26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 44:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious lazy.Generic Sample 5996e210f83d… — Score 92/100 — Hybrid Analysis","description":"Malicious verdict for sample 5996e210f83d…. Malware family: lazy.Generic. Threat score 92/100. 10/27 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5996e210f83d265a0c745ff669c388a834aedd25426ecee6ddc59111d06eefb0","keywords":["Malicious","lazy.Generic","malware analysis","sandbox report","threat intelligence","5996e210f83d265a0c745ff669c388a834aedd25426ecee6ddc59111d06eefb0"],"about":{"@type":"SoftwareApplication","name":"e-dekont_html.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"5996e210f83d265a0c745ff669c388a834aedd25426ecee6ddc59111d06eefb0","additionalType":"Malicious sample"},"threatScore":92,"malwareFamily":"lazy.Generic","antivirusDetections":{"malicious":10,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T19eb,Found reference to "AesaBpl" (Indicator: "Aes"; File: "5996e210f83d265a0c745ff669c388a834aedd25426ecee6ddc59111d06eefb0.bin") Found reference to "AesaBpl" (Indicator: "Aes"; Source: "00000000-00005836.00000000.131438.00E52000.00000002.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00005836.00000000.131438.057B0000.00000004.mdmp")28:T560," HTTP/1.1 200 OK Date: Wed 08 Apr 2026 08:59:27 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Wed 08 Apr 2026 08:59:27 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET /xml/64.124.12.162 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Wed 08 Apr 2026 08:59:28 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 86285 Accept-Ranges: bytes last-modified: Tue 07 Apr 2026 09:01:22 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=r4LNQwYqa46GwkrBWu78woCjt%2Fl2vu7x9x40GyXmaNJ7%2FYysDZyuh%2FuUUp%2B5aHZd4HKU1Kcba5Mdgj3TxufbfiFtvRRrcWWVX%2Ft56JpviPy1JO3rzYOpkWL0fTpw04MafHRRkbDz"}]} CF-RAY: 9e90137f1d79a666-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Wed 08 Apr 2026 08:59:28 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Wed 08 Apr 2026 08:59:28 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 86285 Accept-Ranges: bytes last-modified: Tue 07 Apr 2026 09:01:22 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=2DmDiNf%2B8jmbf4kYHU%2Fwm65gvngLw0wjjnbEj5FuFfBZLbMFT0YkLVSwwY77YJpqVRchrRapAMNzycx3XFMJvll4KwTQQKBHkRHH7Rd4ACOKsjf8GzlGDow6JRb%2Fcmy8N7ob3M30"}]} CF-RAY: 9e9013807e4aa666-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Wed 08 Apr 2026 08:59:28 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 86286 Accept-Ranges: bytes last-modified: Tue 07 Apr 2026 09:01:22 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Fp0iBrE3EwuxuXfdAosJtbDHKCwvBJH7l8L0V1Nm9vP3RSyq6LB1nVhC78bmXQYSNo87jyCgkIVJoBUI7QzuEIOBChjYArvICwWhJAg2asnxwQsQfhBc4L9WwtFp5j4QDWYzaKCd"}]} CF-RAY: 9e901381df32a666-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Wed 08 Apr 2026 08:59:29 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Wed 08 Apr 2026 08:59:29 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 86286 Accept-Ranges: bytes last-modified: Tue 07 Apr 2026 09:01:22 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=LtIwb1YZWpahtTFtDK5T%2B%2BPUUHBGL2UwgOvKqQyz%2BvIpwUPGQfSw8O03nFCaR3fPLZtO1e2JBMJeRFg%2FheC71n5SjjFzxjwYD15qSNPN65amiXOZFAHpUIKm%2FKO7Yoe9V2PDMZRO"}]} CF-RAY: 9e9013831ffaa666-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Wed 08 Apr 2026 08:59:29 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 86286 Accept-Ranges: bytes last-modified: Tue 07 Apr 2026 09:01:22 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=xQWNgJW9hsuGJ8NeecvUXU1B0nA4FgcSQhdV771btdAVtcgi6uZHy2nOtpNPG3UbGQeHGH03cf1giIBNApHf7hSJjuH3odSSCfBYZZR23%2BrLn%2F4ClGSGZCOFrsa0bjTDLVTLo%2BMY"}]} CF-RAY: 9e901384990aa666-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Wed 08 Apr 2026 08:59:29 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 86286 Accept-Ranges: bytes last-modified: Tue 07 Apr 2026 09:01:22 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=OQFGYlSYubjZ8UIAGPxrce5OmFoBpF3w1iNcyqJJEa0fchp48UdsxZleAVgdwCTF7SuzHdEH%2BxmbpjgCxvnivKq68m2i2h5m%2FKSWJ2EHLH7gwMTkl%2FEYgGfTiAcbGkTpYk3ZiJZk"}]} CF-RAY: 9e901385f9bca666-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Wed 08 Apr 2026 08:59:29 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 86287 Accept-Ranges: bytes last-modified: Tue 07 Apr 2026 09:01:22 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=mXEtG4z9PLMncOVTGxVNZY3PVRP3ZEMfm6eCWbVvDzOwNlWww6RiLHCmAerwojeZw7m%2BqhjaDUHsrEthoxcCTr5gVVUuQ545wjYZ%2BjmYrEzT363fW940vX2poM6%2Bhgxo%2BMOBDG5j"}]} CF-RAY: 9e9013875a75a666-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Wed 08 Apr 2026 08:59:30 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 86287 Accept-Ranges: bytes last-modified: Tue 07 Apr 2026 09:01:22 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=k9H1NdSSlRS4VctIu6E6L0sc8Nr3zD6uvRJ8F%2FoKcKPdxc5f8n9L%2BgPI3AmB1ZbplxvU7keVoBe0WhT0RUUmjEi1tOagCWa6I78sNPQt%2BBN0iXx3UjeGuIlG8O%2Ffc%2FrEvB5POV%2B0"}]} CF-RAY: 