26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 55:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ab,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious IL:Trojan.MSILZilla Sample 5d3efd95113c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5d3efd95113c…. Malware family: IL:Trojan.MSILZilla. Threat score 100/100. 7/26 AV engines flagged this file. 12 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5d3efd95113c0c2bf75aae8fc89d318123ecb178e4303b52cbf1ca7887357838","keywords":["Malicious","IL:Trojan.MSILZilla","malware analysis","sandbox report","threat intelligence","5d3efd95113c0c2bf75aae8fc89d318123ecb178e4303b52cbf1ca7887357838"],"about":{"@type":"SoftwareApplication","name":"e-dekont_html.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"5d3efd95113c0c2bf75aae8fc89d318123ecb178e4303b52cbf1ca7887357838","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"IL:Trojan.MSILZilla","antivirusDetections":{"malicious":7,"total":26},"behavioralIndicators":{"malicious":12,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1761,Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "00000000-00001788.00000001.122161.001C2000.00000002.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "00000000-00001788.00000001.122161.001C2000.00000002.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "00000000-00001788.00000001.122161.001C2000.00000002.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "00000000-00001788.00000001.122161.001C2000.00000002.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "00000000-00001788.00000001.122161.001C2000.00000002.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "00000000-00001788.00000001.122161.001C2000.00000002.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "00000000-00001788.00000001.122161.001C2000.00000002.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00000944.00000001.122758.00448000.00000002.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00000944.00000001.122758.00448000.00000002.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00000944.00000001.122758.00448000.00000002.mdmp, 00000000-00000944.00000002.124595.00810000.00000040.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00000944.00000001.122758.00448000.00000002.mdmp, 00000000-00000944.00000002.124595.00810000.00000040.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00000944.00000001.122758.00448000.00000002.mdmp, 00000000-00000944.00000002.124595.00810000.00000040.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00000944.00000001.122758.00448000.00000002.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; Source: "00000000-00000944.00000001.122758.00448000.00000002.mdmp") Found reference to "TripleDES" (Indicator: "TripleDES"; Source: "00000000-00000944.00000002.124595.00810000.00000040.mdmp") Found reference to "AesGcm" (Indicator: "Aes"; Source: "00000000-00000944.00000002.124595.00810000.00000040.mdmp") Found reference to "AesGcm" (Indicator: "AesGcm"; Source: "00000000-00000944.00000002.124595.00810000.00000040.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00000944.00000002.124595.00810000.00000040.mdmp") Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "00000000-00000944.00000002.124595.00810000.00000040.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00000944.00000002.124595.00810000.00000040.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; Source: "00000000-00000944.00000002.124595.00810000.00000040.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; Source: "00000000-00000944.00000002.124595.00810000.00000040.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; Source: "00000000-00000944.00000002.124595.00810000.00000040.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp, 00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00001788.00000000.120240.04A90000.00000004.mdmp") Found reference to "HMACSHA1" (Indicator: "HMAC"; Source: "00000000-00001788.00000000.120240.04A90000.00000004.mdmp") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; Source: "00000000-00001788.00000000.120240.04A90000.00000004.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00001788.00000000.120240.04A90000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00001788.00000000.120240.04A90000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00001788.00000000.120240.04A90000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00001788.00000000.120240.04A90000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00001788.00000000.120240.04A90000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00001788.00000000.120240.04A90000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00001788.00000000.120240.04A90000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00001788.00000000.120240.04A90000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00001788.00000000.120240.04A90000.00000004.mdmp")28:T913,"" (Indicator: "enumchildwindows"; Source: "00000000-00001788.00000000.120240.02740000.00000004.mdmp, 00000000-00001788.00000001.122161.02740000.00000004.mdmp, 00000000-00001788.00000002.122759.02740000.00000004.mdmp") Found reference to API "sendMessageChannelCache" (Indicator: "sendmessage"; Source: "00000000-00001788.00000000.120240.04A90000.00000004.mdmp") Found reference to API "System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00001788.00000000.120240.04A90000.00000004.mdmp")32:T2057," HTTP/1.1 200 OK Date: Mon 30 Mar 