34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 5d:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T50d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Capa_reference_anti_VM_strings_targeting_Xen Sample 70a9c079bb15… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 70a9c079bb15…. Malware family: Capa_reference_anti_VM_strings_targeting_Xen. Threat score 100/100. 17/27 AV engines flagged this file. 9 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","keywords":["Malicious","Capa_reference_anti_VM_strings_targeting_Xen","malware analysis","sandbox report","threat intelligence","70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0"],"about":{"@type":"SoftwareApplication","name":"tmphw_c8oz1.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Capa_reference_anti_VM_strings_targeting_Xen","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:Ta8b,Found reference to API "AsyncVoidMethodBuilder" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "+xeno_rat_client.Handler+d__3" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "CreateEncryptor" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "CreateEncryptor" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "RecvAllAsync_ddos_safer" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "BTruncate" (Indicator: "truncate"; Source: "sample.bin"), Found reference to API "ConnectAndSetupAsync" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "ConnectAndSetupAsync" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "ReadToEnd" (Indicator: "read"; Source: "sample.bin"), Found reference to API "-xeno_rat_client.Node+d__18" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "CreateDecryptor" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "__StaticArrayInitTypeSize=32" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "5__6" (Indicator: "time"; Source: "sample.bin"), Found reference to API "WaitForExit" (Indicator: "exit"; Source: "sample.bin"), Found reference to API "-xeno_rat_client.SocketHandler+d__9" (Indicator: "socket"; Source: "sample.bin"), Found reference to API "-xeno_rat_client.SocketHandler+d__9" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "BeginDisconnect" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "1xeno_rat_client.Utils+d__15" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "1xeno_rat_client.Utils+d__15" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "Socket" (Indicator: "socket"; Source: "sample.bin"), Found reference to API "RecvAllAsync_ddos_unsafer" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "d__4" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "GetIdleTime" (Indicator: "time"; Source: "sample.bin"), Found reference to API "SetStateMachine" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "RuntimeHelpers" (Indicator: "time"; Source: "sample.bin"), Found reference to API "set_CreateNoWindow" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "OpenSubKey" (Indicator: "open"; Source: "sample.bin"), Found reference to API "RuntimeFieldHandle" (Indicator: "time"; Source: "sample.bin")37:T52c,Found reference to API (Indicator: "RtlDecompressBuffer"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowTextLength"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetCompressionWorkSpaceSize"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileName"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectory"; Source: "sample.bin"), Found reference to API (Indicator: "GetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowText"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCompressBuffer"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectory"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastInputInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessById"; Source: "sample.bin")38:T81d,Found string "+xeno_rat_client.Handler+d__3" (Source: "sample.bin"), Found string "/xeno_rat_client.DllHandler+d__3" (Source: "sample.bin"), Found string "-xeno_rat_client.Node+d__18" (Source: "sample.bin"), Found string "-xeno_rat_client.SocketHandler+d__9" (Source: "sample.bin"), Found string "1xeno_rat_client.Utils+d__15" (Source: "sample.bin"), Found string "9xeno_rat_client.Utils+d__8" (Source: "sample.bin"), Found string "*xeno_rat_client.Handler+d__7" (Source: "sample.bin"), Found string ",xeno_rat_client.Handler+d__5" (Source: "sample.bin"), Found string "-xeno_rat_client.Utils+d__20" (Source: "sample.bin"), Found string "(xeno_rat_client.Handler+d__10" (Source: "sample.bin"), Found string "(xeno_rat_client.Node+d__13" (Source: "sample.bin"), Found string ".xeno_rat_client.Utils+d__19" (Source: "sample.bin"), Found string "-xeno_rat_client.Handler+d__11" (Source: "sample.bin"), Found string "#xeno_rat_client.Program+

d__11" (Source: "sample.bin"), Found string ";xeno_rat_client.SocketHandler+d__5" (Source: "sample.bin"), Found string "&xeno_rat_client.Handler+d__8" (Source: "sample.bin"), Found string "*xeno_rat_client.Handler+d__9" (Source: "sample.bin"), Found string "&xeno_rat_client.Node+d__10" (Source: "sample.bin"), Found string "1xeno_rat_client.Utils+d__18" (Source: "sample.bin"), Found string "%xeno_rat_client.Node+d__14" (Source: "sample.bin"), Found string "xeno_rat_client" (Source: "sample.bin"), Found string "=xeno_rat_client.SocketHandler+d__4" (Source: "sample.bin"), Found string "&xeno_rat_client.Utils+d__17" (Source: "sample.bin"), Found string "*xeno_rat_client.Utils+d__16" (Source: "sample.bin"), Found string "%\XenoManager\" (Source: "sample.bin")39:T502,"tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}") "tmphw_c8oz1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\INTERFACESPECIFICPARAMETERS") "tmphw_c8oz1.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\INTERFACESPECIFICPARAMETERS") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "tmphw_c8oz1.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "tmphw_c8oz1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS") "tmphw_c8oz1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\DNSCLIENT") "tmphw_c8oz1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEM\DNSCLIENT") "tmphw_c8oz1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS")3a:T68e,"tmphw_c8oz1.exe" queried SystemProcessInformation at 00000000-00008528-00000C15-1196263605 [PID: 8528] "tmphw_c8oz1.exe" queried SystemProcessInformation at 00000000-00008528-00000C15-1196270712 [PID: 8528] "tmphw_c8oz1.exe" queried SystemProcessInformation at 00000000-00008528-00000C15-1196464365 [PID: 8528] "tmphw_c8oz1.exe" queried SystemProcessInformation at 00000000-00008528-00000C15-1196471126 [PID: 8528] "tmphw_c8oz1.exe" queried SystemProcessInformation at 00000000-00008528-00000C15-1196601485 [PID: 8528] "tmphw_c8oz1.exe" queried SystemProcessInformation at 00000000-00008528-00000C15-1196608030 [PID: 8528] "tmphw_c8oz1.exe" queried SystemProcessInformation at 00000000-00008528-00000C15-1198188516 [PID: 8528] "tmphw_c8oz1.exe" queried SystemProcessInformation at 00000000-00008528-00000C15-1198196758 [PID: 8528] "tmphw_c8oz1.exe" queried SystemProcessInformation at 00000000-00008528-00000C15-1200498073 [PID: 8528] "tmphw_c8oz1.exe" queried SystemProcessInformation at 00000000-00008528-00000C15-1200504831 [PID: 8528] "tmphw_c8oz1.exe" queried SystemProcessInformation at 00000000-00008528-00000C15-1200701535 [PID: 8528] "tmphw_c8oz1.exe" queried SystemProcessInformation at 00000000-00008528-00000C15-1200708895 [PID: 8528] "tmphw_c8oz1.exe" queried SystemProcessInformation at 00000000-00008528-00000C15-1201184787 [PID: 8528] "tmphw_c8oz1.exe" queried SystemProcessInformation at 00000000-00008528-00000C15-1201192787 [PID: 8528] "tmphw_c8oz1.exe" queried SystemProcessInformation at 00000000-00008528-00000C15-1202221293 [PID: 8528] "tmphw_c8oz1.exe" queried SystemProcessInformation at 00000000-00008528-00000C15-1202229199 [PID: 8528]3b:T55e,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Able to decrypt/decode data Matched sigs: Contains reference to crypto DLLs Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform AES cryptographic operations (Dotnet) Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: Contains symmetric decryption functionality in .NET code Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Able to decode string content at runtime (.NET)3c:Tc65,"tmphw_c8oz1.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000f00100000f4b600c8d1d90083703277c8d1d9000000000028000000000000000000d80000000000000000000000000000000000448236774830d9000000d800a8f4b6006400000000000000 (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a0000020000000000b600be603277a0a59975be6032770000000000000000000000000d00000000000000030000000d0000007e000000030000002056de00bce0b600db3d9876501ba676af3d98768c31aa730d0000007e0000000300000000000000b9b0337710a5997518e1b600d01f9b76d801b805feffffffece0b6000300000080be5775a0a59975dce0b60091be5775030000000000000028e1b6003b3c9876030000000000000068db9175000000009d1a9876841a98761830aa7368db917592000000a0a5997500000000c041ae7524e1b600a0e1b600d01f9b76981eb805feffffff34e1b600101a9876d041ae7544e1b600e52fa775e099e575d041ae7550e1b600 (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "RtlGetVersion" with parameter 240100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008528)3d:Tae9,"tmphw_c8oz1.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "ENABLEMULTICAST"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "QUERYADAPTERNAME"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEMULTICAST"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "QUERYADAPTERNAME"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "")3e:T515,"tmphw_c8oz1.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "tmphw_c8oz1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "tmphw_c8oz1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "tmphw_c8oz1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "tmphw_c8oz1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "tmphw_c8oz1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "tmphw_c8oz1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "tmphw_c8oz1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "tmphw_c8oz1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "tmphw_c8oz1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")3f:T1bb6,"tmphw_c8oz1.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\ef4992f14ba62dc115c01e7a6018e263\mscorlib.ni.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\67186481d97828a572bf5db055f4a9f1\System.ni.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter C:\shell32.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\c20afd70aeb352395f8f5297a727f0ba\System.Core.ni.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\0fc458e2e89a1743b9bb2c58049a8f4f\System.Configuration.ni.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\416015a614fb5f5c53cd9ccbf0e5e13f\System.Xml.ni.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00008528)40:T5b77,"tmphw_c8oz1.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter IsUserAnAdmin (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CancelIoEx (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter WSAStringToAddress (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00008528)41:T8c8,Process tmphw_c8oz1.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8528:168:WilStaging_02" Process tmphw_c8oz1.exe created mutex with name "\Sessions\1\BaseNamedObjects\456JSCJ5RtdRzWxa-admin" Process tmphw_c8oz1.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8528:168:WilStaging_02" Process tmphw_c8oz1.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8528:64:WilError_03" Process tmphw_c8oz1.exe created mutex with name "Local\SM0:8528:168:WilStaging_02" Process tmphw_c8oz1.exe created mutex with name "456JSCJ5RtdRzWxa-admin" Process tmphw_c8oz1.exe created mutex with name "SM0:8528:168:WilStaging_02" Process tmphw_c8oz1.exe created mutex with name "Local\SM0:8528:64:WilError_03" Process tmphw_c8oz1.exe created mutex with name "SM0:8528:64:WilError_03" Process tmphw_c8oz1.exe created mutex with name "Global\RasPbFile" Process tmphw_c8oz1.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8528:64:WilError_03" Process tmphw_c8oz1.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\RasPbFile" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4380:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4380:120:WilError_03" Process msedge.exe created mutex with name "Local\SessionImmersiveColorMutex" Process msedge.exe created mutex with name "3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD" Process msedge.exe created mutex with name "Local\SM0:4380:304:WilStaging_02" Process msedge.exe created mutex with name "SM0:4380:304:WilStaging_02" Process msedge.exe created mutex with name "__OMADM_NAMED_MUTEX__" Process msedge.exe created mutex with name "Local\SM0:4380:120:WilError_03" Process msedge.exe created mutex with name "ChromeProcessSingletonStartup!" Process msedge.exe created mutex with name "SM0:4380:120:WilError_03" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4380:120:WilError_03" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4380:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\ChromeProcessSingletonStartup!"42:T926,"tmphw_c8oz1.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "tmphw_c8oz1.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "tmphw_c8oz1.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "tmphw_c8oz1.exe" failed to load missing module "C:\shell32.dll" - [base:0; Status:c0000135] "tmphw_c8oz1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "tmphw_c8oz1.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "tmphw_c8oz1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "tmphw_c8oz1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "tmphw_c8oz1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "tmphw_c8oz1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "tmphw_c8oz1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "tmphw_c8oz1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "tmphw_c8oz1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "tmphw_c8oz1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "tmphw_c8oz1.