8576d069f5009004ac03c8ede0260000000050377f7600000000300000000000000057000000a855ad0300000000410d00000000000000000000 (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000897600000000d0b1857658ebe0265cbc8576f003ac03000000003dbc857665c1696874ab8d76fddb8c76e5c169680000000060db8c76526185766805b00348869d760000000029c369686cece026c7968676000000006805b00348869d76011800006cece026d2968676d82f7f76501e8676f996867600000000d82f7f76bcdaab03dcece0266805b00360ebe02600000000b8f2e02600a88d7675e61538fefffffffddb8c76b702867624839d76f003ac03e05a8d766dfa8576a4eee026f003ac03ccfa8576d069f500f003ac03b8f0e0260000000050377f7600000000300000000000000058000000f8d3af03000000004f1700000000000000000000 (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000897600000000d0b1857618e7e0265cbc8576d000ac03000000003dbc857625cd696874ab8d76fddb8c76a5cd69680000000060db8c7652618576f8b8ae0348869d7600000000e9ce69682ce8e026c796867600000000f8b8ae0348869d76011800002ce8e026d2968676d82f7f76501e8676f996867600000000d82f7f76bcdaab039ce8e026f8b8ae0320e7e0260000000078eee02600a88d7675e61538fefffffffddb8c76b702867624839d76d000ac03e05a8d766dfa857664eae026d000ac03ccfa8576d069f500d000ac0378ece0260000000050377f7600000000300000000000000052000000686fb003000000004e1300000000000000000000 (UID: 00000000-00007288)2a:Tc63,"Xeno_1.3.6.0.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")2b:T51f,"Xeno_1.3.6.0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "Xeno_1.3.6.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Xeno_1.3.6.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Xeno_1.3.6.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "Xeno_1.3.6.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "Xeno_1.3.6.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "Xeno_1.3.6.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "Xeno_1.3.6.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "Xeno_1.3.6.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "Xeno_1.3.6.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")2c:T596,"Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007288)2d:T382a,"Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WerGetFlags (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter SetProcessPriorityBoost (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter RaiseFailFastException (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetErrorMode (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter NtAssociateWaitCompletionPacket (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter NtCancelWaitCompletionPacket (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter getsockname (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter getsockopt (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WSARecvFrom (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WSASendTo (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CLSIDFromProgID (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter VariantInit (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter VariantClear (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetLastInputInfo (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CancelIoEx (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter socket (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter getpeername (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CertCreateCertificateContext (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CertAddCertificateContextToStore (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00007288)2e:T56c,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007288.00000000.133422.03AA0000.00000004.mdmp 00000000-00007288.00000002.137264.03AA0000.00000004.mdmp 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}" in Source: 00000000-00007288.00000000.133422.03AA0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00007288.00000000.133422.03AA0000.00000004.mdmp 00000000-00007288.00000002.137264.03AA0000.00000004.mdmp 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}" in Source: 00000000-00007288.00000000.133422.03AA0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}" in Source: 00000000-00007288.00000000.133422.03AA0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00007288.00000002.137264.03AA0000.00000004.mdmp 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020404-0000-0000-C000-000000000046}" in Source: 00000000-00007288.00000002.137264.03AA0000.00000004.mdmp 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp2f:T764,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007288.00000000.133422.03AA0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}" in Source: 00000000-00007288.00000000.133422.03AA0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00007288.00000000.133422.03AA0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}" in Source: 00000000-00007288.00000000.133422.03AA0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}" in Source: 00000000-00007288.00000000.133422.03AA0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007288.00000002.137264.03AA0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00007288.00000002.137264.03AA0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00007288.00000002.137264.03AA0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020404-0000-0000-C000-000000000046}" in Source: 00000000-00007288.00000002.137264.03AA0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020404-0000-0000-C000-000000000046}" in Source: 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp30:Ta00,"GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 354 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 500 Internal Server Error Server: Angie Date: Tue 22 Sep 2026 02:31:57 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=O7zA%2F83UxBtErkIUdYxz21oGAwqkYhMmS%2BuqZ51DCwHtFyqTw%2BHKJi5Jenbnmy700uRsKVHnJx9AekS7MCDzObfbQPSCVVO%2BoPg9HV5ws7SzFnJYoOfLVpuwYjVj"}]} CF-RAY: a3ede5790abe86dc-AMS alt-svc: h3=":443"; ma=86400 with no response body "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Tue 22 Sep 2026 02:32:02 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a3ede5999e7607e8-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Tue 22 Sep 2026 02:32:03 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a3ede59b39e7306f-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D.......31:T9e3,"Xeno_1.3.6.0.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72a30000 "Xeno_1.3.6.0.exe" loaded module "KERNEL32.DLL" at base 74990000 "Xeno_1.3.6.0.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 75300000 "Xeno_1.3.6.0.exe" loaded module "NTDLL.DLL" at base 773f0000 "Xeno_1.3.6.0.exe" loaded module "WINMM.DLL" at base 729e0000 "Xeno_1.3.6.0.exe" loaded module "POWRPROF.DLL" at base 73eb0000 "Xeno_1.3.6.0.exe" loaded module "WS2_32.DLL" at base 74800000 "Xeno_1.3.6.0.exe" loaded module "USER32.DLL" at base 73f00000 "Xeno_1.3.6.0.exe" loaded module "ADVAPI32.DLL" at base 73e30000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72c50000 "Xeno_1.3.6.0.exe" loaded module "IPHLPAPI.DLL" at base 73dd0000 "Xeno_1.3.6.0.exe" loaded module "RPCRT4.DLL" at base 76de0000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 729a0000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72950000 "Xeno_1.3.6.0.exe" loaded module "USERENV.DLL" at base 72920000 "Xeno_1.3.6.0.exe" loaded module "SECUR32.DLL" at base 72910000 "Xeno_1.3.6.0.exe" loaded module "SSPICLI.DLL" at base 73e10000 "Xeno_1.3.6.0.exe" loaded module "OLE32.DLL" at base 74a90000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73a00000 "Xeno_1.3.6.0.