9e9013889b82a666-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Wed 08 Apr 2026 08:59:30 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Wed 08 Apr 2026 08:59:30 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 86287 Accept-Ranges: bytes last-modified: Tue 07 Apr 2026 09:01:22 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=RkiwoeO%2FbpzAtkr8paAn4b68%2F5ur8ZDLpG4S0mg1ib%2FGeYOj7GYfuAEFdBkEbHPOvbLFo4l8ynf51yum9XWuJK8xjvHR5dgC8qdYgEE7fhOnK1MdtehJOXQY6mTO8beeiyGkThTV"}]} CF-RAY: 9e901389fc4ba666-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465.......36:T13d1,"" - Source: "00000000-00005836.00000002.133901.708F1000.00000020.mdmp")40:T8f3,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005836.00000000.131438.03600000.00000004.mdmp, 00000000-00005836.00000001.133359.03600000.00000004.mdmp, 00000000-00005836.00000002.133901.03600000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005836.00000000.131438.03600000.00000004.mdmp, 00000000-00005836.00000001.133359.03600000.00000004.mdmp, 00000000-00005836.00000002.133901.03600000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005836.00000000.131438.03600000.00000004.mdmp, 00000000-00005836.00000001.133359.03600000.00000004.mdmp, 00000000-00005836.00000002.133901.03600000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005836.00000000.131438.03600000.00000004.mdmp, 00000000-00005836.00000001.133359.03600000.00000004.mdmp, 00000000-00005836.00000002.133901.03600000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005836.00000000.131438.03600000.00000004.mdmp, 00000000-00005836.00000001.133359.03600000.00000004.mdmp, 00000000-00005836.00000002.133901.03600000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005836.00000000.131438.03600000.00000004.mdmp, 00000000-00005836.00000001.133359.03600000.00000004.mdmp, 00000000-00005836.00000002.133901.03600000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005836.00000000.131438.03600000.00000004.mdmp, 00000000-00005836.00000001.133359.03600000.00000004.mdmp, 00000000-00005836.00000002.133901.03600000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005836.00000000.131438.03600000.00000004.mdmp, 00000000-00005836.00000001.133359.03600000.00000004.mdmp, 00000000-00005836.00000002.133901.03600000.00000004.mdmp")41:T9e4,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005836.00000000.131438.03600000.00000004.mdmp, 00000000-00005836.00000001.133359.03600000.00000004.mdmp, 00000000-00005836.00000002.133901.03600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$27","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00005836.00000000.131438.03600000.00000004.mdmp\n 00000000-00005836.00000001.133359.03600000.00000004.mdmp\n 00000000-00005836.00000002.133901.03600000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethods\" in \"5996e210f83d265a0c745ff669c388a834aedd25426ecee6ddc59111d06eefb0.bin\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"5996e210f83d265a0c745ff669c388a834aedd25426ecee6ddc59111d06eefb0.bin has big resource with name: \"Jegborafid.7125601\" size: \"329224\" and abnormal entropy:\"7.138520819467278\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005836.00000000.131438.067B0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005836.00000001.133359.08090000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005836.00000001.133359.0A540000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$28","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005836.00000000.131438.057B0000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005836.00000000.131438.057B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00005836.00000000.131438.067B0000.00000004.mdmp, 00000000-00005836.00000001.133359.08090000.00000004.mdmp, 00000000-00005836.00000001.133359.0A540000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$29","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00005836.00000000.131438.70811000.00000020.mdmp, 00000000-00005836.00000002.133901.708A1000.00000002.mdmp\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00005836.00000000.131438.70811000.00000020.mdmp, 00000000-00005836.00000002.133901.708A1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00005836.00000000.131438.067B0000.00000004.mdmp, 00000000-00005836.00000001.133359.08090000.00000004.mdmp, 00000000-00005836.00000001.133359.0A540000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005836.00000000.131438.057B0000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005836.00000000.131438.057B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00005836.00000000.131438.067B0000.00000004.mdmp, 