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135]43:T3d93,"Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" in Source: 00000000-00008528.00000000.148489.00D80000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManag" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.FinishProxyTunnelConnectionEarly" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowNewLineInFtpCommand" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowSmtpFallbackToPlainText" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SystemDefaultTlsVersions" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00008528.00000001.150411.00D80000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" in Source: 00000000-00008528.00000001.150411.00D80000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManag" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.FinishProxyTunnelConnectionEarly" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowNewLineInFtpCommand" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowSmtpFallbackToPlainText" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SystemDefaultTlsVersions" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00008528.00000002.152332.00D80000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" in Source: 00000000-00008528.00000002.152332.00D80000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManag" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.FinishProxyTunnelConnectionEarly" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowNewLineInFtpCommand" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowSmtpFallbackToPlainText" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SystemDefaultTlsVersions" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp44:T4eea,"GET / HTTP/1.1 Host: rr88vipa.com Connection: Keep-Alive" Response ==> HTTP/1.1 301 Moved Permanently Server: CloudFront Date: Tue 10 Nov 2026 11:57:03 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Location: https://rr88vipa.com/ X-Cache: Redirect from cloudfront Via: 1.1 e9c14790ff63b931e8e58434b28761a0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LAX50-P3 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: 7YSkU0mRQeoaO4gwdn-oRUtQAwCptPFTzuE5cNpfdv8ujVEd7vPtgA== with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E333031204D6F766564205065726D616E656E746C793C2F7469746C653E3C2F686561643E0D0A3C626F6479....... "GET / HTTP/1.1 Host: www.rr88vipa.com Connection: Keep-Alive" Response ==> HTTP/1.1 301 Moved Permanently Server: CloudFront Date: Tue 10 Nov 2026 11:57:05 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Location: https://www.rr88vipa.com/ X-Cache: Redirect from cloudfront Via: 1.1 da0d6aa5f636a59073949bb9b7c3478a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P15 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: imgs5JVCcSvSzCtjvm7kMrGOw93_ClArfN3cADiqeRpCwL7xQJNEWQ== with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E333031204D6F766564205065726D616E656E746C793C2F7469746C653E3C2F686561643E0D0A3C626F6479....... "GET /.well-known/windows-app-web-link HTTP/2 Host: m365.cloud.microsoft Accept-Encoding: gzip, deflate" Response ==> HTTP/2 302 Found Date: Tue 10 Nov 2026 11:57:10 GMT X-Msedge-Ref: Ref A: E441819D5A78426581814B7184020B09 Ref B: SJC211051201031 Ref C: 2026-11-10T11:57:10Z Location: https://res.public.onecdn.static.microsoft/m365mobile/5mttl/desktop/windows/weblink/windows-app-web-link.json with no response body "GET /m365mobile/5mttl/desktop/windows/weblink/windows-app-web-link.json HTTP/2 Host: res.public.onecdn.static.microsoft Accept-Encoding: gzip, deflate" Response ==> HTTP/2 200 OK Content-Type: application/json Date: Tue 10 Nov 2026 11:57:10 GMT Akamai-Cache-Status: Hit from child Vary: Accept-Encoding Content-Encoding: gzip Access-Control-Allow-Headers: * X-Cdn-Provider: Akamai Access-Control-Allow-Methods: GET HEAD OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains Ak-Network: FF Access-Control-Expose-Headers: date X-Cdn-Provider X-Ms-Request-Id Akamai-Request-BC Access-Control-Allow-Origin: * Last-Modified: Thu 26 Feb 2026 07:56:51 GMT Nel: {"report_to":"NelM365CDNUpload1" "max_age":604800 "include_subdomains":true "failure_fraction":1.0 "success_fraction":0.01} Report-To: {"group":"NelM365CDNUpload1" "max_age":604800 "endpoints":[{"url":"https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=LOSANGELES&ASN=20940&Country=US&Region=CA&RequestIdentifier=0.b003d517.1794311830.70b97611&TotalRTCDNTime=9&CompressionType=gzip&FileSize=106"}] "include_subdomains":true} Server-Timing: clientrtt; dur=9 clienttt; dur= origin; dur=0 cdntime; dur=0 Timing-Allow-Origin: * Cache-Control: max-age=300 Alt-Svc: h3=":443"; ma=93600 h3-29=":443"; ma=93600 Akamai-Request-Bc: [a=23.213.3.176 b=1891202577 c=g n=US_CA_LOSANGELES o=20940] X-Ms-Request-Id: 5a6ffee1-901e-0010-6248-45076a000000 with no response body "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: arxiv.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/x-icon Date: Tue 10 Nov 2026 11:59:05 GMT Server: Apache Vary: Accept-Encoding Content-Encoding: gzip X-Served-By: cache-lga-kjfk8660020-LGA cache-lga-kjfk8660020-LGA cache-lga-kjfk8660020-LGA cache-lax-kwhp1940062-LAX Strict-Transport-Security: max-age=31536000 Via: 1.1 varnish 1.1 varnish 1.1 varnish Set-Cookie: browser=64.124.12.162.1794311945559145; path=/; max-age=946080000; domain=.arxiv.org Last-Modified: Tue 18 Jun 2013 15:14:38 GMT X-Timer: S1794311945.460559 VS0 VE144 Etag: "8a9d39d-e36-4df6f2bea9380" X-Cache: MISS MISS MISS Accept-Ranges: bytes with no response body "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: duo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 404 Not Found Content-Type: text/html; charset=utf-8 Date: Tue 10 Nov 2026 11:59:05 GMT X-Amz-Cf-Pop: JFK52-P4 Server: Duo/1.0 Vary: Accept-Encoding Content-Encoding: gzip Etag: W/"6af225c9-fd58" X-Cache: Error from cloudfront X-Amz-Cf-Id: _1yPaSQUv0E1ifHhOpuYlda5ZKefEr2nvSLnwvTBVeoNRietFkkrow== Via: 1.1 28fca7284ad6e07382ad05b79a20cd6a.cloudfront.net (CloudFront) with response body ==>BINARY_CONTENT....... "GET /favicon?url=driveteslacanada.ca?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Tue 10 Nov 2026 11:59:05 GMT X-Msedge-Ref: Ref A: DD58357B31B0428BB6722ED3E6F06377 Ref B: SJC211051205007 Ref C: 2026-11-10T11:59:05Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: DD58357B31B0428BB6722ED3E6F06377 Ref B: SC-WUS2-1ZB4Y_AKS-GEN00-28457140-VMSS00000D_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-9QSPL Ref C: 2026-11-10T11:59:05Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=chatsports.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Tue 10 Nov 2026 11:59:05 GMT X-Msedge-Ref: Ref A: DAA8110C40CC451A99D35C44036D61C0 Ref B: SJC211051205007 Ref C: 2026-11-10T11:59:05Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: DAA8110C40CC451A99D35C44036D61C0 Ref B: SC-WUS2-1ZB4Y_AKS-GEN00-28457140-VMSS00000A_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-G4QM2 Ref C: 2026-11-10T11:59:05Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=theshopmag.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Tue 10 Nov 2026 11:59:05 GMT X-Msedge-Ref: Ref A: F4FDFBB9E7B84C77AF14767BC1612835 Ref B: SJC211051205007 Ref C: 2026-11-10T11:59:05Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: F4FDFBB9E7B84C77AF14767BC1612835 Ref B: SC-WUS2-1ZB4Y_AKS-GEN00-28457140-VMSS000014_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-CDQ79 Ref C: 2026-11-10T11:59:05Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=techannouncer.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Tue 10 Nov 2026 11:59:05 GMT X-Msedge-Ref: Ref A: BC9FA706F0E84AAF8D890CD56586744F Ref B: SJC211051205007 Ref C: 2026-11-10T11:59:05Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: BC9FA706F0E84AAF8D890CD56586744F Ref B: SC-WUS2-1ZB4Y_AKS-GEN00-28457140-VMSS000015_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-NFS4N Ref C: 2026-11-10T11:59:05Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=evchargingstations.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Tue 10 Nov 2026 11:59:05 GMT X-Msedge-Ref: Ref A: 29C11B58C649470E90C4E0E37A92A775 Ref B: SJC211051205007 Ref C: 2026-11-10T11:59:05Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: 29C11B58C649470E90C4E0E37A92A775 Ref B: SC-WUS2-1ZB4Y_AKS-GEN00-28457140-VMSS00000R_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-T6G7T Ref C: 2026-11-10T11:59:05Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=miamisportswire.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Tue 10 Nov 2026 11:59:05 GMT X-Msedge-Ref: Ref A: E6415222D40D447EB53C20BD17E53955 Ref B: SJC211051205007 Ref C: 2026-11-10T11:59:05Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: E6415222D40D447EB53C20BD17E53955 Ref B: SC-WUS2-1ZB4Y_AKS-GEN00-28457140-VMSS00000I_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-7HMR8 Ref C: 2026-11-10T11:59:05Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=menafn.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Tue 10 Nov 2026 11:59:05 GMT X-Msedge-Ref: Ref A: 21D09633D67A4329927E8E3F1559CACA Ref B: SJC211051205007 Ref C: 2026-11-10T11:59:05Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: 21D09633D67A4329927E8E3F1559CACA Ref B: SC-WUS2-1ZB4Y_AKS-GEN00-28457140-VMSS000012_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-B8KNF Ref C: 2026-11-10T11:59:05Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: atlasofsecurity.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 404 Not Found Content-Type: text/html Date: Tue 10 Nov 2026 11:59:08 GMT X-Amz-Cf-Pop: JFK52-P10 Server: AmazonS3 Vary: Accept-Encoding Content-Encoding: br X-Frame-Options: SAMEORIGIN X-Amz-Server-Side-Encryption: AES256 X-Amz-Version-Id: d8SW3cg4RslJiv60qL_0qKuEx3B18icG Strict-Transport-Security: max-age=31536000 Via: 1.1 911e28435e9a834f6bc712f4907c4312.cloudfront.net (CloudFront) X-Amz-Meta-Sha256: dd88a5820154bf6f6c1ae0b918d6b8a167db726d02fbc1e91ea88915e9586847 Last-Modified: Tue 10 Nov 2026 10:32:51 GMT X-Xss-Protection: 1; mode=block X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Etag: W/"b571bb73bb8c8f23fd2cb99438ab2b84" X-Cache: Error from cloudfront Cache-Control: public max-age=60 must-revalidate Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: UX_fDp-dAVx_zHzbUm_FbKHceSPTJsqCaiiW1zKEWTvLQpUapMR6zA== with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.synqly.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/x-icon Date: Tue 10 Nov 2026 11:59:08 GMT X-Ac: 1.sjc _atomic_bur MISS Server: nginx Last-Modified: Wed 25 Jun 2025 17:46:45 GMT Expires: Thu 10 Dec 2026 11:59:08 GMT X-Remembering: Eric Binnion Etag: "685c3605-0" Server-Timing: a8c-cdn dc;desc=sjc cache;desc=MISS;dur=51.0 Cache-Control: max-age=2592000 Accept-Ranges: bytes Alt-Svc: clear Strict-Transport-Security: max-age=31536000 with no response body "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.cisco.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/x-icon Date: Tue 10 Nov 2026 11:59:08 GMT Server: Apache/2.4.37 (Red Hat Enterprise Linux) OpenSSL/1.1.1k Expires: Tue 10 Nov 2026 11:59:08 GMT Strict-Transport-Security: max-age=31536000 Last-Modified: Wed 08 Nov 2017 00:55:03 GMT Set-Cookie: c_bi=cecd4ecd6c29a29a1251344a80ac351c; path=/; domain=.www.cisco.com; Secure Content-Security-Policy: upgrade-insecure-requests; frame-ancestors *.cisco.com *.jasper.com *.ciscospark.com *.ciscolive.com http://cisco.lookbookhq.com https://cisco.lookbookhq.com testcisco.marketing.adobe.com cisco.marketing.adobe.com ciscosales.my.salesforce.com test.salesforce.com zedo.com hindustantimes.com economictimes.indiatimes.com *.webex.com *.cdw.com *.cdwg.com *.cdw.ca *.meraki-go.com http://ciscopartners.lookbookhq.com https://ciscopartners.lookbookhq.com ciscolearningsystem.com ciscocustomer.lookbookhq.com cisco.lookbookhq.com ccsmedia.com *.itquotes.ie dteonline.com ampito-cisco.com arkphire.com *.insight.com *.ccsmedia.com *.ebuyer.com *.lambda-tek.com *.storm-technologies.com *.vohkus.com *.bechtle.com *.rainfocus.com *.broadbandbuyer.com *.hardware.com shop.redpontem.com *.miro.com cisco.techdatavendors.be *.service-now.com *.thousandeyes.com *.duo.com duo.com *.umbrella.com *.pricespider.com *.mapbox.com *.vercel.app cdnjs.cloudflare.com https://community.cisco.com/; X-Xss-Protection: 1; mode=block X-Content-Type-Options: nosniff Etag: "55d6e2347e016" Cdchost: cdcxweb-prod2-02 Server-Timing: ak_p; desc="1794311948317_399001619_34494943_4801_12366_27_56_15";dur=1 Accept-Ranges: bytes Cache-Control: max-age=0 with response body ==>BINARY_CONTENT.......45:Tfe2,"tmphw_c8oz1.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74ec0000 "tmphw_c8oz1.exe" loaded module "ADVAPI32.DLL" at base 766e0000 "tmphw_c8oz1.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75450000 "tmphw_c8oz1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75450000 "tmphw_c8oz1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75450000 "tmphw_c8oz1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 74e10000 "tmphw_c8oz1.exe" loaded module "SHLWAPI.DLL" at base 75800000 "tmphw_c8oz1.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74e00000 "tmphw_c8oz1.exe" loaded module "VERSION.DLL" at base 74df0000 "tmphw_c8oz1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 745a0000 "tmphw_c8oz1.exe" loaded module "USER32.DLL" at base 76b70000 "tmphw_c8oz1.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 75450000 "tmphw_c8oz1.exe" loaded module "MSCOREE.DLL" at base 750f0000 "tmphw_c8oz1.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 760d0000 "tmphw_c8oz1.exe" loaded module "PSAPI.DLL" at base 76880000 "tmphw_c8oz1.exe" loaded module "RPCRT4.DLL" at base 76000000 "tmphw_c8oz1.exe" loaded module "KERNEL32.DLL" at base 771e0000 "tmphw_c8oz1.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\EF4992F14BA62DC115C01E7A6018E263\MSCORLIB.NI.DLL" at base 73070000 "tmphw_c8oz1.exe" loaded module "OLE32.DLL" at base 76a80000 "tmphw_c8oz1.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 760d0000 "tmphw_c8oz1.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 75450000 "tmphw_c8oz1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72fe0000 "tmphw_c8oz1.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\67186481D97828A572BF5DB055F4A9F1\SYSTEM.NI.DLL" at base 72580000 "tmphw_c8oz1.exe" loaded module "SHELL32.DLL" at base 758f0000 "tmphw_c8oz1.exe" loaded module "COMBASE.DLL" at base 760d0000 "tmphw_c8oz1.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 760d0000 "tmphw_c8oz1.exe" loaded module "NTDLL.DLL" at base 772e0000 "tmphw_c8oz1.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\C20AFD70AEB352395F8F5297A727F0BA\SYSTEM.CORE.NI.DLL" at base 71d60000 "tmphw_c8oz1.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\0FC458E2E89A1743B9BB2C58049A8F4F\SYSTEM.CONFIGURATION.NI.DLL" at base 71c50000 "tmphw_c8oz1.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\416015A614FB5F5C53CD9CCBF0E5E13F\SYSTEM.XML.NI.DLL" at base 714d0000 "tmphw_c8oz1.exe" loaded module "BCRYPT.DLL" at base 75170000 "tmphw_c8oz1.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 70e20000 "tmphw_c8oz1.exe" loaded module "RASAPI32.DLL" at base 70d20000 "tmphw_c8oz1.exe" loaded module "RASMAN.DLL" at base 70cf0000 "tmphw_c8oz1.exe" loaded module "WS2_32.DLL" at base 76560000 "tmphw_c8oz1.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 70c70000 "tmphw_c8oz1.exe" loaded module "WINHTTP.DLL" at base 70ba0000 "tmphw_c8oz1.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 70b80000 "tmphw_c8oz1.exe" loaded module "IPHLPAPI.DLL" at base 70b60000 "tmphw_c8oz1.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 70a70000 "tmphw_c8oz1.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 70a10000 "tmphw_c8oz1.exe" loaded module "SECUR32.DLL" at base 70a00000 "tmphw_c8oz1.exe" loaded module "SSPICLI.DLL" at base 709d0000 "tmphw_c8oz1.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 70950000 "tmphw_c8oz1.exe" loaded module "MSKEYPROTECT.DLL" at base 70940000 "tmphw_c8oz1.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 708c0000 "tmphw_c8oz1.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75ed0000 "tmphw_c8oz1.exe" loaded module "CRYPT32.DLL" at base 7646000046:T440,"tmphw_c8oz1.