2026 13:49:01 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 30 Mar 2026 13:49:02 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET /xml/64.124.12.162 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 30 Mar 2026 13:49:03 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 31169 Accept-Ranges: bytes last-modified: Mon 30 Mar 2026 05:09:34 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=b1W%2F49icfi2lnN0eERlQBXq6GB%2Be%2BeIrcjeyVL5jsW899NWIThMjipcPDas36W21SpKIXlQOE97JF46RVq%2BxuSxtJF607IBBfwl1mcEnSmrFGGmNUeQjBy1d2ZDK6slhEleddqQ9"}]} CF-RAY: 9e479352cf00f997-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 30 Mar 2026 13:49:04 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Mon 30 Mar 2026 13:49:04 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 31170 Accept-Ranges: bytes last-modified: Mon 30 Mar 2026 05:09:34 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=m5TlKTpOOmOnJs7w7P2E5m0t2Uf30tF7wI5V26LslMtXKBMGqXYKbBvgO9ZA%2BLHIqE7aDbpVVVXzn641uGbWwfp5opYZvGP65kyC0ZgGeTJEhCKzmsZ%2FS0Ytt8OvL3weDfsWiRW2"}]} CF-RAY: 9e4793558822f997-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET /xml/64.124.12.162 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 30 Mar 2026 13:49:04 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 31170 Accept-Ranges: bytes last-modified: Mon 30 Mar 2026 05:09:34 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=g0NttP4MUF8ysHt9ebbLEBih%2FQhNn9DggsTr2epjJTm6kEDQQODouB6Qx8N3cakjO33lELH6F7p3CV9FUdqpSlgLQXZdl6sJEPeZvQdHRJMr%2FUlhLi%2Bio0p3rnC%2FlTSL33vKDVR%2F"}]} CF-RAY: 9e47935889473884-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 30 Mar 2026 13:49:05 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET /xml/64.124.12.162 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 30 Mar 2026 13:49:05 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 31170 Accept-Ranges: bytes last-modified: Mon 30 Mar 2026 05:09:34 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=iCSxScwBu%2FSSFsRgNutMx%2BIX2sN0ctstHHz37XUbbENCaVhgwz7PgijxaPMeyQq2hs2IhecqONxwWC41AqsX9bWrRIANyBOhkFxbcOL%2BSsU5skvLU0yc%2F9e6wldlVv1w%2BJkE2ceo"}]} CF-RAY: 9e47935b7da167c1-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Mon 30 Mar 2026 13:49:05 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 31171 Accept-Ranges: bytes last-modified: Mon 30 Mar 2026 05:09:34 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=QpH4YqAtYN%2BfW2lwW9ixMPlz8oQ1jy275yqIMfyetBYJIEgfz0s9nAOUiOxVFDRQe6WMIlGoY5%2B9hDOkyxoII2Kf18FTMVqqmGfU7c7ttII29EPSTefKVbAujVhqVTsnXOvvYyOU"}]} CF-RAY: 9e47935eab5b2b29-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 30 Mar 2026 13:49:06 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET /xml/64.124.12.162 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 30 Mar 2026 13:49:06 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 31171 Accept-Ranges: bytes last-modified: Mon 30 Mar 2026 05:09:34 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ahhPhsw24uqR76QDdfNNLPaf2ZLzkTBf3U7pJKX9U2wKuGiZZL1B68mFrrROItQz5KL%2B5r0YBVChFczDJrU2h71hIvE%2BpfQ%2F%2BjkOWWHFFTw%2FjJerA7pjq%2FFcFJW%2F38QZPtP7S8DL"}]} CF-RAY: 9e4793619abb15a2-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Mon 30 Mar 2026 13:49:06 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 31172 Accept-Ranges: bytes last-modified: Mon 30 Mar 2026 05:09:34 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=iQjHkoP1o5DzxaOS07jRL6epZYmFLC0hEf0fK1gQiewQsnrXLaB2wQTvHF20boRLup0u%2F%2BXXltDRiWYjrZbbGjP0s21Cm4jXSLoUg61GCiEF1G12kVRaj9OQ06Y1npQWig2Bz1TJ"}]} CF-RAY: 9e4793661f8df46e-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 30 Mar 2026 13:49:07 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET /xml/64.124.12.162 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 30 Mar 2026 13:49:07 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 31173 Accept-Ranges: bytes last-modified: Mon 30 Mar 2026 05:09:34 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ixL3BfY8qLbXosQde%2Fl9ICyEBEb32nCU7HpCh6OIT2I5uc7vMAY%2B162H7maNC14OrknfircvmM8j4kkLvH1nBv12TIFzCYhCwWy4ffveAgRqU2biAUwSBVLf8CK1qAjn4uIJMSXq"}]} CF-RAY: 9e4793692efe55c2-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET /xml/64.124.12.162 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 30 Mar 2026 13:49:07 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 31173 Accept-Ranges: bytes last-modified: Mon 30 Mar 2026 05:09:34 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=AEgthutXxbSx2m1ilkS%2BHwEIS%2F9%2FEKHksLc1p3MTEyhkbQeVGVENlAyR2SkJ%2BK0kUKk1Q5njrHhq2Q43vrZLp1yZggj0p5oZI%2Bxx67Fs%2B79JZtu5bDOl0HpRBM9D1uwQMvPl4ja%2B"}]} CF-RAY: 9e47936cdbf14833-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465.......3e:T1f7f,"64.124.12.162USUnited StatesMIMichiganOkemos48864America/Detroit64.124.12.162", "2.5.29.16", "2.5.29.10", Potential IP "4.0.0.0" found in string "ccessibility 4.0.0.0 b03f5f7f11d50a3a", "2.5.29.37", "4.0.0.0", "127.0.0.1", Potential IP "127.0.0.1" found in string "/c ping 127.0.0.1 -n"48:T27f9,Heuristic match: "1(.xn" Heuristic match: "ac.tl" Heuristic match: "checkip.dyndns.org" Heuristic match: "get / http/1.1user-agent: mozilla/4.0 (compatible; msie 6.0; windows nt 5.2; .net clr1.0.3705;)host: checkip.dyndns.org" Heuristic match: "reallyfreegeoip.org" Pattern match: "https://www.osha.gov/formaldehyde" Pattern match: "https://api.municipality.gov/trees/v1" Heuristic