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76a20000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 728d0000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 73e30000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 72850000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 76ea0000 "Xeno_1.3.6.0.exe" loaded module "OLEAUT32.DLL" at base 76ea0000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 727a0000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 72790000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 726d0000 "Xeno_1.3.6.0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76a20000 "Xeno_1.3.6.0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76a20000 "Xeno_1.3.6.0.exe" loaded module "CRYPT32.DLL" at base 770f0000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 728e0000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7530000032:T563,"Xeno_1.3.6.0.exe" touched "WBEM Scripting Locator" (Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}") "Xeno_1.3.6.0.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "Xeno_1.3.6.0.exe" touched "PSDispatch" (Path: "HKCU\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "Xeno_1.3.6.0.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "Xeno_1.3.6.0.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "Xeno_1.3.6.0.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "Xeno_1.3.6.0.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "Xeno_1.3.6.0.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "Xeno_1.3.6.0.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "Xeno_1.3.6.0.exe" touched "PSEnumVariant" (Path: "HKCU\WOW6432NODE\CLSID\{00020421-0000-0000-C000-000000000046}\TREATAS")33:T6cb,The input sample is signed with a certificate issued by "CN=SSL.com SSL Intermediate CA ECC R2, O=SSL Corp, L=Houston, ST=Texas, C=US" (SHA1: F8:86:35:01:72:60:D4:0B:9E:B4:17:BE:E7:37:37:91:1B:63:0E:59; see report for more information) The input sample is signed with a certificate issued by "CN=SSL.com Root Certification Authority ECC, O=SSL Corporation, L=Houston, ST=Texas, C=US" (SHA1: 92:19:61:2E:90:1C:49:04:F9:83:5E:E8:C2:AD:D5:4F:F0:B7:97:FD; see report for more information) The input sample is signed with a certificate issued by "CN=YE1, O=Let's Encrypt, C=US" (SHA1: AB:25:EB:6F:79:0C:98:69:DF:E7:06:17:12:53:55:51:63:BA:20:D7; see report for more information) The input sample is signed with a certificate issued by "CN=Root YE, O=ISRG, C=US" (SHA1: D0:93:70:A9:86:49:82:A5:04:7D:A4:63:73:54:02:56:D0:8A:3C:81; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X2, O=Internet Security Research Group, C=US" (SHA1: F3:76:20:FC:4B:1C:DD:D2:A3:D7:4B:1D:5E:8D:B4:2E:24:4C:A0:06; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 3C:34:E3:56:C7:FC:17:F5:AC:F0:48:24:BC:58:7C:6C:62:39:51:A2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Atlas R3 DV TLS CA 2026 Q2, O=GlobalSign nv-sa, C=BE" (SHA1: 43:73:33:AB:BC:05:B7:FC:F3:56:7F:D7:00:31:93:88:47:3D:DE:5B; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3" (SHA1: 37:08:77:93:79:80:7F:7C:FD:3C:9C:5E:62:83:55:15:F3:CC:62:0C; see report for more information)34:Tb3b,"Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OID"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTDLLDECODEOBJECTEX"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECTEX"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECTEX\1.2.840.113549.1.9.16.1.1"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECTEX\1.2.840.113549.1.9.16.2.1"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECTEX\1.2.840.113549.1.9.16.2.11"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECTEX\1.2.840.113549.1.9.16.2.12"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECTEX\1.2.840.113549.1.9.16.2.2"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECTEX\1.2.840.113549.1.9.16.2.3"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECTEX\1.2.840.113549.1.9.16.2.4"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\MSASN1"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: ""; Value: "")35:T1190,"Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "DISABLEMANDATORYBASICCONSTRAINTS"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "DISABLECANAMECONSTRAINTS"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "DISABLEUNSUPPORTEDCRITICALEXTENSIONS"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXAIAURLCOUNTINCERT"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXAIAURLRETRIEVALCOUNTPERCHAIN"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXURLRETRIEVALBYTECOUNT"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXAIAURLRETRIEVALBYTECOUNT"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MAXAIAURLRETRIEVALCERTCOUNT"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "CRYPTNETPREFETCHTRIGGERPERIODSECONDS"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "ENABLEWEAKSIGNATUREFLAGS"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "MINRSAPUBKEYBITLENGTH"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "WEAKRSAPUBKEYTIME"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "CHAINCACHERESYNCFILETIME"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "ENABLESTRICTCHECKSFLAGS"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "WEAKMD5THIRDPARTYFLAGS"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG\DEFAULT"; Key: "WEAKMD5THIRDPARTYFLAGS"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG\DEFAULT"; Key: "WEAKMD5THIRDPARTYAFTERTIME"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "WEAKMD5ALLFLAGS"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CI\CONFIG"; Key: "WEAKMD5ALLFLAGS"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG\DEFAULT"; Key: "WEAKMD5ALLFLAGS"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CI\CONFIG\DEFAULT"; Key: "WEAKMD5ALLFLAGS"; Value: "")36:T467,"Xeno_1.3.6.0.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\FLTLIB.DLL" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\MSVCP140.DLL" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\MSVCP140.dll" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\BCRYPT.DLL" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\bcrypt.dll" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\Windows\SysWOW64\wbem\WBEMCOMN.DLL" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\wbem\wbemcomn.dll"37:T7d1,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007288.00000000.133422.03AA0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=7jwihv%2fe8wd%2btxd2vzpmg%2fllkngcn33s20jztrprlevuyy9pfqwna%2fucg8gvqlce1xv8fefeq7kz2nq1qnqg3t5hcovtbfozfdy%2f%2bjugkjbcqoqdnzpsszpwsynl" - Source: "00000000-00007288.00000000.133422.06480000.00000004.mdmp") Found URL "http://ocsp.v)i'qu9r@x@dz,qc]x" - Source: "00000000-00007288.00000000.133422.06480000.00000004.mdmp") Found URL "http://i.pki.goog/wr2.crt0dns.googledns.google.com*.dns.google.com8888.googledns64.dns.googleh" - Source: "00000000-00007288.00000000.133422.06480000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/gsyt1n4pbrg.crl0t!!