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,insd dword ptr es:[edi], dx,outsd dx, dword ptr [esi],outsd dx, dword ptr [esi],insd dword ptr es:[edi], dx,cmp byte ptr [edx], dh,xor eax, 0x2010000,add eax, dword ptr [eax + 0x9080706],or cl, byte ptr [ebx],or al, 0xd,push cs,movups xmm2, xmmword ptr [ecx],adc dl, byte ptr [ebx],adc al, 0x15,push ss,pop ss,sbb byte ptr [ecx], bl,sbb bl, byte ptr [ebx],sbb al, 0x1d,push ds,pop ds,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"47:Tbd6,Process "msedge.exe" (UID: 00000000-00004380) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A"" Process "msedge.exe" (UID: 00000000-00004380) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00008112) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_4380_VXPGRMLPTFNBGZNT", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="4380"" Process "msedge.exe" (UID: 00000000-00008656) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="12", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00006732) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), NODE_PATH, CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, DriverData, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "identity_helper.exe" (UID: 00000000-00007684) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="DESKTOP-FVVF82A", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="12", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="%OSUSER%", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", NODE_PATH="%PROGRAMFILES%\nodejs\node_modules", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", DriverData="%WINDIR%\System32\Drivers\DriverData", OS="Windows_NT", COMPUTERNAME="DESKTOP-FVVF82A", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\%OSUSER%", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753""48:T101f,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00008528-00000C2E-1095253438] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00008528-00000C2B-1197188315] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00008528-00000C2B-1197282896] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00008528-00000C2B-1197344368] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\ef4992f14ba62dc115c01e7a6018e263\mscorlib.ni.dll" [Source: 00000000-00008528-00000C2B-1197631221] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00008528-00000C2B-1197658746] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00008528-00000C2B-1197712387] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00008528-00000C2B-1197801801] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\67186481d97828a572bf5db055f4a9f1\System.ni.dll" [Source: 00000000-00008528-00000C2B-1197888725] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00008528-00000C2B-1198292283] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00008528-00000C2B-1198456516] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\c20afd70aeb352395f8f5297a727f0ba\System.Core.ni.dll" [Source: 00000000-00008528-00000C2B-1199575816] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\0fc458e2e89a1743b9bb2c58049a8f4f\System.Configuration.ni.dll" [Source: 00000000-00008528-00000C2B-1199607177] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\416015a614fb5f5c53cd9ccbf0e5e13f\System.Xml.ni.dll" [Source: 00000000-00008528-00000C2B-1199683078] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00008528-00000C2B-1199854662] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00008528-00000C2B-1199960137] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" [Source: 00000000-00008528-00000C2B-1200101725] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00008528-00000C2B-1200368250] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" [Source: 00000000-00008528-00000C2B-1200441660] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" [Source: 00000000-00008528-00000C2B-1200676920] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" [Source: 00000000-00008528-00000C2B-1201120901] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00008528-00000C2B-1201558111] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00008528-00000C2B-1201602889] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00008528-00000C2B-1201870526] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00008528-00000C2B-1202130902]49:T848,Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00004380) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00008112), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00008656), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00007572), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00006732), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00009024), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00007524), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00009196), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00001388), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00007684), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00006264), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00007936), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00000008), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=audio.mojom.AudioService --lan ..." (UID: 00000000-00007824), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=PooledProcess2 --lang=en-US -- ..." (UID: 00000000-00005108)4a:T848,Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00004380) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00008112), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00008656), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00007572), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00006732), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00009024), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00007524), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00009196), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00001388), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00007684), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00006264), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00007936), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00000008), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=audio.mojom.AudioService --lan ..." (UID: 00000000-00007824), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=PooledProcess2 --lang=en-US -- ..." (UID: 00000000-00005108)4b:T113a,The input sample is signed with a certificate issued by "CN=Certainly Intermediate R1, O=Certainly, C=US" (SHA1: 51:BB:DC:CC:A4:BD:EF:2B:5B:0D:40:06:07:AB:7F:EF:3E:B7:23:81; see report for more information) The input sample is signed with a certificate issued by "CN=Starfield Root Certificate Authority - G2, O="Starfield Technologies Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: FE:DE:A3:AA:3B:69:BF:9B:84:DB:1F:BE:46:85:5A:F9:90:ED:BD:B1; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon RSA 2048 M01, O=Amazon, C=US" (SHA1: 48:06:96:AE:DD:7B:81:79:BD:B9:31:65:8A:23:25:B5:03:73:39:D3; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon Root CA 1, O=Amazon, C=US" (SHA1: 2A:D9:74:A7:75:F7:3C:BD:BB:D8:F5:AC:3A:49:25:5F:A8:FB:1F:8C; see report for more information) The input sample is signed with a certificate issued by "CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 06:B2:59:27:C4:2A:72:16:31:C1:EF:D9:43:1E:64:8F:A6:2E:1E:39; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: 76:7A:3B:FA:D0:F8:92:94:22:AC:46:9B:F5:92:44:E3:9B:62:43:32; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 4D:9A:CB:31:3D:73:DA:2E:9E:B4:51:A7:CF:63:09:AF:45:C9:93:C1; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon RSA 2048 M01, O=Amazon, C=US" (SHA1: 81:B2:35:3F:0B:BE:8D:AD:85:E2:F3:1E:10:CE:C1:01:D2:68:D5:F3; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US" (SHA1: 9C:FF:31:B5:1D:22:B9:BF:D3:80:8A:8C:35:B4:BB:DF:36:13:71:F0; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: 27:E6:66:32:99:D3:40:DF:E5:45:71:CE:CC:EC:01:BE:74:49:5D:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 04, O=Microsoft Corporation, C=US" (SHA1: C3:07:62:86:89:F9:51:F8:BA:05:51:2E:C5:2A:DF:E1:FF:EF:90:90; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US" (SHA1: DA:6D:04:00:64:1B:45:AE:CC:59:5D:24:E5:03:7A:A6:BC:09:C3:58; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G3 TLS ECC SHA384 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 8C:3F:A5:74:CB:50:76:53:00:E4:24:A1:F7:7C:85:30:87:4F:8E:4D; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 95:77:F9:1F:E8:6C:27:D9:91:21:29:73:0E:81:66:37:3F:C2:EE:B8; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 RSA CA OCSP 04, O=Microsoft Corporation, C=US" (SHA1: A7:48:54:6D:5A:98:FA:2D:C8:97:69:39:C8:CA:D3:5D:AB:D0:2F:31; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon RSA 2048 S25, O=Amazon, C=US" (SHA1: 5C:73:74:1D:FA:25:9D:EE:33:68:06:37:56:53:9B:BA:BA:B1:17:6D; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon Root CA 1, O=Amazon, C=US" (SHA1: EE:B1:C6:9B:3D:25:F3:15:4B:42:37:3C:B4:5C:19:5D:AA:98:00:27; see report for more information)4c:T4fc,"GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: duo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: atlasofsecurity.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image"4d:T405,"tmphw_c8oz1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "tmphw_c8oz1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "tmphw_c8oz1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "tmphw_c8oz1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "tmphw_c8oz1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "tmphw_c8oz1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "tmphw_c8oz1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "tmphw_c8oz1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "")4e:T8d0,"tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2026"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")4f:T461,"tmphw_c8oz1.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "tmphw_c8oz1.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\45cef8929f7918524d50f1f75c04b1c3\mscorlib.ni.dll.aux" "tmphw_c8oz1.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\ef4992f14ba62dc115c01e7a6018e263\mscorlib.ni.dll.aux" "tmphw_c8oz1.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\67186481d97828a572bf5db055f4a9f1\system.ni.dll.aux" "tmphw_c8oz1.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\0fc458e2e89a1743b9bb2c58049a8f4f\system.configuration.ni.dll.aux" "tmphw_c8oz1.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\bcf904b37e30108d3d330423a4a98235\system.core.ni.dll.aux" "tmphw_c8oz1.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\c20afd70aeb352395f8f5297a727f0ba\system.core.ni.dll.aux" "tmphw_c8oz1.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\416015a614fb5f5c53cd9ccbf0e5e13f\system.xml.ni.dll.aux"50:T5d9,"tmphw_c8oz1.exe" trying to access non-existent file "C:\Windows\System32\wow64log.dll" "tmphw_c8oz1.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "tmphw_c8oz1.exe" trying to access non-existent file "C:\FLTLIB.DLL" "tmphw_c8oz1.exe" trying to access non-existent file "C:\MSVCP140.dll" "tmphw_c8oz1.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "tmphw_c8oz1.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "tmphw_c8oz1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "tmphw_c8oz1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "tmphw_c8oz1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "tmphw_c8oz1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "tmphw_c8oz1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "tmphw_c8oz1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "tmphw_c8oz1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "tmphw_c8oz1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "tmphw_c8oz1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll"51:T4fa,"tmphw_c8oz1.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.local" "tmphw_c8oz1.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\MSCOREE.DLL.local" "tmphw_c8oz1.exe" trying to access non-existent file "C:\tmphw_c8oz1.exe.config" "tmphw_c8oz1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "tmphw_c8oz1.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\xeno rat client" "tmphw_c8oz1.exe" trying to access non-existent file "C:\tmphw_c8oz1.INI" "tmphw_c8oz1.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PublisherPolicy.tme" "tmphw_c8oz1.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui" "tmphw_c8oz1.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}" "tmphw_c8oz1.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\tzres.dll.mui" "tmphw_c8oz1.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\en-US\tzres.dll.mui" "tmphw_c8oz1.exe" trying to access non-existent file "C:\Windows\SysWOW64\en\tzres.dll.mui" "tmphw_c8oz1.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\en\tzres.dll.mui"52:T56b,Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Connected" in "tmphw_c8oz1.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_NoDelay" in "tmphw_c8oz1.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_ReceiveTimeout" in "tmphw_c8oz1.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "tmphw_c8oz1.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_RemoteEndPoint" in "tmphw_c8oz1.exe" Observed Namespace "System.Net.Sockets.SocketTaskExtensions" and MemberReference "ConnectAsync" in "tmphw_c8oz1.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginDisconnect" in "tmphw_c8oz1.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndDisconnect" in "tmphw_c8oz1.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Close" in "tmphw_c8oz1.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Dispose" in "tmphw_c8oz1.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Available" in "tmphw_c8oz1.exe" Observed Namespace "System.Net.Sockets.SocketTaskExtensions" and MemberReference "ReceiveAsync" in "tmphw_c8oz1.exe" Observed Namespace "System.Net.Sockets.SocketTaskExtensions" and MemberReference "SendAsync" in "tmphw_c8oz1.exe"53:T728c,Found URL "http://rr88vipa.comhttps://rr88vipa.comhttp://www.rr88vipa.comhttps://www.rr88vipa.comhttp://c2.rr88vipa.comhttps://c2.rr88vipa.comhttp://backdoor.rr88vipa.comhttps://backdoor.rr88vipa.com456jscj5rtdrzwxanothingsetplugin.main-admin%\xenomanager\xenoupdatemanager[c2" - Source: "00000000-00008528.00000000.148489.02FB0000.00000004.mdmp") Found URL "http://rr88vipa.comdownloadstringmaxdatasizetracemodesystem.netsystem.net.httplistenersystem.net.socketssystem.net.websocketssystem.net.cachesystem.net.httpsystem.configuration.internal.configurationmanagerinternal," - Source: "00000000-00008528.00000000.148489.02FB0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00008528.00000000.148489.02FB0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00008528.00000000.148489.02FB0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00008528.00000000.148489.02FB0000.00000004.mdmp") Found URL "https://rr88vipa.comhttps://rr88vipa.comhttp://rr88vipa.comystem.core," - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://rr88vipa.comhttp://rr88vipa.comhttp://rr88vipa.comystem.xml," - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "https://rr88vipa.comhttps://rr88vipa.cominsta0\default24k8upsaystringssspku2umphw_c8oz1.exe:\windows\microsoft.net\framework\v4.0.30319\clrjit.dll:\windows\microsoft.net\assembly\gac_msil\system\v4.0_4.0.0.0__b77a5c561934e089\system.dll:\windows\system32\rasapi32.dll:\windows\system32\cryptbase.dll:\windows\system32\fwpuclnt.dllecurity=impersonation" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://www.rr88vipa.comx962p239v3ecdhcryptoidinfoeccparametersx962p256v1ecdhcryptoidinfoeccparametershttp://www.rr88vipa.comx962p239v3ecdsacryptoidinfoeccparametershttp://www.rr88vipa.comhttps://www.rr88vipa.comhttp://c2.rr88vipa.comhttps://www.rr88vipa.comx962p239v2ecdsacryptoidinfoeccparametershttps://www.rr88vipa.comhttps://c2.rr88vipa.comhttps://c2.rr88vipa.comhttp://www.rr88vipa.comhttps://c2.rr88vipa.comhttp://c2.rr88vipa.comhttp://www.rr88vipa.comx962p239v2ecdhcryptoidinfoeccparametershttps://c2.rr88vipa.comhttps://www.rr88vipa.comhttps://c2.rr88vipa.comhttp://www.rr88vipa.comx962p256v1ecdsacryptoidinfoeccparametershttp://c2.rr88vipa.comx962p192v1ecdhcryptoidinfoeccparametersx962p239v1ecdsacryptoidinfoeccparameterssecp256r1ecdhcryptoidinfoeccparametersx962p192v3ecdsacryptoidinfoeccparametersx962p192v2ecdsacryptoidinfoeccparametersicrosoft" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://c2.rr88vipa.comhttps://c2.rr88vipa.comhttps://c2.rr88vipa.comhttp://www.rr88vipa.comhttp://www.rr88vipa.comhttps://c2.rr88vipa.comhttp://c2.rr88vipa.comreview" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "https://backdoor.rr88vipa.combrainpoolp512t1ecdsacryptoidinfoeccparametershttp://backdoor.rr88vipa.comhttps://backdoor.rr88vipa.comhttp://backdoor.rr88vipa.combrainpoolp512t1ecdhcryptoidinfoeccparametershttps://backdoor.rr88vipa.comhttp://backdoor.rr88vipa.comhttps://backdoor.rr88vipa.comhttps://backdoor.rr88vipa.comhttp://backdoor.rr88vipa.combackdoor.rr88vipa.comhttp://rr88vipa.comhttps://rr88vipa.combackdoor.rr88vipa.comhttp://rr88vipa.comhttp://rr88vipa.comsecp521r1ecdhcryptoidinfoeccparametershttps://rr88vipa.comsecp521r1ecdsacryptoidinfoeccparametersinrules_autoupdate_1http://rr88vipa.comhttps://rr88vipa.comhttps://rr88vipa.comhttps://rr88vipa.comlatform" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://crl.r2s25.amazontrust.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0yf!%l" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://crl.r2s25.amazontrust.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0var&^uel(.%ux?" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcsi" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.0q" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.html^" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j/www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0<'jy1.3.36.3.3.2.8.1.1.14@eckph3y0w'q<@2" - Source: "00000000-00008528.00000001.150411.00D80000.00000004.mdmp") Found URL "http://rr88vipa.comhttps://rr88vipa.comhttp://www.rr88vipa.comhttps://www.rr88vipa.comhttp://c2.rr88vipa.comhttps://c2.rr88vipa.comhttp://backdoor.rr88vipa.comhttps://backdoor.rr88vipa.com456jscj5rtdrzwxanothingsetplugin.main[c2" - Source: "00000000-00008528.00000001.150411.02FB0000.00000004.mdmp") Found URL "http://backdoor.rr88vipa.com]" - Source: "00000000-00008528.00000001.150411.02FB0000.00000004.mdmp") Found URL "https://backdoor.rr88vipa.com]" - Source: "00000000-00008528.00000001.150411.02FB0000.00000004.mdmp") Found URL "http://rr88vipa.comdownloadstringmaxdatasizetracemodesystem.netsystem.net.httplistenersystem.net.socketssystem.net.websocketssystem.net.cachesystem.net.httpsystem.configuration.internal.configurationmanagerinternal," - Source: "00000000-00008528.00000001.150411.02FB0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00008528.00000001.150411.02FB0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00008528.00000001.150411.02FB0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00008528.00000001.150411.02FB0000.00000004.mdmp") Found URL "https://backdoor.rr88vipa.comhttp://backdoor.rr88vipa.comhttp://backdoor.rr88vipa.comhttps://backdoor.rr88vipa.comentrusttrustcdsa/sha384cdsa/sha384ntrust" - Source: "00000000-00008528.00000001.150411.06490000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00008528.00000001.150411.06490000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?8" - Source: "00000000-00008528.00000001.150411.06490000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00008528.00000001.150411.06490000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00008528.00000001.150411.06490000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00008528.00000001.150411.06490000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008528.00000001.150411.06490000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00008528.00000001.150411.06490000.00000004.mdmp") Found URL "http://rr88vipa.comhttps://rr88vipa.comhttps://rr88vipa.comhttp://rr88vipa.comystem.core," - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "https://rr88vipa.comhttp://rr88vipa.comhttp://rr88vipa.comhttp://rr88vipa.comystem.xml," - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "https://rr88vipa.comhttps://rr88vipa.cominsta0\default24k8upsaystringssspku2umphw_c8oz1.exe:\windows\microsoft.net\framework\v4.0.30319\clrjit.dll:\windows\microsoft.net\assembly\gac_msil\system\v4.0_4.0.0.0__b77a5c561934e089\system.dll:\windows\system32\rasapi32.dll:\windows\system32\cryptbase.dll:\windows\system32\fwpuclnt.dllecurity=impersonation" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "https://c2.rr88vipa.comhttp://www.rr88vipa.comx962p239v3ecdhcryptoidinfoeccparametersx962p256v1ecdhcryptoidinfoeccparametershttp://c2.rr88vipa.comx962p239v3ecdsacryptoidinfoeccparametershttp://www.rr88vipa.comhttp://www.rr88vipa.comhttp://c2.rr88vipa.comhttp://c2.rr88vipa.comx962p239v2ecdsacryptoidinfoeccparametershttps://c2.rr88vipa.comhttps://c2.rr88vipa.comhttp://www.rr88vipa.comhttp://www.rr88vipa.comhttp://c2.rr88vipa.comhttps://c2.rr88vipa.comhttp://www.rr88vipa.comx962p239v2ecdhcryptoidinfoeccparametershttps://www.rr88vipa.comhttp://www.rr88vipa.comhttps://www.rr88vipa.comhttp://www.rr88vipa.comx962p256v1ecdsacryptoidinfoeccparametershttps://c2.rr88vipa.comhttp://c2.rr88vipa.comx962p192v1ecdhcryptoidinfoeccparametersx962p239v1ecdsacryptoidinfoeccparameterssecp256r1ecdhcryptoidinfoeccparametersx962p192v3ecdsacryptoidinfoeccparametersx962p192v2ecdsacryptoidinfoeccparametersicrosoft" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "https://c2.rr88vipa.comhttps://c2.rr88vipa.comhttps://c2.rr88vipa.comhttp://www.rr88vipa.comhttp://c2.rr88vipa.comhttps://c2.rr88vipa.comhttp://www.rr88vipa.comreview" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "https://backdoor.rr88vipa.comhttp://backdoor.rr88vipa.combrainpoolp512t1ecdsacryptoidinfoeccparametershttps://backdoor.rr88vipa.comhttps://backdoor.rr88vipa.comhttp://backdoor.rr88vipa.comhttps://backdoor.rr88vipa.comhttp://backdoor.rr88vipa.combrainpoolp512t1ecdhcryptoidinfoeccparametershttp://backdoor.rr88vipa.comhttp://backdoor.rr88vipa.comhttps://backdoor.rr88vipa.comhttps://backdoor.rr88vipa.comhttps://backdoor.rr88vipa.comhttp://backdoor.rr88vipa.combackdoor.rr88vipa.comhttp://rr88vipa.comhttp://rr88vipa.comhttps://rr88vipa.comhttps://rr88vipa.comhttps://rr88vipa.comhttp://rr88vipa.comhttp://rr88vipa.comhttp://rr88vipa.comsecp521r1ecdhcryptoidinfoeccparametershttp://rr88vipa.comhttps://rr88vipa.comsecp521r1ecdsacryptoidinfoeccparametersinrules_autoupdate_1http://rr88vipa.comhttps://rr88vipa.comhttps://rr88vipa.comhttps://rr88vipa.comhttps://rr88vipa.comhttps://rr88vipa.comlatform" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "http://crl.r2s25.amazontrust.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0var&^uel(.%ux?" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "http://crl.r2s25.amazontrust.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0yf!%l" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcsi" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.0q" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.html^" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j/www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00008528.00000002.152332.00D80000.00000004.mdmp") Found URL "http://rr88vipa.comhttps://rr88vipa.comhttp://www.rr88vipa.comhttps://www.rr88vipa.comhttp://c2.rr88vipa.comhttps://c2.rr88vipa.comhttp://backdoor.rr88vipa.comhttps://backdoor.rr88vipa.com456jscj5rtdrzwxanothingsetplugin.main[c2" - Source: "00000000-00008528.00000002.152332.02FB0000.00000004.mdmp") Found URL "http://backdoor.rr88vipa.com]" - Source: "00000000-00008528.00000002.152332.02FB0000.00000004.mdmp") Found URL "https://backdoor.rr88vipa.com]" - Source: "00000000-00008528.00000002.152332.02FB0000.00000004.mdmp") Found URL "http://rr88vipa.comdownloadstringmaxdatasizetracemodesystem.netsystem.net.httplistenersystem.net.socketssystem.net.websocketssystem.net.cachesystem.net.httpsystem.configuration.internal.configurationmanagerinternal," - Source: "00000000-00008528.00000002.152332.02FB0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00008528.00000002.152332.02FB0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00008528.00000002.152332.02FB0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00008528.00000002.152332.02FB0000.00000004.mdmp") Found URL "https://backdoor.rr88vipa.comhttp://backdoor.rr88vipa.comhttps://backdoor.rr88vipa.comhttp://backdoor.rr88vipa.comhttps://backdoor.rr88vipa.comhttps://backdoor.rr88vipa.comentrusttrustcdsa/sha384cdsa/sha384ntrust" - Source: "00000000-00008528.00000002.152332.06490000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00008528.00000002.152332.06490000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?8" - Source: "00000000-00008528.00000002.152332.06490000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00008528.00000002.152332.06490000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00008528.00000002.152332.06490000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00008528.00000002.152332.06490000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008528.00000002.152332.06490000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00008528.00000002.152332.06490000.00000004.mdmp")54:T2011,GET / HTTP/1.1 Host: rr88vipa.com Connection: Keep-Alive GET / HTTP/1.1 Host: www.rr88vipa.com Connection: Keep-Alive GET /.well-known/windows-app-web-link HTTP/2 Host: m365.cloud.microsoft Accept-Encoding: gzip deflate GET /m365mobile/5mttl/desktop/windows/weblink/windows-app-web-link.json HTTP/2 Host: res.public.onecdn.static.microsoft Accept-Encoding: gzip deflate GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: arxiv.org User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: duo.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=driveteslacanada.ca?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=chatsports.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=theshopmag.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=techannouncer.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=evchargingstations.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=miamisportswire.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon?url=menafn.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: atlasofsecurity.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.synqly.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.cisco.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image 55:T5ed,Found HTTPS GET request to https://m365.cloud.microsoft/.well-known/windows-app-web-link Found HTTPS GET request to https://res.public.onecdn.static.microsoft/m365mobile/5mttl/desktop/windows/weblink/windows-app-web-link.json Found HTTPS GET request to https://arxiv.org/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://duo.com/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=driveteslacanada.ca?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=chatsports.com?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=theshopmag.com?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=techannouncer.com?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=evchargingstations.com?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=miamisportswire.com?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://services.bingapis.com/favicon?url=menafn.com?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://atlasofsecurity.com/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://www.synqly.com/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t Found HTTPS GET request to https://www.cisco.com/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t56:T9b4,"tmphw_c8oz1.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00008528) "tmphw_c8oz1.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00008528)57:T68e,Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00008528.00000000.148489.00D80000.00000004.mdmp, 00000000-00008528.00000000.148489.02FB0000.00000004.mdmp, 00000000-00008528.00000001.150411.00D80000.00000004.mdmp, 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.00D80000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00008528.00000000.148489.02FB0000.00000004.mdmp, 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00008528.00000000.148489.02FB0000.00000004.mdmp, 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00008528.00000000.148489.02FB0000.00000004.mdmp, 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00008528.00000000.148489.02FB0000.00000004.mdmp, 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00008528.00000000.148489.02FB0000.00000004.mdmp, 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp")58:T52b,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00008528.00000000.148489.00D70000.00000004.mdmp, 00000000-00008528.00000000.148489.00D80000.00000004.mdmp, 00000000-00008528.00000000.148489.02B20000.00000004.mdmp, 00000000-00008528.00000001.150411.00D80000.00000004.mdmp, 00000000-00008528.00000001.150411.02B20000.00000004.mdmp, 00000000-00008528.00000002.152332.00D80000.00000004.mdmp, 00000000-00008528.00000002.152332.02B20000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00008528.00000000.148489.00D70000.00000004.mdmp, 00000000-00008528.00000000.148489.00D80000.00000004.mdmp, 00000000-00008528.00000000.148489.02B20000.00000004.mdmp, 00000000-00008528.00000001.150411.00D80000.00000004.mdmp, 00000000-00008528.00000001.150411.02B20000.00000004.mdmp, 00000000-00008528.00000002.152332.00D80000.00000004.mdmp, 00000000-00008528.00000002.152332.02B20000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00008528.00000000.148489.00D80000.00000004.mdmp, 00000000-00008528.00000001.150411.00D80000.00000004.mdmp, 00000000-00008528.00000002.152332.00D80000.00000004.mdmp")59:T9b3,"tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\RASMAN\PARAMETERS"; Key: "FORCECMDLOWERCASE"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "tmphw_c8oz1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")5a:T98c,"tmphw_c8oz1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "tmphw_c8oz1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\TMPHW_C8OZ1_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "tmphw_c8oz1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\TMPHW_C8OZ1_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "tmphw_c8oz1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\TMPHW_C8OZ1_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "tmphw_c8oz1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\TMPHW_C8OZ1_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "tmphw_c8oz1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\TMPHW_C8OZ1_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "tmphw_c8oz1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\TMPHW_C8OZ1_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "tmphw_c8oz1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\TMPHW_C8OZ1_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "tmphw_c8oz1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\TMPHW_C8OZ1_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "tmphw_c8oz1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\TMPHW_C8OZ1_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "tmphw_c8oz1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\TMPHW_C8OZ1_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "tmphw_c8oz1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\TMPHW_C8OZ1_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "tmphw_c8oz1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\TMPHW_C8OZ1_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "tmphw_c8oz1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\TMPHW_C8OZ1_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "tmphw_c8oz1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\TMPHW_C8OZ1_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing")5b:T534,Found string "LocalAlloc" (Source: tmphw_c8oz1.exe, API is part of module: KERNELBASE.DLL) Found string "GetWindowThreadProcessId" (Source: tmphw_c8oz1.exe, API is part of module: USER32.DLL) Found string "LocalFree" (Source: tmphw_c8oz1.exe, API is part of module: KERNELBASE.DLL) Found string "CloseHandle" (Source: tmphw_c8oz1.exe, API is part of module: KERNELBASE.DLL) Found string "RtlGetCompressionWorkSpaceSize" (Source: tmphw_c8oz1.exe, API is part of module: NTDLL.DLL) Found string "IsUserAnAdmin" (Source: tmphw_c8oz1.exe, API is part of module: WINDOWS.STORAGE.DLL) Found string "GetLastInputInfo" (Source: tmphw_c8oz1.exe, API is part of module: USER32.DLL) Found string "Sleep" (Source: tmphw_c8oz1.exe, API is part of module: KERNELBASE.DLL) Found string "memcmp" (Source: tmphw_c8oz1.exe, API is part of module: VCRUNTIME140_CLR0400.DLL) Found string "RtlCompressBuffer" (Source: tmphw_c8oz1.exe, API is part of module: NTDLL.DLL) Found string "RtlDecompressBuffer" (Source: tmphw_c8oz1.exe, API is part of module: NTDLL.DLL) Found string "GetCurrentProcess" (Source: tmphw_c8oz1.exe, API is part of module: KERNELBASE.DLL) Found string "socket" (Source: tmphw_c8oz1.exe, API is part of module: WS2_32.DLL) Found string "GetForegroundWindow" (Source: tmphw_c8oz1.exe, API is part of module: USER32.DLL)5c:Ta0e,"tmphw_c8oz1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "tmphw_c8oz1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "tmphw_c8oz1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "tmphw_c8oz1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "tmphw_c8oz1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "tmphw_c8oz1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "tmphw_c8oz1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "tmphw_c8oz1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "tmphw_c8oz1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "tmphw_c8oz1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "tmphw_c8oz1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "tmphw_c8oz1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "tmphw_c8oz1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "tmphw_c8oz1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "tmphw_c8oz1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "tmphw_c8oz1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "tmphw_c8oz1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "tmphw_c8oz1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "tmphw_c8oz1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "tmphw_c8oz1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "tmphw_c8oz1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "tmphw_c8oz1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794312274892,"unified_at":"2026-11-10T12:04:34.892Z","metadata":{"hashes":{"sha256":"70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","sha1":"8c5f8b5b542f38351d78bedbddbb944716d9e4fb","md5":"bb3a2a63c803a94f3ce25ee514a54ff8","sha512":"b35216103d1d9a0b02daf72deae56163a8e27da7053574b5d7d2858c0d25112dbb5f282d0ff7e79339d03cee28f351d5d22ae451a5bd7a44116753e691509a7f","ssdeep":"768:ydHjiYXYojwYybbZWsiBHUuS7DrUjQzShr4sjZ5ebuz+UOfX2z:yxxKz3ZWsiBHUumDrUPrX5ebuXO8","ssdeep_chunks":["768:ydHjiYX","768:dHjiYXY","768:HjiYXYo","768:jiYXYoj","768:iYXYojw","768:YXYojwY","768:XYojwYy","768:YojwYyb","768:ojwYybb","768:jwYybbZ","768:wYybbZW","768:YybbZWs","768:ybbZWsi","768:bbZWsiB","768:bZWsiBH","768:ZWsiBHU","768:WsiBHUu","768:siBHUuS","768:iBHUuS7","768:BHUuS7D","768:HUuS7Dr","768:UuS7DrU","768:uS7DrUj","768:S7DrUjQ","768:7DrUjQz","768:DrUjQzS","768:rUjQzSh","768:UjQzShr","768:jQzShr4","768:QzShr4s","768:zShr4sj","768:Shr4sjZ","768:hr4sjZ5","768:r4sjZ5e","768:4sjZ5eb","768:sjZ5ebu","768:jZ5ebuz","768:Z5ebuz+","768:5ebuz+U","768:ebuz+UO","768:buz+UOf","768:uz+UOfX","768:z+UOfX2","768:+UOfX2z","1536:ydHjiYX","1536:dHjiYXY","1536:HjiYXYo","1536:jiYXYoj","1536:iYXYojw","1536:YXYojwY","1536:XYojwYy","1536:YojwYyb","1536:ojwYybb","1536:jwYybbZ","1536:wYybbZW","1536:YybbZWs","1536:ybbZWsi","1536:bbZWsiB","1536:bZWsiBH","1536:ZWsiBHU","1536:WsiBHUu","1536:siBHUuS","1536:iBHUuS7","1536:BHUuS7D","1536:HUuS7Dr","1536:UuS7DrU","1536:uS7DrUj","1536:S7DrUjQ","1536:7DrUjQz","1536:DrUjQzS","1536:rUjQzSh","1536:UjQzShr","1536:jQzShr4","1536:QzShr4s","1536:zShr4sj","1536:Shr4sjZ","1536:hr4sjZ5","1536:r4sjZ5e","1536:4sjZ5eb","1536:sjZ5ebu","1536:jZ5ebuz","1536:Z5ebuz+","1536:5ebuz+U","1536:ebuz+UO","1536:buz+UOf","1536:uz+UOfX","1536:z+UOfX2","1536:+UOfX2z","768:yxxKz3Z","768:xxKz3ZW","768:xKz3ZWs","768:Kz3ZWsi","768:z3ZWsiB","768:3ZWsiBH","768:siBHUum","768:iBHUumD","768:BHUumDr","768:HUumDrU","768:UumDrUP","768:umDrUPr","768:mDrUPrX","768:DrUPrX5","768:rUPrX5e","768:UPrX5eb","768:PrX5ebu","768:rX5ebuX","768:X5ebuXO","768:5ebuXO8"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"tmphw_c8oz1.