match: "api.telegram.org" Heuristic match: "zny6dr9.my" Heuristic match: "hosting2.ro.hostsailor.com" Pattern match: "http://aborters.duckdns.org:8081,http://anotherarmy.dns.army:8081" Pattern match: "reallyfreegeoip.org/xml/" Pattern match: "api.telegram.org/bot" Heuristic match: "remington.my" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "stem.co" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "ntrust.net" Pattern match: "www.api.telegram.org" Heuristic match: "m.web.se" Pattern match: "www.api.telegram.org0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://www.microsoft.com0" Pattern match: "http://wwwo" Pattern match: "ft.com/pki/certs/microoceraut_2010-06-23.crt07" Heuristic match: "pi.telegram.org" Pattern match: "http://checkip.dyndns.org/" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "microsoft.net/assembly/gac_msil/system/v4.0_4.0.0.0__b77a5c561934e089/system.dll" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315#withcomments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#withcomments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/tr/1999/rec-xpath-19991116" Pattern match: "http://www.w3.org/tr/1999/rec-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#xml" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://schemas.microsoft.com/.netconfiguration/v2.0" Pattern match: "system.web/anonymousidentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browsercaps" Pattern match: "system.web/clienttarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customerrors" Pattern match: "system.web/deployment" Pattern match: "system.web/devicefilters" Pattern match: "system.web/fulltrustassemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthmonitoring" Pattern match: "system.web/hostingenvironment" Pattern match: "system.web/httpcookies" Pattern match: "system.web/httphandlers" Pattern match: "system.web/httpmodules" Pattern match: "system.web/httpruntime" Pattern match: "system.web/identity" Pattern match: "system.web/machinekey" Pattern match: "system.web/membership" Pattern match: "system.web/mobilecontrols" Pattern match: "system.web/pages" Pattern match: "system.web/partialtrustvisibleassemblies" Pattern match: "system.web/processmodel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/rolemanager" Pattern match: "system.web/securitypolicy" Pattern match: "system.web/sessionpagestate" Pattern match: "system.web/sessionstate" Pattern match: "system.web/sitemap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlmappings" Pattern match: "system.web/webcontrols" Pattern match: "system.web/webparts" Pattern match: "system.web/webservices" Pattern match: "system.web/xhtmlconformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputcache" Pattern match: "system.web/caching/outputcachesettings" Pattern match: "system.web/caching/sqlcachedependency" Pattern match: "https://fs.microsoft.com/fs/windows/config.json" Pattern match: "https://fs.microsoft.com/fs/windows/config.json,config,0" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&"49:T535e,Found URL "http://aborters.duckdns.org:8081,http://anotherarmy.dns.army:8081srokyichvpfhakipzaxnnchkmgklnaizhgmyrnjfulidgkftkrtelinhfklkjrkdexmvkeucxukugr$hash" - Source: "00000000-00000944.00000002.124595.00810000.00000040.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcion1" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;geotrust" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://wwwo@6t+a6" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00000944.00000002.124595.02970000.00000004.mdmp") Found URL "http://checkip.dyndns.org/checkip.dyndns.orglocal" - Source: "00000000-00000944.00000002.124595.08640000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00000944.00000002.124595.08640000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00000944.00000002.124595.08640000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00000944.00000002.124595.08640000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00000944.00000002.124595.08640000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000944.00000002.124595.08640000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00000944.00000002.124595.08640000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcion1" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;geotrust" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://wwwo@6t+a6" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00000944.00000003.129585.02970000.00000004.mdmp") Found URL "http://checkip.dyndns.org/checkip.dyndns.orglocal" - Source: "00000000-00000944.00000003.129585.08640000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00000944.00000003.129585.08640000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00000944.00000003.129585.08640000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00000944.00000003.129585.08640000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00000944.00000003.129585.08640000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000944.00000003.129585.08640000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00000944.00000003.129585.08640000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001788.00000000.120240.02740000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00001788.00000000.120240.04880000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00001788.00000000.120240.04A90000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00001788.00000000.120240.04A90000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json03/30" - Source: "00000000-00001788.00000000.120240.075A0000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,003/30" - Source: "00000000-00001788.00000000.120240.075A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00001788.00000000.120240.70571000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00001788.00000000.120240.70571000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00001788.00000000.120240.70571000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001788.00000001.122161.02740000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00001788.00000001.122161.04880000.00000004.mdmp") Found URL "http://ns.adobe.com/xap/1.0/xmpid8bimiplogscrdescimgdesciccp/www.w3.org/1999/02/22-r/xap/1.0/ns.adobe.com/xap/1.0/rig1.0/bj/photoshophttp://ns.a.adobe.com/http://ns.adobe.com/xa/xap/1.0/stype/resourceref" - Source: "00000000-00001788.00000001.122161.0723D000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001788.00000002.122759.02740000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00001788.00000002.122759.04880000.00000004.mdmp") Found URL "http://ns.adobe.com/xap/1.0/xmpidbj*+" - Source: "00000000-00001788.00000002.122759.07256000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00001788.00000002.122759.70651000.00000020.mdmp")4a:T97e,Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00000944.00000002.124595.00810000.00000040.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001788.00000000.120240.02740000.00000004.mdmp, 00000000-00001788.00000001.122161.02740000.00000004.mdmp, 00000000-00001788.00000002.122759.02740000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001788.00000000.120240.02740000.00000004.mdmp, 00000000-00001788.00000001.122161.02740000.00000004.mdmp, 00000000-00001788.00000002.122759.02740000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001788.00000000.120240.02740000.00000004.mdmp, 00000000-00001788.00000001.122161.02740000.00000004.mdmp, 00000000-00001788.00000002.122759.02740000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001788.00000000.120240.02740000.00000004.mdmp, 00000000-00001788.00000001.122161.02740000.00000004.mdmp, 00000000-00001788.00000002.122759.02740000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001788.00000000.120240.02740000.00000004.mdmp, 00000000-00001788.00000001.122161.02740000.00000004.mdmp, 00000000-00001788.00000002.122759.02740000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001788.00000000.120240.02740000.00000004.mdmp, 00000000-00001788.00000001.122161.02740000.00000004.mdmp, 00000000-00001788.00000002.122759.02740000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001788.00000000.120240.02740000.00000004.mdmp, 00000000-00001788.00000001.122161.02740000.00000004.mdmp, 00000000-00001788.00000002.122759.02740000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001788.00000000.120240.02740000.00000004.mdmp, 00000000-00001788.00000001.122161.02740000.00000004.mdmp, 00000000-00001788.00000002.122759.02740000.00000004.mdmp")4b:T9e4,"" (Indicator: "password"; Source: "00000000-00001788.00000000.120240.04A90000.00000004.mdmp")4f:Tade,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001788.00000000.120240.02740000.00000004.mdmp, 00000000-00001788.00000001.122161.02740000.00000004.mdmp, 00000000-00001788.00000002.122759.02740000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69ca7f03a7ffe817ee0919ea"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$27","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69ca7f03a7ffe817ee0919ea"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00001788.00000000.120240.02740000.00000004.mdmp\n 00000000-00001788.00000001.122161.02740000.00000004.mdmp\n 00000000-00001788.00000002.122759.0276B000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"69ca7f03a7ffe817ee0919ea"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00000944.00000002.124595.00810000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001788.00000001.122161.096B0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001788.00000002.122759.071A0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69ca7f03a7ffe817ee0919ea"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00001788.00000000.120240.04A90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69ca7f03a7ffe817ee0919ea"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00000944.00000002.124595.00810000.00000040.mdmp\")\n Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00000944.00000002.124595.00810000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69ca7f03a7ffe817ee0919ea"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69ca7f03a7ffe817ee0919ea"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"64.124.12.162USUnited StatesMIMichiganOkemos48864America/Detroit64.124.12.162\" (Indicator: \"64.124.12.162\"; Source: \"00000000-00000944.00000002.124595.02970000.00000004.mdmp, 00000000-00000944.00000002.124595.08640000.00000004.mdmp, 00000000-00000944.00000003.129585.02970000.00000004.mdmp, 00000000-00000944.00000003.129585.08640000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590.005","relevance":1,"id":"string-643","sources":[{"report_type":"sandbox","report_id":"69ca7f03a7ffe817ee0919ea"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to steal Pidgin account information (file access)","description":"\"