>" - Source: "00000000-00007288.00000000.133422.06480000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crt0+$0" - Source: "00000000-00007288.00000000.133422.06480000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/oi4td@k0fqll>>us1" - Source: "00000000-00007288.00000000.133422.06480000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/o" - Source: "00000000-00007288.00000000.133422.06480000.00000004.mdmp") Found URL "http://ocsp" - Source: "00000000-00007288.00000000.133422.06480000.00000004.mdmp") Found URL "http://ocspgoogle" - Source: "00000000-00007288.00000000.133422.06480000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/ogoogle" - Source: "00000000-00007288.00000000.133422.06480000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr10)http://pki.goog/gsr1/gsr1.crt02+0)0'!http://crl.pki.goog/gsr1/gsr1.crl0;40207okzgm=" - Source: "00000000-00007288.00000000.133422.06480000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0s" - Source: "00000000-00007288.00000000.133422.06480000.00000004.mdmp") Found URL "http://ocsp.pki.goog/g" - Source: "00000000-00007288.00000000.133422.06480000.00000004.mdmp") Found URL "http://ocsp.pki.goog/ggoogle" - Source: "00000000-00007288.00000000.133422.06480000.00000004.mdmp")38:Tac3,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007288.00000000.133422.03AA0000.00000004.mdmp, 00000000-00007288.00000001.135344.03AA0000.00000004.mdmp, 00000000-00007288.00000002.137264.03AA0000.00000004.mdmp, 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007288.00000000.133422.03AA0000.00000004.mdmp, 00000000-00007288.00000001.135344.03AA0000.00000004.mdmp, 00000000-00007288.00000002.137264.03AA0000.00000004.mdmp, 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007288.00000000.133422.03AA0000.00000004.mdmp, 00000000-00007288.00000001.135344.03AA0000.00000004.mdmp, 00000000-00007288.00000002.137264.03AA0000.00000004.mdmp, 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007288.00000000.133422.03AA0000.00000004.mdmp, 00000000-00007288.00000001.135344.03AA0000.00000004.mdmp, 00000000-00007288.00000002.137264.03AA0000.00000004.mdmp, 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007288.00000000.133422.03AA0000.00000004.mdmp, 00000000-00007288.00000001.135344.03AA0000.00000004.mdmp, 00000000-00007288.00000002.137264.03AA0000.00000004.mdmp, 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007288.00000000.133422.03AA0000.00000004.mdmp, 00000000-00007288.00000001.135344.03AA0000.00000004.mdmp, 00000000-00007288.00000002.137264.03AA0000.00000004.mdmp, 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007288.00000000.133422.03AA0000.00000004.mdmp, 00000000-00007288.00000001.135344.03AA0000.00000004.mdmp, 00000000-00007288.00000002.137264.03AA0000.00000004.mdmp, 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007288.00000000.133422.03AA0000.00000004.mdmp, 00000000-00007288.00000001.135344.03AA0000.00000004.mdmp, 00000000-00007288.00000002.137264.03AA0000.00000004.mdmp, 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp")39:Tc2e,"Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}"; Key: "SEARCHLIST"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPRACOEXISTENCEENABLED"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPV6DOMAIN"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "")3a:T5cb3,"POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgBzaHlldG9vdHZhbACNoplI"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:30:53 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1790044253.280444 VS0 VE2 X-Served-By: cache-lax-kwhp1940020-LAX X-Cache: HIT Accept-Ranges: bytes Age: 13 X-Cache-Hits: 1 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"EQC3dNlesgVD8YbAazcauIrXBPfiVhMMr5YYk2in0Mtsz0Bz","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEADwAAGgBzaHlldG9vdHZhbAD607xQ"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:30:53 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1790044253.352669 VS0 VE3 X-Served-By: cache-lax-kwhp1940020-LAX X-Cache: HIT Accept-Ranges: bytes Age: 13 X-Cache-Hits: 1 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"EQD2HFpCkKlDS-Cvow9jPU7SDQ-pEq000a2sG5U39JwoUXRR","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAAwAAAgDTZ9xB"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:30:53 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1790044253.421788 VS0 VE1 X-Served-By: cache-lax-kwhp1940020-LAX X-Cache: HIT Accept-Ranges: bytes Age: 13 X-Cache-Hits: 1 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgBzaHlldG9vdHZhbACNoplI"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:30:54 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1790044254.497479 VS0 VE0 X-Served-By: cache-lax-kwhp1940020-LAX X-Cache: HIT Accept-Ranges: bytes Age: 14 X-Cache-Hits: 2 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"EQC3dNlesgVD8YbAazcauIrXBPfiVhMMr5YYk2in0Mtsz0Bz","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEADwAAGgBzaHlldG9vdHZhbAD607xQ"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:30:54 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1790044255.560293 VS0 VE0 X-Served-By: cache-lax-kwhp1940020-LAX X-Cache: HIT Accept-Ranges: bytes Age: 14 X-Cache-Hits: 2 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"EQD2HFpCkKlDS-Cvow9jPU7SDQ-pEq000a2sG5U39JwoUXRR","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAAwAAAgDTZ9xB"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:30:54 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1790044255.624565 VS0 VE0 X-Served-By: cache-lax-kwhp1940020-LAX X-Cache: HIT Accept-Ranges: bytes Age: 14 X-Cache-Hits: 2 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgBzaHlldG9vdHZhbACNoplI"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:30:55 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1790044256.704332 VS0 VE0 X-Served-By: cache-lax-kwhp1940020-LAX X-Cache: HIT Accept-Ranges: bytes Age: 15 X-Cache-Hits: 3 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"EQC3dNlesgVD8YbAazcauIrXBPfiVhMMr5YYk2in0Mtsz0Bz","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEADwAAGgBzaHlldG9vdHZhbAD607xQ"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:30:55 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1790044256.770123 VS0 VE0 X-Served-By: cache-lax-kwhp1940020-LAX X-Cache: HIT Accept-Ranges: bytes Age: 15 X-Cache-Hits: 3 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"EQD2HFpCkKlDS-Cvow9jPU7SDQ-pEq000a2sG5U39JwoUXRR","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAAwAAAgDTZ9xB"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:30:55 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1790044256.838333 VS0 VE0 X-Served-By: cache-lax-kwhp1940020-LAX X-Cache: HIT Accept-Ranges: bytes Age: 15 X-Cache-Hits: 3 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgBzaHlldG9vdHZhbACNoplI"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:31:53 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1790044314.536153 VS0 VE1 X-Served-By: cache-lax-kwhp1940020-LAX X-Cache: HIT Accept-Ranges: bytes Age: 14 X-Cache-Hits: 1 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"EQC3dNlesgVD8YbAazcauIrXBPfiVhMMr5YYk2in0Mtsz0Bz","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEADwAAGgBzaHlldG9vdHZhbAD607xQ"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:31:53 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1790044314.603789 VS0 VE3 X-Served-By: cache-lax-kwhp1940020-LAX X-Cache: HIT Accept-Ranges: bytes Age: 14 X-Cache-Hits: 1 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"EQD2HFpCkKlDS-Cvow9jPU7SDQ-pEq000a2sG5U39JwoUXRR","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAAwAAAgDTZ9xB"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:31:53 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1790044314.672536 VS0 VE1 X-Served-By: cache-lax-kwhp1940020-LAX X-Cache: HIT Accept-Ranges: bytes Age: 13 X-Cache-Hits: 1 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgBzaHlldG9vdHZhbACNoplI"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:31:54 