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":47616,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794311781000,"last_seen":1794311781000,"last_multi_scan":1794311781000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","modular","rat","ddos","informationstealer","keylogger","quasar","njratlime","opensource","targeted","criminal","asyncrat","ransomware","suspicious","evasive","new_domain"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":65},"sandbox_signatures":{"informative_count":166,"suspicious_count":10,"malicious_count":9,"total":185},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.XenoRAT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/MSIL.XenoRat","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"BDS/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Application.Barys.66003","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Msilzilla-10023780-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Agent.WNX trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.dd!ni","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Agent.dj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005b11ae1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_reference_anti_VM_strings_targeting_Xen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/RAT-C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.DN-Xeno.47616.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"XenoRAT!BB3A2A63C803","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.HCQ.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Capa_reference_anti_VM_strings_targeting_Xen","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":".NET code is able to query registry"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Able to execute applications using .NET process API"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Contains ability to communicates via socket (possible C&C communication)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Contains symmetric decryption functionality in .NET code"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Stealth","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"informative","value":"Contains strings related to Xeno RAT remote access tool"},{"type":"malicious","value":"Known malware detected"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to perform AES cryptographic operations (Dotnet)"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Contains ability to perform CryptoStream operations (Dotnet)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Able to execute applications in hidden mode (.NET)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Contains ability to compress/decompress buffers (API string)"},{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve user privileges"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Reconnaissance","technique":"Vulnerability Scanning","attack_id":"T1595.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1595/002","identifiers":[{"type":"informative","value":"Detected User Agent or request patterns of known vulnerability scanning tools"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"malicious","value":"Recently registered domain detected"},{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Tries to GET non-existent files from a web server"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"malicious","value":"Detected multiple DNS responses with a low TTL"},{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate via sockets (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download files with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$36","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$37","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM AntivirusProduct\" (Source: sample.bin, Indicator: \"select * from antivirusproduct\"), \"SELECT * FROM Win32_OperatingSystem\" (Source: sample.bin, Indicator: \"select * from win32_operatingsystem\")","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1620","id":"string-615","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"GetAntivirus\" (Indicator: \"antivirus\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-8","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\ToolVT\\XenoRAT-main\\xeno rat client\\obj\\Release\\xeno rat client.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Remote Access Related","name":"Contains strings related to Xeno RAT remote access tool","description":"$38","origin":"sample.bin","mitre_attack_id":"T1219","id":"string-990","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to compress/decompress buffers (API string)","description":"Found reference to API \"RtlDecompressBuffer\" (Indicator: \"RtlDecompressBuffer\"; Source: \"sample.bin\"), Found reference to API \"RtlCompressBuffer\" (Indicator: \"RtlCompressBuffer\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1560.002","id":"string-404","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; Source: \"sample.bin\"), Found reference to \"SymmetricAlgorithm\" (Indicator: \"SymmetricAlgorithm\"; Source: \"sample.bin\"), Found reference to \"CryptoStreamMode\" (Indicator: \"CryptoStream\"; Source: \"sample.bin\"), Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"sample.bin\"), Found reference to \"CryptoStream\" (Indicator: \"CryptoStream\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"CreateEncryptor\" (Indicator: \"createencryptor\"; Source: \"sample.bin\"), Found string \"CreateDecryptor\" (Indicator: \"createdecryptor\"; Source: \"sample.bin\"), Found string \"MD5CryptoServiceProvider\" (Indicator: \"md5cryptoserviceprovider\"; Source: \"sample.bin\"), Found string \"CryptoStreamMode\" (Indicator: \"cryptostream\"; Source: \"sample.bin\"), Found string \"CryptoStreamMode\" (Indicator: \"cryptostreammode\"; Source: \"sample.bin\"), Found string \"FromBase64String\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"sample.bin\"), Found string \"System.Security.Cryptography\" (Indicator: \"System.Security.Cryptography\"; Source: \"sample.bin\"), Found string \"CryptoStream\" (Indicator: \"cryptostream\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentDirectory\" (Indicator: \"GetCurrentDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT * FROM AntivirusProduct\" (Indicator: \"antivirusproduct\"; Source: \"sample.bin\"), Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-507","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsUserAnAdmin\" (Indicator: \"IsUserAnAdmin\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-217","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://c2.rr88vipa.com\", Pattern match: \"http://rr88vipa.com\", Pattern match: \"http://www.rr88vipa.com\", Pattern match: \"https://rr88vipa.com\", Pattern match: \"https://www.rr88vipa.com\", Pattern match: \"http://backdoor.rr88vipa.com\", Pattern match: \"https://c2.rr88vipa.com\", Pattern match: \"https://backdoor.rr88vipa.com\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://rr88vipa.com\", Found HTTPS url \"https://www.rr88vipa.com\", Found HTTPS url \"https://c2.rr88vipa.com\", Found HTTPS url \"https://backdoor.rr88vipa.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-356","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-106","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowTextLength\" (Indicator: \"GetWindowText\"; Source: \"sample.bin\"), Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"sample.bin\"), Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM AntivirusProduct\" (Indicator: \"select * from \"; Source: \"sample.bin\"), Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \"select * from \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-433","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-55","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"Switch.System.IO.Compression.DoNotUseNativeZipLibraryForDecompression\" (Source: \"00000000-00008528.00000000.148489.02FB0000.00000004.mdmp, 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to execute applications in hidden mode (.NET)","description":"Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":7,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"tmphw_c8oz1.exe\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"tmphw_c8oz1.exe\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"SizeOf\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00008528.00000002.152332.00B69000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethod\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"tmphw_c8oz1.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"tmphw_c8oz1.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$39","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$3a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00008528.00000000.148489.02FB0000.00000004.mdmp, 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00008528.00000000.148489.02FB0000.00000004.mdmp, 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES cryptographic operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-167","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-166","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"tmphw_c8oz1.exe\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00008528.00000000.148489.02FB0000.00000004.mdmp, 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00008528.00000000.148489.02FB0000.00000004.mdmp, 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00008528.00000000.148489.00D80000.00000004.mdmp, 00000000-00008528.00000001.150411.00D80000.00000004.mdmp, 00000000-00008528.00000002.152332.00D80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00008528.00000000.148489.02FB0000.00000004.mdmp, 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00008528.00000000.148489.02FB0000.00000004.mdmp, 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00008528.00000001.150411.00D80000.00000004.mdmp, 00000000-00008528.00000002.152332.00D80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains symmetric decryption functionality in .NET code","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$3b","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008528-00000C2C-1198577695\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetCurrentDirectory\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"get_MachineName\" (Source: \"00000000-00008528.00000002.152332.007C2000.00000002.mdmp\")\n Found string \"get_UserName\" (Source: \"00000000-00008528.00000002.152332.007C2000.00000002.mdmp\")\n Found string \"get_OSVersion\" (Source: \"00000000-00008528.00000002.152332.007C2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008528-00000C2C-1198577695\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00008528-00000C2C-1197342465\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00008528-00000C2C-1197343282\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00008528-00000C2C-1200961754\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"sendMessageChannelCache\" (Indicator: \"sendmessage\"; Source: \"00000000-00008528.00000000.148489.02FB0000.00000004.mdmp, 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp\")\n Found reference to API \"System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" (Indicator: \"sendmessage\"; Source: \"00000000-00008528.00000000.148489.02FB0000.00000004.mdmp, 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"tmphw_c8oz1.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00008528)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"tmphw_c8oz1.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00008528)\n \"tmphw_c8oz1.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00008528)\n \"tmphw_c8oz1.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00008528)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"tmphw_c8oz1.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00008528)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"tmphw_c8oz1.exe\" called \"IsWow64Process\" with parameter \"8528\" - (UID: 00000000-00008528)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"tmphw_c8oz1.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008528)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function \"ExpandEnvironmentVariables\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_MachineName\" in \"tmphw_c8oz1.exe\"\n Observed function \"get_UserName\" in \"tmphw_c8oz1.exe\"\n Observed function \"get_OSVersion\" in \"tmphw_c8oz1.exe\"\n Observed function \"get_SystemDirectory\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"tmphw_c8oz1.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve current user details (Dotnet)","description":"Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1033","relevance":1,"id":"static-152","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00008528.00000000.148489.00D80000.00000004.mdmp\n 00000000-00008528.00000001.150411.00D80000.00000004.mdmp\n 00000000-00008528.00000002.152332.00D80000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"tmphw_c8oz1.exe\" queried token user identity (UID: 00000000-00008528)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"tmphw_c8oz1.exe\" queries volume information of \"C:\\tmphw_c8oz1.exe\" at 00000000-00008528-00000C17-1197657441","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"tmphw_c8oz1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"tmphw_c8oz1.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA Applayer Wrong direction first Data\" (SID: 2260001, Rev: 1, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA STREAM ESTABLISHED packet out of window\" (SID: 2210020, Rev: 3, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA STREAM ESTABLISHED invalid ack\" (SID: 2210029, Rev: 3, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA STREAM Packet with invalid ack\" (SID: 2210045, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA STREAM FIN invalid ack\" (SID: 2210030, Rev: 3, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA STREAM FIN out of window\" (SID: 2210038, Rev: 3, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":".NET code is able to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenBaseKey\" in \"tmphw_c8oz1.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"tmphw_c8oz1.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValueNames\" in \"tmphw_c8oz1.