26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 57:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4b9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Virus.Sality Sample 5b6430e115eb… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5b6430e115eb…. Malware family: Virus.Sality. Threat score 100/100. 19/27 AV engines flagged this file. 15 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5b6430e115eb28e10d4e38f3cf311fd9fd39b358ab0dcd6d7ff49bf9d01dab3a","keywords":["Malicious","Virus.Sality","malware analysis","sandbox report","threat intelligence","5b6430e115eb28e10d4e38f3cf311fd9fd39b358ab0dcd6d7ff49bf9d01dab3a"],"about":{"@type":"SoftwareApplication","name":"5b6430e115eb28e10d4e38f3cf311fd9fd39b358ab0dcd6d7ff49bf9d01dab3a.bin","applicationCategory":["peexe","executable"],"identifier":"5b6430e115eb28e10d4e38f3cf311fd9fd39b358ab0dcd6d7ff49bf9d01dab3a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Virus.Sality","antivirusDetections":{"malicious":19,"total":27},"behavioralIndicators":{"malicious":15,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T68a,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "5b6430e115eb28e10d4e38f3cf311fd9fd39b358ab0dcd6d7ff49bf9d01dab3a.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "5b6430e115eb28e10d4e38f3cf311fd9fd39b358ab0dcd6d7ff49bf9d01dab3a.bin") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "00000000-00005864.00000000.119501.00401000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005864.00000000.119501.00401000.00000040.mdmp, 00000000-00005864.00000000.119501.00454000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005864.00000000.119501.00401000.00000040.mdmp, 00000000-00005864.00000000.119501.00454000.00000040.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00005864.00000000.119501.00401000.00000040.mdmp") Found reference to API "tCreateThread" (Indicator: "CreateThread"; Source: "00000000-00005864.00000000.119501.00456000.00000040.mdmp, 00000000-00005864.00000000.119501.02870000.00000004.mdmp, 00000000-00005864.00000000.119501.02960000.00000004.mdmp, 00000000-00005864.00000000.119501.04AE4000.00000004.mdmp, 00000000-00005864.00000000.119501.07390000.00000040.mdmp") Found reference to API "tVirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005864.00000000.119501.00456000.00000040.mdmp, 00000000-00005864.00000000.119501.02870000.00000004.mdmp, 00000000-00005864.00000000.119501.02960000.00000004.mdmp, 00000000-00005864.00000000.119501.04AE4000.00000004.mdmp, 00000000-00005864.00000000.119501.07390000.00000040.mdmp")28:T716,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "5b6430e115eb28e10d4e38f3cf311fd9fd39b358ab0dcd6d7ff49bf9d01dab3a.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "00000000-00005864.00000000.119501.00401000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "00000000-00005864.00000000.119501.00401000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "00000000-00005864.00000000.119501.00401000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005864.00000000.119501.00401000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005864.00000000.119501.00401000.00000040.mdmp, 00000000-00005864.00000000.119501.00454000.00000040.mdmp, 00000000-00005864.00000000.119501.00456000.00000040.mdmp, 00000000-00005864.00000000.119501.02870000.00000004.mdmp, 00000000-00005864.00000000.119501.02960000.00000004.mdmp, 00000000-00005864.00000000.119501.04AE4000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005864.00000000.119501.00401000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005864.00000000.119501.00401000.00000040.mdmp") Found reference to API "wLoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005864.00000000.119501.00456000.00000040.mdmp, 00000000-00005864.00000000.119501.02870000.00000004.mdmp, 00000000-00005864.00000000.119501.02960000.00000004.mdmp, 00000000-00005864.00000000.119501.04AE4000.00000004.mdmp") Found reference to API "tLoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005864.00000000.119501.07390000.00000040.mdmp")29:T820,"" (Indicator: "enumchildwindows"; Source: "00000000-00005864.00000000.119501.02960000.00000004.mdmp")2e:Tc6f," HTTP/1.1 500 Internal Server Error Cache-Control: private Content-Type: text/html Server: Microsoft-IIS/8.5 Set-Cookie: ASPSESSIONIDCQBADRAT=JCILIHBCAEAGJPGIACJFFNGA; path=/ Date: Thu 19 Mar 2026 18:58:22 GMT Content-Length: 617 with response body ==>3C21444F43545950452068746D6C205055424C494320222D2F2F5733432F2F445444205848544D4C20312E30205472616E736974696F6E616C2F2F454E222022....... "GET /logo.gif?36544f47=-386479745 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) Host: ksandrafashion.com Cache-Control: no-cache" Response ==> HTTP/1.1 301 Moved Permanently Date: Thu 19 Mar 2026 18:58:24 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu 19 Mar 2026 19:58:24 GMT Location: https://ksandrafashion.com/logo.gif?36544f47=-386479745 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hw4OT8Qk%2B30FqRGUYQfQSwexJGzYuOEBvP38rkKGhj%2BEpMJ4FbUMRU4%2FBxMaXQfClFqGZGi3esquKwKFqtuEtHtNH25Fi%2FDhzhtXs0N%2BI3H%2FZRNu1Odh2raXNsKz%2Beh0CnRlkg%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0.01 "report_to":"cf-nel" "max_age":604800} Server-Timing: cfRequestDuration;dur=8.000135 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Download-Options: noopen Server: cloudflare CF-RAY: 9deeb55928df3ecb-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E333031204D6F766564205065726D616E656E746C793C2F7469746C653E3C2F686561643E0D0A3C626F6479....... "GET /logo.gif?36544f47=-386479745 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) Cache-Control: no-cache Host: ksandrafashion.com Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Date: Thu 19 Mar 2026 18:58:26 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 0 Connection: keep-alive CF-RAY: 9deeb5656e2f8a19-SJC etag: "page_cache:76359172339:NotFoundController:dd67edb855d49695decf3f4d31938466" set-cookie: cart_currency=MXN; path=/; expires=Thu 02 Apr 2026 18:58:26 GMT set-cookie: _shopify_y=1871b52b-b722-4764-8c78-f9799e33f656; domain=ksandrafashion.com; path=/; expires=Sat 20 Mar 2027 00:58:26 GMT; SameSite=Lax set-cookie: _shopify_s=6decc397-7ae9-4879-adaa-18cbe68fdc30; domain=ksandrafashion.com; path=/; expires=Thu 19 Mar 2026 19:28:26 GMT; SameSite=Lax set-cookie: _shopify_essential=:AZ0HdpuWAAEAMsJ7AMD-4oLL6B1nZrdLxrlRct_CWayMGtJwbXXcq_3A-s9kC_gwySNxOZGvMji6GpN_7hy1mTt74VwEdNKV6OT2JQt1fvH79zVpQPBhV10ebQIbdSpLbu3JdKU_U7vtPCoK305_Qzu7-j5-Amz5Po0KgS3bLRJFw2ZB4pCmXkgpj8Cfp37GdikqQW7wmwKPQH2HdNRGYfonEZEBSc2APV_DfzzhxGAp93lCWkm5kLg-fQWu2HldX8_YB_eHh76dFmpgy3RqnUDVqexquIMa1A3g32acNJ6gCQNX:; Max-Age=31536000; Path=/; HttpOnly; Secure; Priority=High; SameSite=Lax shopify-complexity-score: 440 x-frame-options: DENY content-security-policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests; strict-transport-security: max-age=7889238 Alt-Svc: h3=":443"; ma=86400 content-language: es-MX cache-control: private no-store powered-by: Shopify server-timing: processing;dur=24;desc="gc:1" db;dur=8 asn;desc="6461" edge;desc="SJC" country;desc="US" servedBy;desc="r47d" requestID;desc="b7aaca12-756f-44b1-b718-774e9299b854-1773946706" _y;desc="1871b52b-b722-4764-8c78-f9799e33f656" _s;desc="6decc397-7ae9-4879-adaa-18cbe68fdc30" _cmp;desc="3.AMPS_USVA_f_f_I-S8QlYCR92EeE2qk7wdQw" Server-Timing: cfRequestDuration;dur=86.999893 x-dc: gcp-us-west1 gcp-us-west1 gcp-us-west1 x-request-id: b7aaca12-756f-44b1-b718-774e9299b854-1773946706 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NSZqMSb6a%2B%2FqSXMywxPUIadmXiGMWa1NI2U7CJNHGV2oJI%2FUjEg7AB7u%2BBGYo7bqKsUn8Nyknb%2FZGXMqQrkAz0IGBx7wcJ2sTrTTTSbq0Aecfb3cBBHmgmMJPJlvG0Mw4DJqpQ%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0.01 "report_to":"cf-nel" "max_age":604800} X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Download-Options: noopen Server: cloudflare with no response body "GET /logo.gif?36af5c52=-1542581002 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) Host: kulppasur.com Cache-Control: no-cache" Response ==> HTTP/1.1 301 Moved Permanently Date: Thu 19 Mar 2026 18:58:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} server: cloudflare location: https://kulppasur.com/logo.gif?36af5c52=-1542581002 x-turbo-charged-by: LiteSpeed Cache-Control: max-age=14400 cf-cache-status: MISS Server-Timing: cfCacheStatus;desc="MISS" Server-Timing: cfEdge;dur=8 cfOrigin;dur=364 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=aFdBKfQraYButsfmkpEp8HFO8mdrsAs%2BriqJwqdNScdZ5sKgkZzhmSc2RN7XtJKS1TCXiGKsS13nKwGYqREp0chsnnjLBtHMxjssW78%3D"}]} CF-RAY: 9deeb57b49de3222-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C207374796C653D226865696768743A31303025223E0A3C686561643E0A3C6D657461206E616D653D227669....... "GET /logo.gif?36af5c52=-1542581002 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) Cache-Control: no-cache Host: kulppasur.com Connection: Keep-Alive" Response ==> HTTP/1.1 403 Forbidden Date: Thu 19 Mar 2026 18:58:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private no-cache no-store must-revalidate max-age=0 pragma: no-cache Server: cloudflare x-frame-options: SAMEORIGIN x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin permissions-policy: geolocation=() microphone=() camera=() content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: https:; img-src 'self' data: https: blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' data: https: blob:; alt-svc: h3=":443"; ma=86400 x-turbo-charged-by: LiteSpeed cf-cache-status: BYPASS Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="BYPASS" Server-Timing: cfEdge;dur=3 cfOrigin;dur=562 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=QgRzg492x6jQLXqj1MVlyAcSvEJocLZGbPk1AulVi60etfU%2FZ%2FOZtJrDGtcYqoFYET1LKl0vTTtio6VDxvVDDk7MiqUCSaU9kL5jf8U%3D"}]} CF-RAY: 9deeb59a58075e56-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C207374796C653D226865696768743A31303025223E0A3C686561643E0A3C6D657461206E616D653D227669....... "GET /index_top/logo.gif?39d920f5=144844957 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) Host: www.ecole-saint-simon.net Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 19 Mar 2026 18:58:40 GMT Content-Type: image/gif Content-Length: 0 Connection: close with no response body "GET /images/logo.gif?3a41f8a4=977402020 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) Host: lazarea.ro Cache-Control: no-cache" Response ==> HTTP/1.1 404 Not Found Connection: Keep-Alive Keep-Alive: timeout=5 max=100 Cache-Control: private no-cache no-store must-revalidate max-age=0 Pragma: no-cache Content-Type: text/html Content-Length: 1251 Date: Thu 19 Mar 2026 18:58:40 GMT Server: LiteSpeed X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C207374796C653D226865696768743A31303025223E0A3C686561643E0A3C6D657461206E616D653D227669....... "GET /images/logo.gif?3ade8c7b=-688626728 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) Host: koonadance2.com Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 19 Mar 2026 18:58:42 GMT Content-Type: image/gif Content-Length: 0 Connection: close with no response body "GET /logo.gif?5fdbb592=1608234386 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) Host: www.ledyazilim.com Cache-Control: no-cache Cookie: ASPSESSIONIDCQBADRAT=JCILIHBCAEAGJPGIACJFFNGA" Response ==> HTTP/1.1 500 Internal Server Error Cache-Control: private Content-Type: text/html Server: Microsoft-IIS/8.5 Date: Thu 19 Mar 2026 18:59:59 GMT Content-Length: 617 with response body ==>3C21444F43545950452068746D6C205055424C494320222D2F2F5733432F2F445444205848544D4C20312E30205472616E736974696F6E616C2F2F454E222022....... "GET /logo.gif?60360140=1614152000 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) Host: ksandrafashion.com Cache-Control: no-cache Cookie: cart_currency=MXN; _shopify_y=1871b52b-b722-4764-8c78-f9799e33f656" Response ==> HTTP/1.1 301 Moved Permanently Date: Thu 19 Mar 2026 19:00:00 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu 19 Mar 2026 20:00:00 GMT Location: https://ksandrafashion.com/logo.gif?60360140=1614152000 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D0CNX9W33xyFiI4JET%2BHua40ltpKkMVPXx5ncM608sHS9h%2F3VI19HDjyobE7yrAaCYOQOv8eBHflj35xF9JgEccegsUSlFn%2F6%2BPyZka0XeJO8sZA6pqJDJYYfjOg95%2B79NMVzg%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0.01 "report_to":"cf-nel" "max_age":604800} Server-Timing: cfRequestDuration;dur=8.000135 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Download-Options: noopen Server: cloudflare CF-RAY: 9deeb7ad3a31df0a-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E333031204D6F766564205065726D616E656E746C793C2F7469746C653E3C2F686561643E0D0A3C626F6479....... "GET /logo.gif?60360140=1614152000 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) Cache-Control: no-cache Host: ksandrafashion.com Connection: Keep-Alive Cookie: cart_currency=MXN; _shopify_y=1871b52b-b722-4764-8c78-f9799e33f656; _shopify_essential=:AZ0HdpuWAAEAMsJ7AMD-4oLL6B1nZrdLxrlRct_CWayMGtJwbXXcq_3A-s9kC_gwySNxOZGvMji6GpN_7hy1mTt74VwEdNKV6OT2JQt1fvH79zVpQPBhV10ebQIbdSpLbu3JdKU_U7vtPCoK305_Qzu7-j5-Amz5Po0KgS3bLRJFw2ZB4pCmXkgpj8Cfp37GdikqQW7wmwKPQH2HdNRGYfonEZEBSc2APV_DfzzhxGAp93lCWkm5kLg-fQWu2HldX8_YB_eHh76dFmpgy3RqnUDVqexquIMa1A3g32acNJ6gCQNX:" Response ==> HTTP/1.1 404 Not Found Date: Thu 19 Mar 2026 19:00:00 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 0 Connection: keep-alive CF-RAY: 9deeb7b16953e8d9-SJC etag: "page_cache:76359172339:NotFoundController:dd67edb855d49695decf3f4d31938466" set-cookie: cart_currency=MXN; path=/; expires=Thu 02 Apr 2026 19:00:00 GMT set-cookie: _shopify_y=1871b52b-b722-4764-8c78-f9799e33f656; domain=ksandrafashion.com; path=/; expires=Sat 20 Mar 2027 01:00:00 GMT; SameSite=Lax set-cookie: _shopify_s=03aafcc0-2852-45d8-a93d-1e4815e6fd87; domain=ksandrafashion.com; path=/; expires=Thu 19 Mar 2026 19:30:00 GMT; SameSite=Lax shopify-complexity-score: 360 x-frame-options: DENY content-security-policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests; strict-transport-security: max-age=7889238 Alt-Svc: h3=":443"; ma=86400 content-language: es-MX cache-control: private no-store powered-by: Shopify server-timing: processing;dur=20 db;dur=8 asn;desc="6461" edge;desc="SJC" country;desc="US" servedBy;desc="tf7s" requestID;desc="63017335-748d-40ab-a5a8-85b97ccb15a4-1773946800" _y;desc="1871b52b-b722-4764-8c78-f9799e33f656" _s;desc="03aafcc0-2852-45d8-a93d-1e4815e6fd87" _cmp;desc="3.AMPS_USVA_f_f_ZAXV0zGDQdW7AN9uKFP19g" Server-Timing: cfRequestDuration;dur=83.999872 x-dc: gcp-us-west1 gcp-us-west1 gcp-us-west1 x-request-id: 63017335-748d-40ab-a5a8-85b97ccb15a4-1773946800 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cqNnjS9RJjElGNoSLzfj8T3qV7rmrk9W9Zb%2BjqXWNjzz3f63EkHRYq0PKSJlAVlLaqe1V5PEyhuQoHwZGCc7op%2FxM1iLSoKf7WMXtk7JUWFG4MBCJNF0icqqWtonltdn9RP7nA%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0.01 "report_to":"cf-nel" "max_age":604800} X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Download-Options: noopen Server: cloudflare with no response body "GET /logo.gif?60daf784=1159843096 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) Host: kulppasur.com Cache-Control: no-cache" Response ==> HTTP/1.1 301 Moved Permanently Date: Thu 19 Mar 2026 19:00:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} server: cloudflare location: https://kulppasur.com/logo.gif?60daf784=1159843096 x-turbo-charged-by: LiteSpeed Cache-Control: max-age=14400 cf-cache-status: MISS Server-Timing: cfCacheStatus;desc="MISS" Server-Timing: cfEdge;dur=21 cfOrigin;dur=374 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=IlFSHdtIsodfBdGM3QDHjtOJBQ9p97nNy6x2IdrtgfDuSPBjC0CbLVXVwMaEmYgld3eiuWxz9eU974HCvL5q7caBfG8Xv5f5EZ9PO84%3D"}]} CF-RAY: 9deeb7b4e914b828-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C207374796C653D226865696768743A31303025223E0A3C686561643E0A3C6D657461206E616D653D227669....... "GET /logo.gif?60daf784=1159843096 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) Cache-Control: no-cache Host: kulppasur.com Connection: Keep-Alive" Response ==> HTTP/1.1 403 Forbidden Date: Thu 19 Mar 2026 19:00:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private no-cache no-store must-revalidate max-age=0 pragma: no-cache Server: cloudflare x-frame-options: SAMEORIGIN x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin permissions-policy: geolocation=() microphone=() camera=() content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: https:; img-src 'self' data: https: blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' data: https: blob:; alt-svc: h3=":443"; ma=86400 x-turbo-charged-by: LiteSpeed cf-cache-status: BYPASS Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="BYPASS" Server-Timing: cfEdge;dur=5 cfOrigin;dur=569 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=gybkAmYYvYYbqs7A6lqR9Kj4K3jYiFyBWxV3gI59dipBctVB93YpftB7f85ePFWVMByqHpGntsaoq4Jy2M2JsBngT3Z3BxLkxZhi%2FBQ%3D"}]} CF-RAY: 9deeb7c38de53451-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C207374796C653D226865696768743A31303025223E0A3C686561643E0A3C6D657461206E616D653D227669....... "GET /index_top/logo.gif?62660d2a=657598334 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) Host: www.ecole-saint-simon.net Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 19 Mar 2026 19:00:04 GMT Content-Type: image/gif Content-Length: 0 Connection: close with no response body "GET /images/logo.gif?62acd37f=-983980290 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) Host: lazarea.ro Cache-Control: no-cache" Response ==> HTTP/1.1 404 Not Found Connection: Keep-Alive Keep-Alive: timeout=5 max=100 Cache-Control: private no-cache no-store must-revalidate max-age=0 Pragma: no-cache Content-Type: text/html Content-Length: 1251 Date: Thu 19 Mar 2026 19:00:04 GMT Server: LiteSpeed X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C207374796C653D226865696768743A31303025223E0A3C686561643E0A3C6D657461206E616D653D227669....... "GET /images/logo.gif?6315e13a=692167598 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) Host: koonadance2.com Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 19 Mar 2026 19:00:06 GMT Content-Type: image/gif Content-Length: 0 Connection: close with no response body "GET /logo.gif?8709c8cc=944653920 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) Host: www.ledyazilim.com Cache-Control: no-cache Cookie: ASPSESSIONIDCQBADRAT=JCILIHBCAEAGJPGIACJFFNGA" Response ==> HTTP/1.1 500 Internal Server Error Cache-Control: private Content-Type: text/html Server: Microsoft-IIS/8.5 Date: Thu 19 Mar 2026 19:01:20 GMT Content-Length: 617 with response body ==>3C21444F43545950452068746D6C205055424C494320222D2F2F5733432F2F445444205848544D4C20312E30205472616E736974696F6E616C2F2F454E222022....... "GET /logo.gif?87688e63=1242927070 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) Host: ksandrafashion.com Cache-Control: no-cache Cookie: cart_currency=MXN; _shopify_y=1871b52b-b722-4764-8c78-f9799e33f656" Response ==> HTTP/1.1 301 Moved Permanently Date: Thu 19 Mar 2026 19:01:22 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu 19 Mar 2026 20:01:22 GMT Location: https://ksandrafashion.com/logo.gif?87688e63=1242927070 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M0Lk%2BAsJ2xQw1IA8xcfp0pCXSYwuwWK9qb7GiHA%2FsZV0mO8vdzSJy4Qj4xvsKYsRH0PEqvhUWeVXjgs9oxOn7JbyOSgDzc6qFrpDJmZPo41F0Izo9cejtQu0Av%2F7KDZnPkMVUg%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0.01 "report_to":"cf-nel" "max_age":604800} Server-Timing: cfRequestDuration;dur=8.000135 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Download-Options: noopen Server: cloudflare CF-RAY: 9deeb9b159fa4900-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E333031204D6F766564205065726D616E656E746C793C2F7469746C653E3C2F686561643E0D0A3C626F6479....... "GET /logo.gif?87688e63=1242927070 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) Cache-Control: no-cache Host: ksandrafashion.com Connection: Keep-Alive Cookie: cart_currency=MXN; _shopify_y=1871b52b-b722-4764-8c78-f9799e33f656; _shopify_essential=:AZ0HdpuWAAEAMsJ7AMD-4oLL6B1nZrdLxrlRct_CWayMGtJwbXXcq_3A-s9kC_gwySNxOZGvMji6GpN_7hy1mTt74VwEdNKV6OT2JQt1fvH79zVpQPBhV10ebQIbdSpLbu3JdKU_U7vtPCoK305_Qzu7-j5-Amz5Po0KgS3bLRJFw2ZB4pCmXkgpj8Cfp37GdikqQW7wmwKPQH2HdNRGYfonEZEBSc2APV_DfzzhxGAp93lCWkm5kLg-fQWu2HldX8_YB_eHh76dFmpgy3RqnUDVqexquIMa1A3g32acNJ6gCQNX:" Response ==> HTTP/1.1 404 Not Found Date: Thu 19 Mar 2026 19:01:23 GMT Content-Type: image/gif; charset=utf-8 Content-Length: 0 Connection: keep-alive CF-RAY: 9deeb9b4487bdf82-SJC etag: "page_cache:76359172339:NotFoundController:dd67edb855d49695decf3f4d31938466" set-cookie: cart_currency=MXN; path=/; expires=Thu 02 Apr 2026 19:01:23 GMT set-cookie: _shopify_y=1871b52b-b722-4764-8c78-f9799e33f656; domain=ksandrafashion.com; path=/; expires=Sat 20 Mar 2027 01:01:23 GMT; SameSite=Lax set-cookie: _shopify_s=cd127a65-cf17-44dc-b544-2fb374b87b16; domain=ksandrafashion.com; path=/; expires=Thu 19 Mar 2026 19:31:23 GMT; SameSite=Lax shopify-complexity-score: 360 x-frame-options: DENY content-security-policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests; strict-transport-security: max-age=7889238 Alt-Svc: h3=":443"; ma=86400 content-language: es-MX cache-control: private no-store powered-by: Shopify server-timing: processing;dur=19 db;dur=6 asn;desc="6461" edge;desc="SJC" country;desc="US" servedBy;desc="c47z" requestID;desc="8fc1466a-8fff-4d37-b382-a31663918bd0-1773946883" _y;desc="1871b52b-b722-4764-8c78-f9799e33f656" _s;desc="cd127a65-cf17-44dc-b544-2fb374b87b16" _cmp;desc="3.AMPS_USVA_f_f_zUmzNxRFSfKTLHuvB20QAA" Server-Timing: cfRequestDuration;dur=86.999893 x-dc: gcp-us-west1 gcp-us-west1 gcp-us-west1 x-request-id: 8fc1466a-8fff-4d37-b382-a31663918bd0-1773946883 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YgSFR0ew0JWRURRY85UclapsWIgA9lQGZP6wjUER%2FflPxvduOGfks3q5u9PvuQVG2jX2s70Zq4urq13uv0PStIg6Utdi24mxBRfnBhCVMmnvmKscCPObln%2F7LHphQum%2FSO6moQ%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0.01 "report_to":"cf-nel" "max_age":604800} X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Download-Options: noopen Server: cloudflare with no response body "GET /logo.gif?87f5b41d=1068343528 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) Host: kulppasur.com Cache-Control: no-cache" Response ==> HTTP/1.1 301 Moved Permanently Date: Thu 19 Mar 2026 19:01:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} server: cloudflare location: https://kulppasur.com/logo.gif?87f5b41d=1068343528 x-turbo-charged-by: LiteSpeed Cache-Control: max-age=14400 cf-cache-status: MISS Server-Timing: cfCacheStatus;desc="MISS" Server-Timing: cfEdge;dur=22 cfOrigin;dur=376 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=%2BhjQODrRrLr2XCxkeZXdjx73sRyRzfnwMDYvqpP%2BOIhzYnBfJuW2WzdLGiMPWJvA%2BM%2BNv0VOJ9LSzOqP5UtxsTCaEqkNDzx4DxV3DEQ%3D"}]} CF-RAY: 9deeb9b77e216cb7-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C207374796C653D226865696768743A31303025223E0A3C686561643E0A3C6D657461206E616D653D227669....... "GET /logo.gif?87f5b41d=1068343528 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) Cache-Control: no-cache Host: kulppasur.com Connection: Keep-Alive" Response ==> HTTP/1.1 403 Forbidden Date: Thu 19 Mar 2026 19:01:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private no-cache no-store must-revalidate max-age=0 pragma: no-cache Server: cloudflare x-frame-options: SAMEORIGIN x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin permissions-policy: geolocation=() microphone=() camera=() content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: https:; img-src 'self' data: https: blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' data: https: blob:; alt-svc: h3=":443"; ma=86400 x-turbo-charged-by: LiteSpeed cf-cache-status: BYPASS Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="BYPASS" Server-Timing: cfEdge;dur=9 cfOrigin;dur=575 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=kOIogr2FbcKaP1aGx3FilpUAlc0tjYFqbR%2FuQJQ969eGklw4R5gbeLfEJoEondx1FRjNHGK6ZJ9nEqq4hlh9Lak3E1c4F1lZhMawNOs%3D"}]} CF-RAY: 9deeb9c48a14fae3-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C207374796C653D226865696768743A31303025223E0A3C686561643E0A3C6D657461206E616D653D227669....... "GET /index_top/logo.gif?8980c88c=318869784 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) Host: www.ecole-saint-simon.net Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 19 Mar 2026 19:01:27 GMT Content-Type: image/gif Content-Length: 0 Connection: close with no response body "GET /images/logo.gif?89c790f0=656294848 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) Host: lazarea.ro Cache-Control: no-cache" Response ==> HTTP/1.1 404 Not Found Connection: Keep-Alive Keep-Alive: timeout=5 max=100 Cache-Control: private no-cache no-store must-revalidate max-age=0 Pragma: no-cache Content-Type: text/html Content-Length: 1251 Date: Thu 19 Mar 2026 19:01:26 GMT Server: LiteSpeed X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C207374796C653D226865696768743A31303025223E0A3C686561643E0A3C6D657461206E616D653D227669....... "GET /images/logo.gif?8a22b2cd=-1637345177 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) Host: koonadance2.com Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 19 Mar 2026 19:01:28 GMT Content-Type: image/gif Content-Length: 0 Connection: close with no response body39:Tc8a,"" (Indicator: "GetDC"; Source: "00000000-00005864.00000000.119501.02960000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005864.00000000.119501.02960000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005864.00000000.119501.02960000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005864.00000000.119501.02960000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005864.00000000.119501.02960000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005864.00000000.119501.02960000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005864.00000000.119501.02960000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005864.00000000.119501.02960000.00000004.mdmp")4a:T835,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005864.00000000.119501.02960000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69bc472ff3716c946b095c8d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005864.00000000.119501.00400000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005864.00000000.119501.00456000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005864.00000000.119501.02870000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005864.00000000.119501.02960000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005864.00000000.119501.04AE4000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69bc472ff3716c946b095c8d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69bc472ff3716c946b095c8d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69bc472ff3716c946b095c8d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00005864.00000000.119501.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69bc472ff3716c946b095c8d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"00000000-00005864.00000000.119501.00401000.00000040.mdmp\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00005864.00000000.119501.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69bc472ff3716c946b095c8d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"69bc472ff3716c946b095c8d"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2b","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69bc472ff3716c946b095c8d"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.90778","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"69bc472ff3716c946b095c8d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69bc472ff3716c946b095c8d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Drops file with high entropy\n indicating encryption/obfuscation\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Reads the cryptographic machine GUID","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69bc472ff3716c946b095c8d"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69bc472ff3716c946b095c8d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"00000000-00005864.00000000.119501.00401000.00000040.mdmp\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00005864.00000000.119501.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69bc472ff3716c946b095c8d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; File: \"00000000-00005864.00000000.119501.00401000.00000040.mdmp\")\n Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; Source: \"00000000-00005864.00000000.119501.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69bc472ff3716c946b095c8d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69bc472ff3716c946b095c8d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"