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1790044315.744532 VS0 VE0 X-Served-By: cache-lax-kwhp1940020-LAX X-Cache: HIT Accept-Ranges: bytes Age: 15 X-Cache-Hits: 2 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"EQC3dNlesgVD8YbAazcauIrXBPfiVhMMr5YYk2in0Mtsz0Bz","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEADwAAGgBzaHlldG9vdHZhbAD607xQ"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:31:54 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1790044315.813085 VS0 VE0 X-Served-By: cache-lax-kwhp1940020-LAX X-Cache: HIT Accept-Ranges: bytes Age: 15 X-Cache-Hits: 2 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"EQD2HFpCkKlDS-Cvow9jPU7SDQ-pEq000a2sG5U39JwoUXRR","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAAwAAAgDTZ9xB"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:31:54 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1790044315.882294 VS0 VE0 X-Served-By: cache-lax-kwhp1940020-LAX X-Cache: HIT Accept-Ranges: bytes Age: 14 X-Cache-Hits: 2 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgBzaHlldG9vdHZhbACNoplI"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:31:55 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1790044316.957224 VS0 VE0 X-Served-By: cache-lax-kwhp1940020-LAX X-Cache: HIT Accept-Ranges: bytes Age: 16 X-Cache-Hits: 3 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"EQC3dNlesgVD8YbAazcauIrXBPfiVhMMr5YYk2in0Mtsz0Bz","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEADwAAGgBzaHlldG9vdHZhbAD607xQ"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:31:56 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1790044316.025031 VS0 VE0 X-Served-By: cache-lax-kwhp1940020-LAX X-Cache: HIT Accept-Ranges: bytes Age: 16 X-Cache-Hits: 3 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"EQD2HFpCkKlDS-Cvow9jPU7SDQ-pEq000a2sG5U39JwoUXRR","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAAwAAAgDTZ9xB"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:31:56 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1790044316.093580 VS0 VE0 X-Served-By: cache-lax-kwhp1940020-LAX X-Cache: HIT Accept-Ranges: bytes Age: 15 X-Cache-Hits: 3 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:32:03 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790044323.308049 VS0 VE0 X-Served-By: cache-lax-kwhp1940020-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:32:04 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790044324.377517 VS0 VE0 X-Served-By: cache-lax-kwhp1940020-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:32:05 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790044325.452598 VS0 VE1 X-Served-By: cache-lax-kwhp1940020-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:32:07 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790044328.527106 VS0 VE0 X-Served-By: cache-lax-kwhp1940020-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:32:08 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790044329.599137 VS0 VE2 X-Served-By: cache-lax-kwhp1940020-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:32:09 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790044330.671181 VS0 VE1 X-Served-By: cache-lax-kwhp1940020-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:32:11 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790044332.757608 VS0 VE0 X-Served-By: cache-lax-kwhp1940020-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body3b:T41a,"Xeno_1.3.6.0.exe" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "Process32NextW with parameter System" (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "Process32NextW with parameter smss.exe" (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "Process32NextW with parameter csrss.exe" (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "Process32NextW with parameter wininit.exe" (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "Process32NextW with parameter winlogon.exe" (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "Process32NextW with parameter services.exe" (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "Process32NextW with parameter lsass.exe" (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "Process32NextW with parameter svchost.exe" (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "Process32NextW with parameter fontdrvhost.exe" (UID: 00000000-00007288) "Xeno_1.3.6.0.exe" called "Process32NextW with parameter dwm.exe" (UID: 00000000-00007288)3c:Ta24,"Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790758332601,"unified_at":"2026-09-30T08:52:12.601Z","metadata":{"hashes":{"sha256":"4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6","sha1":"50633592c6eb7f8e748a0c97a30c670f169edbc1","md5":"00998bc7baae454287d475eedac5645d","sha512":"4094015ab1a299db1a5b8a84d313eb9b8c39dff69c1065911953f444c773a1c91d93e1c7bb086ae5a3c2bb6efb86aaa9061ed57357bea003f9c82294928c3086","ssdeep":"98304:3aVnrzbqGVg+cIqKthNHIZ7XrRQ3aj3B6dr:3+nrBVg+ZdthNHIZLrLjAd","ssdeep_chunks":["98304:3aVnrzb","98304:aVnrzbq","98304:VnrzbqG","98304:nrzbqGV","98304:rzbqGVg","98304:zbqGVg+","98304:bqGVg+c","98304:qGVg+cI","98304:GVg+cIq","98304:Vg+cIqK","98304:g+cIqKt","98304:+cIqKth","98304:cIqKthN","98304:IqKthNH","98304:qKthNHI","98304:KthNHIZ","98304:thNHIZ7","98304:hNHIZ7X","98304:NHIZ7Xr","98304:HIZ7XrR","98304:IZ7XrRQ","98304:Z7XrRQ3","98304:7XrRQ3a","98304:XrRQ3aj","98304:rRQ3aj3","98304:RQ3aj3B","98304:Q3aj3B6","98304:3aj3B6d","98304:aj3B6dr","196608:3aVnrzb","196608:aVnrzbq","196608:VnrzbqG","196608:nrzbqGV","196608:rzbqGVg","196608:zbqGVg+","196608:bqGVg+c","196608:qGVg+cI","196608:GVg+cIq","196608:Vg+cIqK","196608:g+cIqKt","196608:+cIqKth","196608:cIqKthN","196608:IqKthNH","196608:qKthNHI","196608:KthNHIZ","196608:thNHIZ7","196608:hNHIZ7X","196608:NHIZ7Xr","196608:HIZ7XrR","196608:IZ7XrRQ","196608:Z7XrRQ3","196608:7XrRQ3a","196608:XrRQ3aj","196608:rRQ3aj3","196608:RQ3aj3B","196608:Q3aj3B6","196608:3aj3B6d","196608:aj3B6dr","98304:3+nrBVg","98304:+nrBVg+","98304:nrBVg+Z","98304:rBVg+Zd","98304:BVg+Zdt","98304:Vg+Zdth","98304:g+ZdthN","98304:+ZdthNH","98304:ZdthNHI","98304:dthNHIZ","98304:thNHIZL","98304:hNHIZLr","98304:NHIZLrL","98304:HIZLrLj","98304:IZLrLjA","98304:ZLrLjAd"],"imphash":"6ed4f5f04d62b18d96b26d6db7c18840"},"file_info":{"file_name":"Xeno_1.3.6.0.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":3592704,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1790041824000,"last_seen":1790044176000,"last_multi_scan":1790044176000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["salatstealer","wacatac","criminal","informationstealer","rat","evasive","suspicious","malicious"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":60},"sandbox_signatures":{"informative_count":105,"suspicious_count":21,"malicious_count":5,"total":131},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.SalatStealer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Multi.