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":5,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"set_UseShellExecute\" (Source: \"00000000-00008528.00000002.152332.007C2000.00000002.mdmp\")\n Found string \"ProcessStartInfo\" (Source: \"00000000-00008528.00000002.152332.007C2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$40","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"rr88vipa.com\"\n \"www.rr88vipa.com\"\n \"m365.cloud.microsoft\"\n \"res.public.onecdn.static.microsoft\"\n \"arxiv.org\"\n \"duo.com\"\n \"services.bingapis.com\"\n \"atlasofsecurity.com\"\n \"www.synqly.com\"\n \"www.cisco.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"18.154.132.106:80\"\n \"18.154.132.106:443\"\n \"99.84.160.20:80\"\n \"99.84.160.20:443\"\n \"150.171.74.13:443\"\n \"23.211.177.80:443\"\n \"13.32.241.16:443\"\n \"151.101.131.42:443\"\n \"18.238.55.72:443\"\n \"88.223.87.195:443\"\n \"13.226.94.27:443\"\n \"199.16.172.96:443\"\n \"23.47.201.52:443\"\n \"23.56.109.208:443\"\n \"142.250.72.1:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"tmphw_c8oz1.exe\"\n Observed function \"Process.get_StartInfo\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$41","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"tmphw_c8oz1.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$42","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"tmphw_c8oz1.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"RtlGetCompressionWorkSpaceSize\" in \"tmphw_c8oz1.exe\"\n Observed unmanaged function \"RtlDecompressBuffer\" in \"tmphw_c8oz1.exe\"\n Observed unmanaged function \"RtlCompressBuffer\" in \"tmphw_c8oz1.exe\"\n Observed unmanaged function \"LocalAlloc\" in \"tmphw_c8oz1.exe\"\n Observed unmanaged function \"LocalFree\" in \"tmphw_c8oz1.exe\"\n Observed unmanaged function \"memcmp\" in \"tmphw_c8oz1.exe\"\n Observed unmanaged function \"IsUserAnAdmin\" in \"tmphw_c8oz1.exe\"\n Observed unmanaged function \"GetForegroundWindow\" in \"tmphw_c8oz1.exe\"\n Observed unmanaged function \"GetWindowText\" in \"tmphw_c8oz1.exe\"\n Observed unmanaged function \"GetWindowTextLength\" in \"tmphw_c8oz1.exe\"\n Observed unmanaged function \"GetWindowThreadProcessId\" in \"tmphw_c8oz1.exe\"\n Observed unmanaged function \"GetLastInputInfo\" in \"tmphw_c8oz1.exe\"\n Observed unmanaged function \"CloseHandle\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"YouTube\" (Indicator: \"youtube\"; File: \"screen_6.png\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$43","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$44","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"msedge.exe\" (UID: 00000000-00004380)\n Launches browser \"msedge.exe\" (UID: 00000000-00008112)\n Launches browser \"msedge.exe\" (UID: 00000000-00008656)\n Launches browser \"msedge.exe\" (UID: 00000000-00007572)\n Launches browser \"msedge.exe\" (UID: 00000000-00006732)\n Launches browser \"msedge.exe\" (UID: 00000000-00009024)\n Launches browser \"msedge.exe\" (UID: 00000000-00007524)\n Launches browser \"msedge.exe\" (UID: 00000000-00009196)\n Launches browser \"msedge.exe\" (UID: 00000000-00001388)\n Launches browser \"msedge.exe\" (UID: 00000000-00007936)\n Launches browser \"msedge.exe\" (UID: 00000000-00000008)\n Launches browser \"msedge.exe\" (UID: 00000000-00007824)\n Launches browser \"msedge.exe\" (UID: 00000000-00005108)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$45","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"tmphw_c8oz1.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\ef4992f14ba62dc115c01e7a6018e263\\mscorlib.ni.dll\" at 73070000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"tmphw_c8oz1.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 75170000\n \"tmphw_c8oz1.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75ED0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"tmphw_c8oz1.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 745A0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"tmphw_c8oz1.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76000000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"tmphw_c8oz1.exe\" was detected as \".NET\" and name: \"Library\"\n \"tmphw_c8oz1.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"tmphw_c8oz1.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"tmphw_c8oz1.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"tmphw_c8oz1.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$46","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$47","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"arxiv.org\"\n \"atlasofsecurity.com\"\n \"backdoor.rr88vipa.com\"\n \"c2.rr88vipa.com\"\n \"clients2.googleusercontent.com\"\n \"duo.com\"\n \"edge-consumer-static.azureedge.net\"\n \"ignaonline.com\"\n \"m365.cloud.microsoft\"\n \"prod-streaming-video-msn-com.akamaized.net\"\n \"r.msftstatic.com\"\n \"rr88vipa.com\"\n \"sb.scorecardresearch.com\"\n \"services.bingapis.com\"\n \"www.cisco.com\"\n \"www.rr88vipa.com\"\n \"www.synqly.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"tmphw_c8oz1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"tmphw_c8oz1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"tmphw_c8oz1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$49","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$4a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$4b","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a web server","description":"$4c","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"tmphw_c8oz1.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"tmphw_c8oz1.exe\" queries basic process information of the \"C:\\tmphw_c8oz1.exe\" (UID: 8528)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"tmphw_c8oz1.exe\" called \"NtQueueApcThread\" (UID: 00000000-00008528)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$4f","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"tmphw_c8oz1.exe\" trying to touch file \"C:\\Windows\\System32\\wow64log.dll\"\n \"tmphw_c8oz1.exe\" trying to touch file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"tmphw_c8oz1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mscoree.dll\"\n \"tmphw_c8oz1.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\MSCOREE.DLL\"\n \"tmphw_c8oz1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"tmphw_c8oz1.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\apphelp.dll\"\n \"tmphw_c8oz1.exe\" trying to touch file \"C:\\tmphw_c8oz1.exe\"\n \"tmphw_c8oz1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"tmphw_c8oz1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"tmphw_c8oz1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"tmphw_c8oz1.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$51","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00008528-00000C2C-1200415564\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /\"\n Found http requests in header \"GET /.well-known/windows-app-web-link\"\n Found http requests in header \"GET /m365mobile/5mttl/desktop/windows/weblink/windows-app-web-link.json\"\n Found http requests in header \"GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t\"\n Found http requests in header \"GET /favicon?url=driveteslacanada.ca?w=32&h=32&q=100&m=6&f=webp&u=t\"\n Found http requests in header \"GET /favicon?url=chatsports.com?w=32&h=32&q=100&m=6&f=webp&u=t\"\n Found http requests in header \"GET /favicon?url=theshopmag.com?w=32&h=32&q=100&m=6&f=webp&u=t\"\n Found http requests in header \"GET /favicon?url=techannouncer.com?w=32&h=32&q=100&m=6&f=webp&u=t\"\n Found http requests in header \"GET /favicon?url=evchargingstations.com?w=32&h=32&q=100&m=6&f=webp&u=t\"\n Found http requests in header \"GET /favicon?url=miamisportswire.com?w=32&h=32&q=100&m=6&f=webp&u=t\"\n Found http requests in header \"GET /favicon?url=menafn.com?w=32&h=32&q=100&m=6&f=webp&u=t\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"$52","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00008528-00000C2C-1200415343\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00008528-00000C2C-1200598953\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00008528-00000C2C-1200599017\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"tmphw_c8oz1.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicates via socket (possible C&C communication)","description":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"get_Connected\" in \"tmphw_c8oz1.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"set_ReceiveTimeout\" in \"tmphw_c8oz1.exe\"\n Observed Namespace \"System.Net.Sockets.SocketTaskExtensions\" and MemberReference \"ConnectAsync\" in \"tmphw_c8oz1.exe\"\n Observed Namespace \"System.Net.Sockets.SocketTaskExtensions\" and MemberReference \"ReceiveAsync\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1071","relevance":1,"id":"static-151","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net.Sockets\" in \"tmphw_c8oz1.exe\"\n Observed namespace \"System.Net\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00008528-00000C2C-1200415343\")\n Found reference to API \"A non-blocking socket operation could not be completed immediately.\" (Indicator: \" socket \"; Source: \"00000000-00008528.00000000.148489.02FB0000.00000004.mdmp, 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp\")\n Found reference to API \"A non-blocking socket operation could not be completed immediately\" (Indicator: \" socket \"; Source: \"00000000-00008528.00000000.148489.02FB0000.00000004.mdmp, 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp\")\n Found reference to API \"GetHostByName\" (Indicator: \"gethostbyname\"; Source: \"00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 18.154.132.106 on port 80\n HTTP traffic to 99.84.160.20 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Network Related","name":"Detected User Agent or request patterns of known vulnerability scanning tools","description":"Vulnerability scan URL pattern \"/.well-known/\" requested from \"m365.cloud.microsoft\"","origin":"Network Traffic","mitre_attack_id":"T1595.002","relevance":1,"id":"network-115","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$53","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 301 Moved Permanently\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp\")\n Found string \"GET / HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$54","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"m365.cloud.microsoft\" has high entropy\n Contacted domain: \"services.bingapis.com\" has high entropy\n Contacted domain: \"atlasofsecurity.com\" has high entropy\n Contacted domain: \"backdoor.rr88vipa.com\" has high entropy\n Contacted domain: \"clients2.googleusercontent.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec\n Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"rr88vipa.com\" (0 days old)\n Newly renewed or created SSL certificate: \"www.cisco.com\" (5 days old)\n Newly renewed or created SSL certificate: \"www.rr88vipa.com\" (0 days old)\n Newly renewed or created SSL certificate: \"www.synqly.com\" (7 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$55","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"arxiv.org\" (29 days old)\n Short term registered certificate: \"clients2.googleusercontent.com\" (83 days old)\n Short term registered certificate: \"www.synqly.com\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"18.154.132.106\" on port \"443\"\n HTTPS traffic to \"99.84.160.20\" on port \"443\"\n HTTPS traffic to \"150.171.74.13\" on port \"443\"\n HTTPS traffic to \"23.211.177.80\" on port \"443\"\n HTTPS traffic to \"13.32.241.16\" on port \"443\"\n HTTPS traffic to \"151.101.131.42\" on port \"443\"\n HTTPS traffic to \"18.238.55.72\" on port \"443\"\n HTTPS traffic to \"88.223.87.195\" on port \"443\"\n HTTPS traffic to \"13.226.94.27\" on port \"443\"\n HTTPS traffic to \"199.16.172.96\" on port \"443\"\n HTTPS traffic to \"23.47.201.52\" on port \"443\"\n HTTPS traffic to \"23.56.109.208\" on port \"443\"\n HTTPS traffic to \"142.250.72.1\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEDE2753062930E2897A74BF7B9556]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00008528.00000000.148489.00D80000.00000004.mdmp, 00000000-00008528.00000001.150411.00D80000.00000004.mdmp, 00000000-00008528.00000002.152332.00D80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00008528.00000001.150411.00D80000.00000004.mdmp, 00000000-00008528.00000002.152332.00D80000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SysWOW64\\Kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00008528.00000001.150411.00D80000.00000004.mdmp, 00000000-00008528.00000002.152332.00D80000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00008528.00000001.150411.00D80000.00000004.mdmp, 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.00D80000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00008528.00000001.150411.00D80000.00000004.mdmp, 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.00D80000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--profile-directory=Default\" (Indicator: \"--profile-directory=\"; File: \"msedge.exe\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00008528.00000000.148489.02FB0000.00000004.mdmp, 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp\")\n Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00008528.00000000.148489.02FB0000.00000004.mdmp, 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"GetProcessById\" (Source: \"00000000-00008528.00000002.152332.007C2000.00000002.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00008528.00000002.152332.007C2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$56","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"tmphw_c8oz1.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"tmphw_c8oz1.exe\" called \"GetComputerNameW\" (UID: 00000000-00008528)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"tmphw_c8oz1.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessById\" in \"tmphw_c8oz1.exe\"\n Observed function \"get_ProcessName\" in \"tmphw_c8oz1.exe\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"xeno_rat_client.Utils::IsUserAnAdmin() at bb3a2a63c803a94f3ce25ee514a54ff8-6000047-Utils~IsAdmin","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$57","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"tmphw_c8oz1.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00008528)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$58","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00008528.00000000.148489.02FB0000.00000004.mdmp, 00000000-00008528.00000001.150411.02FB0000.00000004.mdmp, 00000000-00008528.00000002.152332.02FB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00008528-00000C2C-1201167767","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"tmphw_c8oz1.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"tmphw_c8oz1.exe\" opened \"\\Device\\KsecDD\"\n \"msedge.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$59","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$5a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00008528.00000001.150411.06490000.00000004.mdmp, 00000000-00008528.00000002.152332.06490000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"tmphw_c8oz1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"tmphw_c8oz1.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 8528)","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"16/26 Antivirus vendors marked sample as malicious (61% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 18.154.132.106 on port 80 is sent without HTTP header\n TCP traffic to 18.154.132.106 on port 443 is sent without HTTP header\n TCP traffic to 99.84.160.20 on port 80 is sent without HTTP header\n TCP traffic to 99.84.160.20 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"System.Diagnostics.Process::GetProcessById(System.Int32) at bb3a2a63c803a94f3ce25ee514a54ff8-6000046-Utils~GetCaptionOfActiveWindow","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"/favicon?url=miamisportswire.com?w=32&h=32&q=100&m=6&f=webp&u=t\" (Indicator: \"wire.com\"; File: \"PCAP\")\n \".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"tmphw_c8oz1.