00000000-00005836.00000001.133359.08090000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00005836.00000000.131438.057B0000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00005836.00000000.131438.057B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2a","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2b","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005836-00000C2C-995939135\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005836-00000C2C-997171400\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"get_MachineName\" (Source: \"00000000-00005836.00000000.131438.00E52000.00000002.mdmp\")\n Found string \"get_UserName\" (Source: \"00000000-00005836.00000000.131438.00E52000.00000002.mdmp\")\n Found string \"get_Is64BitOperatingSystem\" (Source: \"00000000-00005836.00000000.131438.00E52000.00000002.mdmp\")\n Found string \"get_OSVersion\" (Source: \"00000000-00005836.00000000.131438.00E52000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00005836.00000000.131438.067B0000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00005836.00000000.131438.067B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005836-00000C2C-995939135\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005836-00000C2C-997171400\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00005836-00000C2C-996932019\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005836-00000C2C-994303088\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005836-00000C2C-994303538\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00005836.00000000.131438.70905000.00000002.mdmp, 00000000-00005836.00000002.133901.708A1000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00005836-00000C2C-1036233661\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00005836-00000C2C-1036233690\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00005836.00000000.131438.03600000.00000004.mdmp, 00000000-00005836.00000001.133359.03600000.00000004.mdmp, 00000000-00005836.00000002.133901.03600000.00000004.mdmp\")\n Found reference to API \"sendMessageChannelCache\" (Indicator: \"sendmessage\"; Source: \"00000000-00005836.00000000.131438.057B0000.00000004.mdmp\")\n Found reference to API \"System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" (Indicator: \"sendmessage\"; Source: \"00000000-00005836.00000000.131438.057B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"5;;7;6B7=\\23.24.36.34\"\n \"127.0.0.1\"\n Potential IP \"127.0.0.1\" found in string \"/c ping 127.0.0.1 -n\"\n \"2.4.5.1\"\n \"2.8.6.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3f","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET / HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)\nHost: checkip.dyndns.org\nConnection: Keep-Alive\n\n GET / HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)\nHost: checkip.dyndns.org\n\n GET /xml/64.124.12.162 HTTP/1.1\nHost: reallyfreegeoip.org\nConnection: Keep-Alive\n\n GET /xml/64.124.12.162 HTTP/1.1\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"checkip.dyndns.org\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://maps.google.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://reallyfreegeoip.org/xml/64.124.12.162","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"reallyfreegeoip.org\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"172.67.177.134\" on port \"443\"\n HTTPS traffic to \"149.154.166.110\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00005836\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Remote Access Related","name":"Able to modify Remote Configuration","description":"Found string \"System.Runtime.Remoting\" (Source: \"00000000-00005836.00000000.131438.067B0000.00000004.mdmp, 00000000-00005836.00000001.133359.08090000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncalrpc\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005836.00000000.131438.70811000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00005836.00000000.131438.70905000.00000002.mdmp, 00000000-00005836.00000002.133901.708A1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00005836.00000000.131438.057B0000.00000004.mdmp\")\n Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00005836.00000000.131438.057B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"get_ProcessName\" (Source: \"00000000-00005836.00000000.131438.067B0000.00000004.mdmp, 00000000-00005836.00000001.133359.08090000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"\" (Indicator: \"password\"; Source: \"00000000-00005836.00000000.131438.057B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Navigate Route\" (Indicator: \"route\"; File: \"5996e210f83d265a0c745ff669c388a834aedd25426ecee6ddc59111d06eefb0.bin\")\n Found string \"avigate Route\" (Indicator: \"route\"; Source: \"00000000-00005836.00000000.131438.00E52000.00000002.mdmp\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00005836.00000000.131438.057B0000.00000004.mdmp\")\n Found string \"/c ping 127.0.0.1 -n\" (Indicator: \"ping\"; Source: \"00000000-00005836.00000000.131438.057B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69d618938e7599a73d0f3277"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"