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Dump:Generic.Dacic.18086.A129FB77","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Dump:Generic.Dacic.18086.A129FB77 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of WinGo/Agent_AGen.XS trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005ce1d91 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"YARA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Salat-B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Banker/W32.Agent.12570112","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABTrojan.UKNX-0730","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Dump:Generic.Dacic.18086","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to transfer data using curl"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Recently renewed or created SSL certificate"},{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Defense Evasion","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","identifiers":[{"type":"suspicious","value":"PE file has no resource directory"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file is packed with UPX"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"References to WMI query strings used for information discovery"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Attempts to retrieve the system language code"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"suspicious","value":"Calls an API typically used to import asymmetric cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"Tries to GET non-existent files from a web server"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-153","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with bottom confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-19","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"kv.gi\", Heuristic match: \"is9.uz\", Heuristic match: \"ay\t.in\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"cuRl\" (Indicator: \"curl\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-576","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"\naES7\" (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"Xeno_1.3.6.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007288.00000000.133422.03AA0000.00000004.mdmp, 00000000-00007288.00000001.135344.03AA0000.00000004.mdmp, 00000000-00007288.00000002.137264.03AA0000.00000004.mdmp, 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007288.00000002.137264.03AA0000.00000004.mdmp, 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\root\\cimv2; Source: \"00000000-00007288.00000000.133422.03AA0000.00000004.mdmp\")\n Found string - \\.\\root\\cimv2; Source: \"00000000-00007288.00000002.137264.03AA0000.00000004.mdmp, 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"Xeno_1.3.6.0.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"Xeno_1.3.6.0.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$25","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$26","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00007288.00000000.133422.03AA0000.00000004.mdmp, 00000000-00007288.00000001.135344.03AA0000.00000004.mdmp, 00000000-00007288.00000002.137264.03AA0000.00000004.mdmp, 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00007288.00000002.137264.03AA0000.00000004.mdmp, 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$27","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.99992","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$28","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007288-00000C2C-1085515018\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00007288-00000C2C-1090251809\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007288-00000C2C-1085743446\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007288-00000C2C-1085743518\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007288-00000C2C-1085743716\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00007288-00000C2C-1086160762\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007288.00000000.133422.03AA0000.00000004.mdmp, 00000000-00007288.00000001.135344.03AA0000.00000004.mdmp, 00000000-00007288.00000002.137264.03AA0000.00000004.mdmp, 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"Xeno_1.3.6.0.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007288)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"Xeno_1.3.6.0.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007288)\n \"Xeno_1.3.6.0.exe\" called \"GetComputerNameExW\" with parameters (UID: 00000000-00007288)\n \"Xeno_1.3.6.0.exe\" called \"GetAdaptersAddresses\" with parameters (UID: 00000000-00007288)\n \"Xeno_1.3.6.0.exe\" called \"Process32FirstW\" with parameters (UID: 00000000-00007288)\n \"Xeno_1.3.6.0.exe\" called \"Process32NextW\" with parameters (UID: 00000000-00007288)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"Xeno_1.3.6.0.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007288)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"Xeno_1.3.6.0.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007288)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"Xeno_1.3.6.0.exe\" called \"GetWindowTextW\" (UID: 00000000-00007288)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Xeno_1.3.6.0.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007288)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Xeno_1.3.6.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Xeno_1.3.6.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Xeno_1.3.6.0.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"Xeno_1.3.6.0.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\" (SID: 2027695, Rev: 5, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2d","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"sa1atik.cn\"\n \"tonapi.io\"\n \"ton.access.orbs.network\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"176.12.71.122:443\"\n \"172.67.216.230:443\"\n \"152.53.49.102:443\"\n \"1.1.1.1:443\"\n \"104.20.29.41:443\"\n \"167.82.50.132:443\"\n \"104.16.248.249:443\"\n \"168.222.202.171:443\"\n \"172.66.170.210:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select Name from Win32_VideoController\" (Source: 00000000-00007288.00000000.133422.03AA0000.00000004.mdmp, Indicator: \"select name from win32_videocontroller\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: Xeno_1.3.6.0.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"GetProcAddress\"; File: \"Xeno_1.3.6.0.exe\")\n Found reference to API (Indicator: \"VirtualProtect\"; File: \"Xeno_1.3.6.0.exe\")\n Found reference to API (Indicator: \"ExitProcess\"; File: \"Xeno_1.3.6.0.exe\")\n Found reference to API (Indicator: \"LoadLibraryA\"; File: \"Xeno_1.3.6.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process Xeno_1.3.6.0.exe created mutex with name \"\\BaseNamedObjects\\WEBR_7NYT58K6CLNU\"\n Process Xeno_1.3.6.0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:7288:168:WilStaging_02\"\n Process Xeno_1.3.6.0.exe created mutex with name \"SM0:7288:168:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"Xeno_1.3.6.0.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$2f","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$30","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Xeno_1.3.6.0.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75300000\n \"Xeno_1.3.6.0.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72D20000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Xeno_1.3.6.0.