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$5c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"tmphw_c8oz1.exe\" claims program is from Fri Jul 3 00:02:20 2048","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"16/26 Antivirus vendors marked sample as malicious (61% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"malicious","category":"Network Related","name":"Detected multiple DNS responses with a low TTL","description":"\"arxiv.org\" with TTL 31\n \"atlasofsecurity.com\" with TTL 60\n \"clients2.googleusercontent.com\" with TTL 247\n \"duo.com\" with TTL 60\n \"edge-consumer-static.azureedge.net\" with TTL 7\n \"ignaonline.com\" with TTL 8\n \"m365.cloud.microsoft\" with TTL 3\n \"prod-streaming-video-msn-com.akamaized.net\" with TTL 374\n \"r.msftstatic.com\" with TTL 19\n \"rr88vipa.com\" with TTL 43\n \"sb.scorecardresearch.com\" with TTL 8\n \"www.rr88vipa.com\" with TTL 300\n \"www.synqly.com\" with TTL 30","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":3,"id":"network-35","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"malicious","category":"Network Related","name":"Recently registered domain detected","description":"Recently Registered domain detected: \"rr88vipa.com\" (6 days old). Commonly seen with phishing or other suspicious domains","origin":"Network Traffic","mitre_attack_id":"T1583.001","relevance":10,"id":"network-8601","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_XenoRAT\" matched file \"sample.bin\" as \"Detects Blacksuit\"","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Known malware detected","description":"The sample is known malware – Xeno RAT","origin":"Indicator Combinations","mitre_attack_id":"T1219","relevance":10,"id":"summary-5012","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected multiple DNS responses with a low TTL"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 17 domains and 17 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]}],"intel_graph":{"map":{"Domain:arxiv.org":{"type":"Domain","value":"arxiv.org"},"Domain:atlasofsecurity.com":{"type":"Domain","value":"atlasofsecurity.com"},"Domain:backdoor.rr88vipa.com":{"type":"Domain","value":"backdoor.rr88vipa.com"},"Domain:c2.rr88vipa.com":{"type":"Domain","value":"c2.rr88vipa.com"},"Domain:clients2.googleusercontent.com":{"type":"Domain","value":"clients2.googleusercontent.com"},"Domain:duo.com":{"type":"Domain","value":"duo.com"},"Domain:edge-consumer-static.azureedge.net":{"type":"Domain","value":"edge-consumer-static.azureedge.net"},"Domain:ignaonline.com":{"type":"Domain","value":"ignaonline.com"},"Domain:m365.cloud.microsoft":{"type":"Domain","value":"m365.cloud.microsoft"},"Domain:prod-streaming-video-msn-com.akamaized.net":{"type":"Domain","value":"prod-streaming-video-msn-com.akamaized.net"},"Domain:r.msftstatic.com":{"type":"Domain","value":"r.msftstatic.com"},"Domain:rr88vipa.com":{"type":"Domain","value":"rr88vipa.com"},"Domain:sb.scorecardresearch.com":{"type":"Domain","value":"sb.scorecardresearch.com"},"Domain:services.bingapis.com":{"type":"Domain","value":"services.bingapis.com"},"Domain:www.cisco.com":{"type":"Domain","value":"www.cisco.com"},"Domain:www.rr88vipa.com":{"type":"Domain","value":"www.rr88vipa.com"},"Domain:www.synqly.com":{"type":"Domain","value":"www.synqly.com"},"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0":{"type":"File","value":"70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0"},"Ip:13.226.94.27":{"type":"Ip","value":"13.226.94.27"},"Ip:13.32.241.16":{"type":"Ip","value":"13.32.241.16"},"Ip:142.250.72.1":{"type":"Ip","value":"142.250.72.1"},"Ip:150.171.110.7":{"type":"Ip","value":"150.171.110.7"},"Ip:150.171.27.10":{"type":"Ip","value":"150.171.27.10"},"Ip:150.171.74.13":{"type":"Ip","value":"150.171.74.13"},"Ip:151.101.131.42":{"type":"Ip","value":"151.101.131.42"},"Ip:18.154.132.106":{"type":"Ip","value":"18.154.132.106"},"Ip:18.238.55.72":{"type":"Ip","value":"18.238.55.72"},"Ip:199.16.172.96":{"type":"Ip","value":"199.16.172.96"},"Ip:23.211.177.80":{"type":"Ip","value":"23.211.177.80"},"Ip:23.47.201.52":{"type":"Ip","value":"23.47.201.52"},"Ip:23.56.109.208":{"type":"Ip","value":"23.56.109.208"},"Ip:88.223.87.195":{"type":"Ip","value":"88.223.87.195"},"Ip:99.84.160.20":{"type":"Ip","value":"99.84.160.20"},"Url:/":{"type":"Url","value":"/"},"Url:/.well-known/windows-app-web-link":{"type":"Url","value":"/.well-known/windows-app-web-link"},"Url:/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=chatsports.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=chatsports.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=driveteslacanada.ca?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=driveteslacanada.ca?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=evchargingstations.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=evchargingstations.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=menafn.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=menafn.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=miamisportswire.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=miamisportswire.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=techannouncer.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=techannouncer.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/favicon?url=theshopmag.com?w=32&h=32&q=100&m=6&f=webp&u=t":{"type":"Url","value":"/favicon?url=theshopmag.com?w=32&h=32&q=100&m=6&f=webp&u=t"},"Url:/m365mobile/5mttl/desktop/windows/weblink/windows-app-web-link.json":{"type":"Url","value":"/m365mobile/5mttl/desktop/windows/weblink/windows-app-web-link.json"}},"chains":[{"id":"sandbox_network","root":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","edges":[{"edge_kind":"contacted_ip","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Ip:18.154.132.106"},{"edge_kind":"contacted_ip","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Ip:18.154.132.106"},{"edge_kind":"contacted_ip","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Ip:99.84.160.20"},{"edge_kind":"contacted_ip","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Ip:99.84.160.20"},{"edge_kind":"contacted_ip","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Ip:150.171.74.13"},{"edge_kind":"contacted_ip","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Ip:23.211.177.80"},{"edge_kind":"contacted_ip","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Ip:13.32.241.16"},{"edge_kind":"contacted_ip","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Ip:151.101.131.42"},{"edge_kind":"contacted_ip","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Ip:18.238.55.72"},{"edge_kind":"contacted_ip","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Ip:88.223.87.195"},{"edge_kind":"contacted_ip","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Ip:13.226.94.27"},{"edge_kind":"contacted_ip","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Ip:199.16.172.96"},{"edge_kind":"contacted_ip","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Ip:23.47.201.52"},{"edge_kind":"contacted_ip","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Ip:23.56.109.208"},{"edge_kind":"contacted_ip","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Ip:142.250.72.1"},{"edge_kind":"contacted_domain","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Domain:arxiv.org"},{"edge_kind":"resolves_to","from_key":"Domain:arxiv.org","to_key":"Ip:151.101.131.42"},{"edge_kind":"contacted_domain","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Domain:atlasofsecurity.com"},{"edge_kind":"resolves_to","from_key":"Domain:atlasofsecurity.com","to_key":"Ip:13.226.94.27"},{"edge_kind":"contacted_domain","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Domain:backdoor.rr88vipa.com"},{"edge_kind":"contacted_domain","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Domain:c2.rr88vipa.com"},{"edge_kind":"contacted_domain","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Domain:clients2.googleusercontent.com"},{"edge_kind":"resolves_to","from_key":"Domain:clients2.googleusercontent.com","to_key":"Ip:142.250.72.1"},{"edge_kind":"contacted_domain","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Domain:duo.com"},{"edge_kind":"resolves_to","from_key":"Domain:duo.com","to_key":"Ip:18.238.55.72"},{"edge_kind":"contacted_domain","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Domain:edge-consumer-static.azureedge.net"},{"edge_kind":"resolves_to","from_key":"Domain:edge-consumer-static.azureedge.net","to_key":"Ip:150.171.110.7"},{"edge_kind":"contacted_domain","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Domain:ignaonline.com"},{"edge_kind":"resolves_to","from_key":"Domain:ignaonline.com","to_key":"Ip:88.223.87.195"},{"edge_kind":"contacted_domain","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Domain:m365.cloud.microsoft"},{"edge_kind":"resolves_to","from_key":"Domain:m365.cloud.microsoft","to_key":"Ip:150.171.74.13"},{"edge_kind":"contacted_domain","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Domain:prod-streaming-video-msn-com.akamaized.net"},{"edge_kind":"resolves_to","from_key":"Domain:prod-streaming-video-msn-com.akamaized.net","to_key":"Ip:23.56.109.208"},{"edge_kind":"contacted_domain","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Domain:r.msftstatic.com"},{"edge_kind":"resolves_to","from_key":"Domain:r.msftstatic.com","to_key":"Ip:150.171.27.10"},{"edge_kind":"contacted_domain","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Domain:rr88vipa.com"},{"edge_kind":"resolves_to","from_key":"Domain:rr88vipa.com","to_key":"Ip:18.154.132.106"},{"edge_kind":"contacted_domain","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Domain:sb.scorecardresearch.com"},{"edge_kind":"resolves_to","from_key":"Domain:sb.scorecardresearch.com","to_key":"Ip:13.32.241.16"},{"edge_kind":"contacted_domain","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Domain:services.bingapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:services.bingapis.com","to_key":"Ip:150.171.74.13"},{"edge_kind":"contacted_domain","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Domain:www.cisco.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.cisco.com","to_key":"Ip:23.47.201.52"},{"edge_kind":"contacted_domain","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Domain:www.rr88vipa.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.rr88vipa.com","to_key":"Ip:99.84.160.20"},{"edge_kind":"contacted_domain","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Domain:www.synqly.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.synqly.com","to_key":"Ip:199.16.172.96"},{"edge_kind":"contacted_url","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Url:/"},{"edge_kind":"contacted_url","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Url:/.well-known/windows-app-web-link"},{"edge_kind":"contacted_url","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Url:/m365mobile/5mttl/desktop/windows/weblink/windows-app-web-link.json"},{"edge_kind":"contacted_url","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Url:/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Url:/favicon?url=driveteslacanada.ca?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Url:/favicon?url=chatsports.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Url:/favicon?url=theshopmag.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Url:/favicon?url=techannouncer.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Url:/favicon?url=evchargingstations.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Url:/favicon?url=miamisportswire.com?w=32&h=32&q=100&m=6&f=webp&u=t"},{"edge_kind":"contacted_url","from_key":"File:70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","to_key":"Url:/favicon?url=menafn.com?w=32&h=32&q=100&m=6&f=webp&u=t"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":16,"spawned_processes_count":16,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":45,"imported_dlls_count":194,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":23,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":15,"dns_resolutions_count":17,"contacted_urls_count":11,"http_requests_count":11},"behavior_tags":["commodity","modular","rat","ddos","informationstealer","keylogger","quasar","njratlime","opensource","targeted","criminal","asyncrat","ransomware","suspicious","evasive","new_domain"],"sample_flags":["Multi-Process","Network Traffic"],"sandbox_reports":[{"id":"6af30664d792c019550a115e","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"MSIL.XenoRat","contacted_countries":["USA"],"submit_name":"tmphw_c8oz1.exe","analysis_start_time":"2026-11-10T11:56:21+00:00","indicators_count":{"informative":165,"suspicious":29,"malicious":7},"tags":["Multi-Process","Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"18.154.132.106","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"address":"18.154.132.106","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"address":"99.84.160.20","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"address":"99.84.160.20","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"address":"150.171.74.13","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"address":"23.211.177.80","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"address":"13.32.241.16","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"address":"151.101.131.42","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"address":"18.238.55.72","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"address":"88.223.87.195","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"address":"13.226.94.27","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"address":"199.16.172.96","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"address":"23.47.201.52","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"address":"23.56.109.208","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"address":"142.250.72.1","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]}],"dns_resolutions":[{"domain":"arxiv.org","address":"151.101.131.42","ttl":31,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"domain":"atlasofsecurity.com","address":"13.226.94.27","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"domain":"backdoor.rr88vipa.com","ttl":1800,"country":"-","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"domain":"c2.rr88vipa.com","country":"-","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"domain":"clients2.googleusercontent.com","address":"142.250.72.1","ttl":247,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"domain":"duo.com","address":"18.238.55.72","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"domain":"edge-consumer-static.azureedge.net","address":"150.171.110.7","ttl":7,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"domain":"ignaonline.com","address":"88.223.87.195","ttl":8,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"domain":"m365.cloud.microsoft","address":"150.171.74.13","ttl":3,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"domain":"prod-streaming-video-msn-com.akamaized.net","address":"23.56.109.208","ttl":374,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"domain":"r.msftstatic.com","address":"150.171.27.10","ttl":19,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"domain":"rr88vipa.com","address":"18.154.132.106","ttl":43,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"domain":"sb.scorecardresearch.com","address":"13.32.241.16","ttl":8,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"domain":"services.bingapis.com","address":"150.171.74.13","ttl":3556,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"domain":"www.cisco.com","address":"23.47.201.52","ttl":3244,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"domain":"www.rr88vipa.com","address":"99.84.160.20","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"domain":"www.synqly.com","address":"199.16.172.96","ttl":30,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]}],"http_requests":[{"host":"rr88vipa.com","host_ip":"18.154.132.106:80","url":"/","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET / HTTP/1.1\nHost: rr88vipa.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"host":"m365.cloud.microsoft","host_ip":"150.171.74.13:443","url":"/.well-known/windows-app-web-link","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /.well-known/windows-app-web-link HTTP/2\nHost: m365.cloud.microsoft\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"host":"res.public.onecdn.static.microsoft","host_ip":"23.211.177.80:443","url":"/m365mobile/5mttl/desktop/windows/weblink/windows-app-web-link.json","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /m365mobile/5mttl/desktop/windows/weblink/windows-app-web-link.json HTTP/2\nHost: res.public.onecdn.static.microsoft\nAccept-Encoding: gzip, deflate","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"host":"arxiv.org","host_ip":"151.101.131.42:443","url":"/favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: arxiv.org\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"host":"services.bingapis.com","host_ip":"150.171.74.13:443","url":"/favicon?url=driveteslacanada.ca?