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76DE0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"Xeno_1.3.6.0.exe\" called \"WbemScripting.SWbemLocator.1.CreateObject\" ... ","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Xeno_1.3.6.0.exe\" was detected as \"UPX\" and name: \"Packer\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$32","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Xeno_1.3.6.0.exe\" has an executable section named \"UPX0\"\n \"Xeno_1.3.6.0.exe\" has an executable section named \"UPX1\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"Xeno_1.3.6.0.exe\" has an writable section named \"UPX0\"\n \"Xeno_1.3.6.0.exe\" has an writable section named \"UPX1\"\n \"Xeno_1.3.6.0.exe\" has an writable section named \"UPX2\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"Xeno_1.3.6.0.exe\" file has an entrypoint instructions - \"pushal\t,mov\tesi, 0xce6015,lea\tedi, [esi - 0x8e5015],push\tedi,mov\tebp, esp,lea\tebx, [esp - 0x3e80],xor\teax, eax,push\teax,cmp\tesp, ebx,jne\t0x10520a8,inc\tesi,inc\tesi,push\tebx,push\t0xc50388,push\tedi,add\tebx, 4,push\tebx,push\t0x36c075,push\tesi,add\tebx, 4,push\tebx,push\teax,mov\tdword ptr [ebx], 0x20003,push\tebp,push\tedi,mov\tedi, 0,push\tesi,push\tebx,sub\tesp, 0x64,mov\tedx, dword ptr [esp + 0x78],mov\tdword ptr [esp + 0x5c], 0,lea\teax, [edx + 4],mov\tdword ptr [esp + 0x60], eax,mov\teax, 1,movzx\tecx, byte ptr [edx + 2],\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"UPX1\" is \"0x36ce00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"UPX0\" is \"0x8e5000\" greater than 0x100000\n Virtual size of \"UPX1\" is \"0x36d000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"cloudflare-dns.com\"\n \"sa1atik.cn\"\n \"ton.access.orbs.network\"\n \"tonapi.io\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"Xeno_1.3.6.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"Xeno_1.3.6.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"Xeno_1.3.6.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"Xeno_1.3.6.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Xeno_1.3.6.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$33","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a web server","description":"\"GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1\nHost: tonapi.io\nUser-Agent: Go-http-client/1.1\nContent-Type: application/octet-stream\nAccept-Encoding: gzip\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Xeno_1.3.6.0.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"Xeno_1.3.6.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"Xeno_1.3.6.0.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Xeno_1.3.6.0.exe\" queries basic process information of the \"C:\\Xeno_1.3.6.0.exe\" (UID: 7288)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Xeno_1.3.6.0.exe\" reads file \"c:\\windows\\syswow64\\wbem\\wbemdisp.tlb\"\n \"Xeno_1.3.6.0.exe\" reads file \"c:\\windows\\syswow64\\stdole2.tlb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"Xeno_1.3.6.0.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"Xeno_1.3.6.0.exe\" trying to touch file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"Xeno_1.3.6.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"Xeno_1.3.6.0.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\apphelp.dll\"\n \"Xeno_1.3.6.0.exe\" trying to touch file \"C:\\Xeno_1.3.6.0.exe\"\n \"Xeno_1.3.6.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"Xeno_1.3.6.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"Xeno_1.3.6.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"Xeno_1.3.6.0.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"Xeno_1.3.6.0.exe\" trying to access non-existent file \"C:\\9CD0B5D5-43DE-AFE2-DF73-7E084977D543\"\n \"Xeno_1.3.6.0.exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}\"\n \"Xeno_1.3.6.0.exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}\"\n \"Xeno_1.3.6.0.exe\" trying to access non-existent file \"\\Device\\RasAcd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00007288-00000C2C-1085692536\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00007288-00000C2C-1085830023\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /sa1at/\"\n Found http requests in header \"GET /v2/dns/remoteadministratortool.ton/resolve\"\n Found http requests in header \"POST /route/1/mainnet/toncenter-api-v2/runGetMethod\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00007288-00000C2C-1085569172\")\n Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; Source: \"00000000-00007288-00000C2C-1086396048\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; Source: \"00000000-00007288-00000C2C-1086423646\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00007288-00000C2C-1129211864\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00007288-00000C2C-1129212048\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00007288-00000C2C-1085569172\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"\n \"92.168.0.1\"\n \"2.5.29.10\"\n \"2.5.29.15\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.19\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.14\"\n \"2.5.29.31\"\n \"2.5.29.17\"\n \"2.5.29.32\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$37","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /sa1at/ HTTP/1.1\nHost: sa1atik.cn\nUser-Agent: Go-http-client/1.1\nContent-Length: 354\nContent-Type: application/octet-stream\nAccept-Encoding: gzip\n\n GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1\nHost: tonapi.io\nUser-Agent: Go-http-client/1.1\nContent-Type: application/octet-stream\nAccept-Encoding: gzip\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"cloudflare-dns.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c\n Observed JA3 fingerprint: 8e6e5e26c545781f412f07aaaef7d20a","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"sa1atik.cn\" (7 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://sa1atik.cn/sa1at/\n Found HTTPS GET request to https://tonapi.io/v2/dns/remoteadministratortool.ton/resolve\n Found HTTPS POST request to https://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/runGetMethod","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"sa1atik.cn\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"176.12.71.122\" on port \"443\"\n HTTPS traffic to \"172.67.216.230\" on port \"443\"\n HTTPS traffic to \"152.53.49.102\" on port \"443\"\n HTTPS traffic to \"1.1.1.1\" on port \"443\"\n HTTPS traffic to \"104.20.29.41\" on port \"443\"\n HTTPS traffic to \"167.82.50.132\" on port \"443\"\n HTTPS traffic to \"104.16.248.249\" on port \"443\"\n HTTPS traffic to \"168.222.202.171\" on port \"443\"\n HTTPS traffic to \"172.66.170.210\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"B+ncalrpc:[OLE07B249C7C98D97F642894D783379]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007288.00000000.133422.03AA0000.00000004.mdmp, 00000000-00007288.00000001.135344.03AA0000.00000004.mdmp, 00000000-00007288.00000002.137264.03AA0000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007288.00000000.133422.03AA0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE89D889EF818E72BA7271C7B37CC3]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007288.00000000.133422.03AA0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE07B249C7C98D97F642894D783379]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007288.00000000.133422.03AA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Xeno_1.3.6.0.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Xeno_1.3.6.0.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"Xeno_1.3.6.0.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"Xeno_1.3.6.0.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"3\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"8461686,1032,3185,,GetAdaptersAddresses,Iphlpapi.dll,\"00:35:40.875\",RX=0,PX=0\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00007288.00000002.137264.03AA0000.00000004.mdmp\")\n Found reference to API \"7440230,5056,3185,,GetAdaptersAddresses,Iphlpapi.dll,\"00:37:08.500\",RX=0,PX=0\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00007288.00000003.142768.03AA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"Xeno_1.3.6.