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=driveteslacanada.ca?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"host":"services.bingapis.com","host_ip":"150.171.74.13:443","url":"/favicon?url=chatsports.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=chatsports.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"host":"services.bingapis.com","host_ip":"150.171.74.13:443","url":"/favicon?url=theshopmag.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=theshopmag.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"host":"services.bingapis.com","host_ip":"150.171.74.13:443","url":"/favicon?url=techannouncer.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=techannouncer.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"host":"services.bingapis.com","host_ip":"150.171.74.13:443","url":"/favicon?url=evchargingstations.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=evchargingstations.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"host":"services.bingapis.com","host_ip":"150.171.74.13:443","url":"/favicon?url=miamisportswire.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=miamisportswire.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"host":"services.bingapis.com","host_ip":"150.171.74.13:443","url":"/favicon?url=menafn.com?w=32&h=32&q=100&m=6&f=webp&u=t","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /favicon?url=menafn.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2\nHost: services.bingapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}],"processes":[{"pid":8528,"ppid":0,"name":"tmphw_c8oz1.exe","command_line":"","sha256":"70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0","normalized_path":"C:\\tmphw_c8oz1.exe","uid":"00000000-00008528","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":4380,"ppid":0,"name":"msedge.exe","command_line":"--profile-directory=Default","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","uid":"00000000-00004380","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":8112,"ppid":4380,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x368,0x7ffbb07c0f18,0x7ffbb07c0f24,0x7ffbb07c0f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004380","uid":"00000000-00008112"},{"pid":8656,"ppid":4380,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1728,i,15418566462254770660,12459664416703858053,262144 --field-trial-handle=2092,i,7228916768137926017,12223344830638416788,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2104 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004380","uid":"00000000-00008656"},{"pid":7572,"ppid":4380,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=1804,i,7690724427971258,14698943645325465103,524288 --field-trial-handle=2092,i,7228916768137926017,12223344830638416788,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2352 /prefetch:3","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004380","uid":"00000000-00007572"},{"pid":6732,"ppid":4380,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2476,i,1738860681305497585,5309824932018243725,524288 --field-trial-handle=2092,i,7228916768137926017,12223344830638416788,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3024 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004380","uid":"00000000-00006732"},{"pid":9024,"ppid":4380,"name":"msedge.exe","command_line":"--type=renderer --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1794331271112278 --launch-time-ticks=2433638624 --skip-read-main-dll --metrics-shmem-handle=3356,i,9456581927551478729,131256978837533296,2097152 --field-trial-handle=2092,i,7228916768137926017,12223344830638416788,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3412 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004380","uid":"00000000-00009024"},{"pid":7524,"ppid":4380,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1794331271112278 --launch-time-ticks=2433628162 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3348,i,2991187946514435574,1310444308992118215,2097152 --field-trial-handle=2092,i,7228916768137926017,12223344830638416788,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3408 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004380","uid":"00000000-00007524"},{"pid":9196,"ppid":4380,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5956,i,14993194975947067379,2104252156129372912,524288 --field-trial-handle=2092,i,7228916768137926017,12223344830638416788,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=6052 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004380","uid":"00000000-00009196"},{"pid":1388,"ppid":4380,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=5944,i,9860084381944669287,4588476894623290386,524288 --field-trial-handle=2092,i,7228916768137926017,12223344830638416788,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=6016 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004380","uid":"00000000-00001388"},{"pid":7684,"ppid":4380,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=144,i,11976656783772980099,7230349105991466834,524288 --field-trial-handle=2092,i,7228916768137926017,12223344830638416788,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=6688 /prefetch:8","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00004380","uid":"00000000-00007684"},{"pid":6264,"ppid":4380,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=144,i,11976656783772980099,7230349105991466834,524288 --field-trial-handle=2092,i,7228916768137926017,12223344830638416788,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=6688 /prefetch:8","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00004380","uid":"00000000-00006264"},{"pid":7936,"ppid":4380,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=7024,i,11534475783772431314,17684320928433202092,524288 --field-trial-handle=2092,i,7228916768137926017,12223344830638416788,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=6876 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004380","uid":"00000000-00007936"},{"pid":8,"ppid":4380,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3436,i,844813051737626530,12978053787494090786,524288 --field-trial-handle=2092,i,7228916768137926017,12223344830638416788,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=2460 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004380","uid":"00000000-00000008"},{"pid":7824,"ppid":4380,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --skip-read-main-dll --metrics-shmem-handle=5504,i,7848625650022736890,7751484362090816603,524288 --field-trial-handle=2092,i,7228916768137926017,12223344830638416788,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5500 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004380","uid":"00000000-00007824"},{"pid":5108,"ppid":4380,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --skip-read-main-dll --metrics-shmem-handle=5576,i,11731777136659084859,3628409549202192714,524288 --field-trial-handle=2092,i,7228916768137926017,12223344830638416788,262144 --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6948 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004380","uid":"00000000-00005108"}],"all_imported_dlls":["dcomp.dll","Windows.Storage.Search.dll","rmclient.dll","libGLESv2.dll","Windows.UI.dll","SHCore.dll","shell32.dll","nsi.dll","msedge.dll","netutils.dll","slc.dll","oneds.dll","mscoree.dll","imm32.dll","cryptsp.dll","profapi.dll","dnsapi.dll","msasn1.dll","TextInputFramework.dll","usermgrcli.dll","psapi.dll","uxtheme.dll","DataExchange.dll","Windows.System.Profile.RetailInfo.dll","Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient.dll","edputil.dll","MicrosoftAccountWAMExtension.dll","dusmapi.dll","apphelp.dll","fltLib.dll","dsreg.dll","msvcp140.dll","shlwapi.dll","version.dll","clr.dll","sspicli.dll","msctf.dll","CoreUIComponents.dll","winsta.dll","gdi32full.dll","vcruntime140.dll","schannel.dll","dbghelp.dll","Windows.Security.Authentication.Web.Core.dll","ShellCommonCommonProxyStub.dll","netprofm.dll","CapabilityAccessManagerClient.dll","ws2_32.dll","combase.dll","userenv.dll","AssignedAccessRuntime.dll","PCPKsp.dll","user32.dll","clrjit.dll","System.Xml.ni.dll","mdmregistration.dll","setupapi.dll","LocationFrameworkPS.dll","TenantRestrictionsPlugin.dll","ResourcePolicyClient.dll","rpcrt4.dll","oleaut32.dll","DXCore.dll","bcryptprimitives.dll","mskeyprotect.dll","KBDUS.DLL","umpdc.dll","Windows.Internal.UI.Shell.WindowTabManager.dll","webauthn.dll","msvcp110_win.dll","vk_swiftshader.dll","wow64cpu.dll","CoreMessaging.dll","VxSSL32.dll","rasman.dll","secur32.dll","devobj.dll","dwmapi.dll","mf.dll","RTWorkQ.dll","win32u.dll","kernel.appcore.dll","crypt32.dll","wkscli.dll","StructuredQuery.dll","Windows.Networking.Connectivity.dll","KernelBase.dll","winnsi.dll","ntasn1.dll","propsys.dll","vaultcli.dll","Windows.ApplicationModel.dll","sechost.dll","rtutils.dll","OneCoreCommonProxyStub.dll","vcruntime140_clr0400.dll","System.Configuration.ni.dll","WindowManagementAPI.dll","InputHost.dll","aadWamExtension.dll","ncryptprov.dll","mfplat.dll","wow64win.dll","mscorlib.ni.dll","gpapi.dll","omadmapi.dll","dmcmnutils.dll","linkinfo.dll","Windows.Devices.Enumeration.dll","xmllite.dll","FWPUCLNT.DLL","Windows.StateRepositoryCore.dll","OneCoreUAPCommonProxyStub.dll","d3d11.dll","AppXDeploymentClient.dll","imagehlp.dll","d3dcompiler_47.dll","onnxruntime.dll","DWrite.dll","npmproxy.dll","Geolocation.dll","biwinrt.dll","ole32.dll","System.ni.dll","OnDemandConnRouteHelper.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","dxgi.dll","atlthunk.dll","fwbase.dll","dhcpcsvc.dll","oneauth.dll","oleacc.dll","tbs.dll","ucrtbase_clr0400.dll","IPHLPAPI.DLL","ncryptsslp.dll","comctl32.dll","nlaapi.dll","Windows.Web.dll","FirewallAPI.dll","ffmpeg.dll","wldp.dll","rasadhlp.dll","msedge_elf.dll","WinTypes.dll","twinapi.dll","coloradapterclient.dll","domain_actions.dll","libEGL.dll","rasapi32.dll","twinapi.appcore.dll","Windows.StateRepositoryPS.dll","msvcp_win.dll","bcrypt.dll","windows.storage.dll","winmm.dll","sxs.dll","wow64.dll","System.Core.ni.dll","cryptbase.dll","ncrypt.dll","policymanager.dll","gdi32.dll","clbcatq.dll","mswsock.dll","winhttp.dll","ntmarta.dll","powrprof.dll","sppc.dll","microsoft_shell_integration.dll","ucrtbase.dll","mscoreei.dll","directmanipulation.dll","wpnapps.dll","ntdll.dll","dhcpcsvc6.dll","wintrust.dll","Windows.UI.Immersive.dll","telclient.dll","cfgmgr32.dll","well_known_domains.dll","iertutil.dll","srvcli.dll","kernel32.dll","msvcrt.dll","rsaenh.dll","wtsapi32.dll","mscms.dll","wlanapi.dll","netapi32.dll","d3d10warp.dll","advapi32.dll","dpapi.dll","SystemSettings.DataModel.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"path":"pipe\\crashpad_4380_VXPGRMLPTFNBGZNT","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"path":"pipe\\LOCAL\\mojo.4380.6360.14992456419498747764","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"path":"pipe\\LOCAL\\mojo.4380.6360.7863631374160302653","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"path":"pipe\\LOCAL\\mojo.4380.6360.6401911252731634083","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"path":"pipe\\LOCAL\\mojo.4380.6360.6769584034466014624","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"path":"pipe\\LOCAL\\mojo.4380.6360.11783560048453280310","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"path":"pipe\\LOCAL\\mojo.4380.4376.17390778959681918317","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"path":"pipe\\LOCAL\\mojo.4380.4376.6427476574554879382","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"path":"pipe\\LOCAL\\mojo.4380.4376.8716978630523913715","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"path":"pipe\\LOCAL\\mojo.4380.4376.14650585365517058963","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"path":"pipe\\LOCAL\\mojo.4380.4376.9548125896073387645","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"path":"pipe\\LOCAL\\mojo.4380.6360.3982362828374999047","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"path":"pipe\\LOCAL\\mojo.4380.6360.14086970387607409640","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"path":"pipe\\LOCAL\\mojo.4380.4376.17882522735820062095","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"path":"pipe\\LOCAL\\mojo.4380.4376.12991964134734805466","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"path":"pipe\\LOCAL\\mojo.4380.6828.11278319567785200146","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"path":"pipe\\LOCAL\\mojo.7524.3652.1748329411349812729","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8528:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\456JSCJ5RtdRzWxa-admin","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8528:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8528:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"Local\\SM0:8528:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"456JSCJ5RtdRzWxa-admin","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"SM0:8528:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"Local\\SM0:8528:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"SM0:8528:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8528:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4380:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4380:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"Local\\SM0:4380:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"SM0:4380:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"Local\\SM0:4380:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"SM0:4380:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4380:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4380:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8112:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"Local\\SM0:8112:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"SM0:8112:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8112:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8656:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"Local\\SM0:8656:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7572:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"Local\\SM0:7572:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"SM0:7572:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7572:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"\\Sessions\\1\\AppContainerNamedObjects\\S-1-15-2-3251537155-1984446955-2931258699-841473695-1938553385-924012159-129201922\\SM0:7524:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:9196:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"SM0:9196:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1388:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]},{"name":"SM0:1388:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af30664d792c019550a115e"}]}]}},"report_ids":{"sandbox_job_ids":["6af30664d792c019550a115e"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Capa_reference_anti_VM_strings_targeting_Xen Sample 70a9c079bb15… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 70a9c079bb15…. Malware family: Capa_reference_anti_VM_strings_targeting_Xen. Threat score 100/100. 17/27 AV engines flagged this file. 9 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0"}],["$","meta","4",{"property":"og:title","content":"Malicious Capa_reference_anti_VM_strings_targeting_Xen Sample 70a9c079bb15… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 70a9c079bb15…. Malware family: Capa_reference_anti_VM_strings_targeting_Xen. Threat score 100/100. 17/27 AV engines flagged this file. 9 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/70a9c079bb1550af53eaf92903b7a706cbb1d263a8b8dfe5f7e89f7da77fc4b0"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Capa_reference_anti_VM_strings_targeting_Xen Sample 70a9c079bb15… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 70a9c079bb15…. Malware family: Capa_reference_anti_VM_strings_targeting_Xen. Threat score 100/100. 17/27 AV engines flagged this file. 9 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5d","11",{}]] 32:null