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"Select Name from Win32_VideoController\" (Indicator: \" Win32_VideoController\"; Source: \"00000000-00007288.00000000.133422.03AA0000.00000004.mdmp\")\n Found string \"om Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00007288.00000002.137264.03AA0000.00000004.mdmp, 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007288.00000000.133422.03AA0000.00000004.mdmp, 00000000-00007288.00000001.135344.03AA0000.00000004.mdmp, 00000000-00007288.00000002.137264.03AA0000.00000004.mdmp, 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"Xeno_1.3.6.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Xeno_1.3.6.0.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Xeno_1.3.6.0.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$39","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"Xeno_1.3.6.0.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2FD\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00007288.00000002.137264.03AA0000.00000004.mdmp, 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Xeno_1.3.6.0.exe\" was detected as \"UPX -> www.upx.sourceforge.net\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Xeno_1.3.6.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \"UPX0\" unusually large (9326592 bytes)\n possible junk padding","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"PE file has no resource directory","description":"\"Xeno_1.3.6.0.exe\" has no resource directory","origin":"Static Parser","mitre_attack_id":"T1027.008","relevance":7,"id":"static-9002","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"Xeno_1.3.6.0.exe\" has a section named \"UPX0\"\n \"Xeno_1.3.6.0.exe\" has a section named \"UPX1\"\n \"Xeno_1.3.6.0.exe\" has a section named \"UPX2\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"Xeno_1.3.6.0.exe\" has section name UPX1 with entropy \"7.999937705284986\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to import asymmetric cryptographic keys into a CSP","description":"\"Xeno_1.3.6.0.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"3ad9700\"\n \"pszBlobType\": \"RSAPUBLICBLOB\"\n \"phKey\": \"b8b6af03c81bb203\"\n \"pbInput\": \"RSA1\"\n \"cbInput\": \"291\"\n \"dwFlags\": \"0\"}\n \"Xeno_1.3.6.0.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"3ad9650\"\n \"pszBlobType\": \"RSAPUBLICBLOB\"\n \"phKey\": \"b8b6af0380e5ac48\"\n \"pbInput\": \"RSA1\"\n \"cbInput\": \"283\"\n \"dwFlags\": \"0\"}\n \"Xeno_1.3.6.0.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"3ad9650\"\n \"pszBlobType\": \"RSAPUBLICBLOB\"\n \"phKey\": \"18b8af0310eaac48\"\n \"pbInput\": \"RSA1\"\n \"cbInput\": \"283\"\n \"dwFlags\": \"0\"}","origin":"API Call","mitre_attack_id":"T1573.002","relevance":1,"id":"api-234","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve the system language code","description":"\"Xeno_1.3.6.0.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}","origin":"API Call","mitre_attack_id":"T1614.001","relevance":10,"id":"api-307","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"Select Name from Win32_VideoController\" (Indicator: \" win32_videocontroller\"; Source: \"00000000-00007288.00000000.133422.03AA0000.00000004.mdmp\")\n \"om Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; Source: \"00000000-00007288.00000002.137264.03AA0000.00000004.mdmp, 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Xeno_1.3.6.0.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"12/26 Antivirus vendors marked sample as malicious (46% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$3a","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 176.12.71.122\"\n \"UDP connection to 172.67.216.230\"\n \"UDP connection to 152.53.49.102\"\n \"UDP connection to 1.1.1.1\"\n \"UDP connection to 104.20.29.41\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"UDP traffic to 176.12.71.122 on port 443\n UDP traffic to 172.67.216.230 on port 443\n UDP traffic to 152.53.49.102 on port 443\n UDP traffic to 1.1.1.1 on port 443\n UDP traffic to 104.20.29.41 on port 443\n TCP traffic to 167.82.50.132 on port 443 is sent without HTTP header\n TCP traffic to 104.16.248.249 on port 443 is sent without HTTP header\n TCP traffic to 168.222.202.171 on port 443 is sent without HTTP header\n TCP traffic to 172.66.170.210 on port 443 is sent without HTTP header\n TCP traffic to 152.53.49.102 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"\\\\.\\root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00007288.00000000.133422.03AA0000.00000004.mdmp\")\n Found string \"\\.\\root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00007288.00000002.137264.03AA0000.00000004.mdmp, 00000000-00007288.00000003.142768.03AA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$3b","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"Xeno_1.3.6.0.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"Xeno_1.3.6.0.exe\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetProcAddress\n VirtualProtect\n LoadLibraryA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"Xeno_1.3.6.0.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"12/26 Antivirus vendors marked sample as malicious (46% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"sa1atik.cn\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"Hooks API calls"},{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"PE file has a section name known to be used by a packer/protector"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]}],"intel_graph":{"map":{"Domain:cloudflare-dns.com":{"type":"Domain","value":"cloudflare-dns.com"},"Domain:sa1atik.cn":{"type":"Domain","value":"sa1atik.cn"},"Domain:ton.access.orbs.network":{"type":"Domain","value":"ton.access.orbs.network"},"Domain:tonapi.io":{"type":"Domain","value":"tonapi.io"},"File:4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6":{"type":"File","value":"4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6"},"Ip:1.1.1.1":{"type":"Ip","value":"1.1.1.1"},"Ip:104.16.248.249":{"type":"Ip","value":"104.16.248.249"},"Ip:104.20.29.41":{"type":"Ip","value":"104.20.29.41"},"Ip:152.53.49.102":{"type":"Ip","value":"152.53.49.102"},"Ip:167.82.50.132":{"type":"Ip","value":"167.82.50.132"},"Ip:168.222.202.171":{"type":"Ip","value":"168.222.202.171"},"Ip:172.66.170.210":{"type":"Ip","value":"172.66.170.210"},"Ip:172.67.216.230":{"type":"Ip","value":"172.67.216.230"},"Ip:176.12.71.122":{"type":"Ip","value":"176.12.71.122"},"Url:/route/1/mainnet/toncenter-api-v2/runGetMethod":{"type":"Url","value":"/route/1/mainnet/toncenter-api-v2/runGetMethod"},"Url:/sa1at/":{"type":"Url","value":"/sa1at/"},"Url:/v2/dns/remoteadministratortool.ton/resolve":{"type":"Url","value":"/v2/dns/remoteadministratortool.ton/resolve"}},"chains":[{"id":"sandbox_network","root":"File:4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6","edges":[{"edge_kind":"contacted_ip","from_key":"File:4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6","to_key":"Ip:176.12.71.122"},{"edge_kind":"contacted_ip","from_key":"File:4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6","to_key":"Ip:172.67.216.230"},{"edge_kind":"contacted_ip","from_key":"File:4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6","to_key":"Ip:152.53.49.102"},{"edge_kind":"contacted_ip","from_key":"File:4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6","to_key":"Ip:1.1.1.1"},{"edge_kind":"contacted_ip","from_key":"File:4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6","to_key":"Ip:104.20.29.41"},{"edge_kind":"contacted_ip","from_key":"File:4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6","to_key":"Ip:167.82.50.132"},{"edge_kind":"contacted_ip","from_key":"File:4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6","to_key":"Ip:104.16.248.249"},{"edge_kind":"contacted_ip","from_key":"File:4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6","to_key":"Ip:168.222.202.171"},{"edge_kind":"contacted_ip","from_key":"File:4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6","to_key":"Ip:172.66.170.210"},{"edge_kind":"contacted_domain","from_key":"File:4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6","to_key":"Domain:cloudflare-dns.com"},{"edge_kind":"resolves_to","from_key":"Domain:cloudflare-dns.com","to_key":"Ip:104.16.248.249"},{"edge_kind":"contacted_domain","from_key":"File:4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6","to_key":"Domain:sa1atik.cn"},{"edge_kind":"resolves_to","from_key":"Domain:sa1atik.cn","to_key":"Ip:152.53.49.102"},{"edge_kind":"contacted_domain","from_key":"File:4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6","to_key":"Domain:ton.access.orbs.network"},{"edge_kind":"resolves_to","from_key":"Domain:ton.access.orbs.network","to_key":"Ip:167.82.50.132"},{"edge_kind":"contacted_domain","from_key":"File:4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6","to_key":"Domain:tonapi.io"},{"edge_kind":"resolves_to","from_key":"Domain:tonapi.io","to_key":"Ip:104.20.29.41"},{"edge_kind":"contacted_url","from_key":"File:4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6","to_key":"Url:/sa1at/"},{"edge_kind":"contacted_url","from_key":"File:4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6","to_key":"Url:/v2/dns/remoteadministratortool.ton/resolve"},{"edge_kind":"contacted_url","from_key":"File:4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6","to_key":"Url:/route/1/mainnet/toncenter-api-v2/runGetMethod"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":3,"imported_dlls_count":61,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":4,"files_deleted_count":0,"registry_keys_created_count":46,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":46,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":9,"dns_resolutions_count":4,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":["salatstealer","wacatac","criminal","informationstealer","rat","evasive","suspicious","malicious"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6ab1e80f2b1a49c6bb00abf3","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Dump:Generic.Dacic.18086","contacted_countries":["AUT","RUS","USA"],"submit_name":"Xeno_1.3.6.0.exe","analysis_start_time":"2026-09-22T02:29:36+00:00","indicators_count":{"informative":104,"suspicious":33,"malicious":3},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"176.12.71.122","port":443,"protocol":"UDP","country":"Russia","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"address":"172.67.216.230","port":443,"protocol":"UDP","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"address":"152.53.49.102","port":443,"protocol":"UDP","country":"Austria","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"address":"1.1.1.1","port":443,"protocol":"UDP","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"address":"104.20.29.41","port":443,"protocol":"UDP","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"address":"167.82.50.132","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"address":"104.16.248.249","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"address":"168.222.202.171","port":443,"protocol":"TCP","country":"Russia","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"address":"172.66.170.210","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]}],"dns_resolutions":[{"domain":"cloudflare-dns.com","address":"104.16.248.249","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"domain":"sa1atik.cn","address":"152.53.49.102","ttl":300,"country":"Austria","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"domain":"ton.access.orbs.network","address":"167.82.50.132","ttl":293,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"domain":"tonapi.io","address":"104.20.29.41","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]}],"http_requests":[{"host":"sa1atik.cn","host_ip":"152.53.49.102:443","url":"/sa1at/","method":"GET","response_code":"500","response_phrase":"Internal Server Error","header":"GET /sa1at/ HTTP/1.1\nHost: sa1atik.cn\nUser-Agent: Go-http-client/1.1\nContent-Length: 354\nContent-Type: application/octet-stream\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"host":"tonapi.io","host_ip":"172.66.170.210:443","url":"/v2/dns/remoteadministratortool.ton/resolve","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1\nHost: tonapi.io\nUser-Agent: Go-http-client/1.1\nContent-Type: application/octet-stream\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"host":"ton.access.orbs.network","host_ip":"167.82.50.132:443","url":"/route/1/mainnet/toncenter-api-v2/runGetMethod","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2\nHost: ton.access.orbs.network\nUser-Agent: Go-http-client/2.0\nContent-Type: application/json\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}],"processes":[{"pid":7288,"ppid":0,"name":"Xeno_1.3.6.0.exe","command_line":"","sha256":"4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6","normalized_path":"C:\\Xeno_1.3.6.0.exe","uid":"00000000-00007288","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["fltLib.dll","msvcrt.dll","powrprof.dll","wmiutils.dll","kernel.appcore.dll","wbemdisp.dll","ntdll.dll","wow64win.dll","kernel32.dll","VxSSL32.dll","combase.dll","advapi32.dll","win32u.dll","msvcp_win.dll","cryptsp.dll","rasadhlp.dll","bcrypt.dll","user32.dll","sxs.dll","fastprox.dll","wow64.dll","bcryptprimitives.dll","nsi.dll","dhcpcsvc.dll","uxtheme.dll","crypt32.dll","msasn1.dll","ws2_32.dll","winmm.dll","secur32.dll","shlwapi.dll","rpcrt4.dll","sspicli.dll","wow64cpu.dll","vcruntime140.dll","IPHLPAPI.DLL","apphelp.dll","ucrtbase.dll","imm32.dll","ole32.dll","mswsock.dll","userenv.dll","profapi.dll","sechost.dll","gdi32full.dll","winmmbase.dll","dhcpcsvc6.dll","dnsapi.dll","rsaenh.dll","gpapi.dll","cryptbase.dll","gdi32.dll","oleaut32.dll","clbcatq.dll","msvcp140.dll","cfgmgr32.dll","wbemprox.dll","wbemsvc.dll","wbemcomn.dll","KernelBase.dll","FWPUCLNT.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\WEBR_7NYT58K6CLNU","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7288:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]},{"name":"SM0:7288:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab1e80f2b1a49c6bb00abf3"}]}]}},"report_ids":{"sandbox_job_ids":["6ab1e80f2b1a49c6bb00abf3"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Dump:Generic.Dacic.18086 Sample 4da4b163522c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4da4b163522c…. Malware family: Dump:Generic.Dacic.18086. Threat score 100/100. 13/27 AV engines flagged this file. 5 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6"}],["$","meta","4",{"property":"og:title","content":"Malicious Dump:Generic.Dacic.18086 Sample 4da4b163522c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4da4b163522c…. Malware family: Dump:Generic.Dacic.18086. Threat score 100/100. 13/27 AV engines flagged this file. 5 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4da4b163522c56e24a538d4b2e44efef40d77add58386142e0d4b25cc1731fd6"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Dump:Generic.Dacic.18086 Sample 4da4b163522c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4da4b163522c…. Malware family: Dump:Generic.Dacic.18086. Threat score 100/100. 13/27 AV engines flagged this file. 5 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3d","11",{}]]