26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4cc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 7a706b95301a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7a706b95301a…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 11 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78"],"about":{"@type":"SoftwareApplication","name":"7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":20,"total":28},"behavioralIndicators":{"malicious":11,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Ta82,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReleaseComObject" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "GetBuffer" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "Dispose" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "WriteTo" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Capacity" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "Chrome.exe.bin"28:Te1f,Found reference to "PbeSha1_RC2_40" (Indicator: "RC2"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found reference to "RC2_CBC_40" (Indicator: "RC2"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found reference to "SRTP_NULL_HMAC_SHA1_80" (Indicator: "HMAC"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found reference to "SRTP_AES128_CM_HMAC_SHA1_80" (Indicator: "HMAC"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found reference to "HMAC_SHA1" (Indicator: "HMAC"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found reference to "EncryptionECDsaWithSha1" (Indicator: "ECDsa"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found reference to "TRAILER_SHA512" (Indicator: "SHA512"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found reference to "ecka_eg_X963kdf_SHA512" (Indicator: "SHA512"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found reference to "sphincs256_with_SHA512" (Indicator: "SHA512"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found reference to "xmss_with_SHA512" (Indicator: "SHA512"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found reference to "xmss_mt_with_SHA512" (Indicator: "SHA512"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found reference to "ecdsa_plain_SHA512" (Indicator: "SHA512"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found reference to "EncryptionECDsaWithSha512" (Indicator: "ECDsa"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found reference to "SRTP_NULL_HMAC_SHA1_32" (Indicator: "HMAC"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found reference to "SRTP_AES128_CM_HMAC_SHA1_32" (Indicator: "HMAC"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found reference to "Aes192" (Indicator: "Aes"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found reference to "ECDsaWithSha2" (Indicator: "ECDsa"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found reference to "TRAILER_SHA512_224" (Indicator: "SHA512"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found reference to "EncryptionECDsaWithSha224" (Indicator: "ECDsa"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found reference to "RC2_64" (Indicator: "RC2"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found reference to "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found reference to "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found reference to "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found reference to "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found reference to "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin")29:T496,"Chrome.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK") "Chrome.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK") "Chrome.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS") "Chrome.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6") "Chrome.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6") "Chrome.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SECURITYPROVIDERS") "Chrome.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SECURITYPROVIDERS") "Chrome.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE") "Chrome.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE") "Chrome.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE\CREDSSP.DLL") "Chrome.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE\CREDSSP.DLL")2a:Tf1c,Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "VerifyHash" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Security.Cryptography.DSA" and TypeReference "ExportParameters" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "Seed" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "Counter" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "P" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "Q" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "G" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "Y" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "X" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Security.Cryptography.RSA" and TypeReference "ExportParameters" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "Modulus" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "Exponent" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "D" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "P" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "Q" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "DP" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "DQ" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "InverseQ" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference ".ctor" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Security.Cryptography.RSA" and TypeReference "ImportParameters" in "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "VerifyHash" in "Chrome.exe.bin" Observed namespace "System.Security.Cryptography.DSA" and TypeReference "ExportParameters" in "Chrome.exe.bin" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "Seed" in "Chrome.exe.bin" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "Counter" in "Chrome.exe.bin" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "P" in "Chrome.exe.bin"2b:T10cf,Found string "[PRIVATE KEY LOCATION: "{0}"]" (Indicator: "private key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "Private key passed - public key expected." (Indicator: "private key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "Private key passed - public key expected." (Indicator: "public key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "Public Key:" (Indicator: "public key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "Public key presented not for certificate signature" (Indicator: "public key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "Public key certificate for attribute certificate cannot be searched." (Indicator: "public key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "Subject public key cannot be decoded." (Indicator: "public key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "Public key of issuer certificate of CRL could not be retrieved." (Indicator: "public key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "Attribute certificate issuer is also a public key certificate issuer." (Indicator: "public key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "Public key certificate specified in base certificate ID for attribute certificate cannot be found." (Indicator: "public key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "Certification path for public key certificate of attribute certificate could not be build." (Indicator: "public key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "Trusted CA Public Key:" (Indicator: "public key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "expected public key" (Indicator: "public key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "Unrecognized curve OID for GostR3410x2001 private key" (Indicator: "private key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "algorithm identifier in private key not recognised" (Indicator: "private key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "error recovering GOST3410_2001 public key" (Indicator: "public key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "invalid length for GOST3410_2001 public key" (Indicator: "public key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "error recovering GOST3410_94 public key" (Indicator: "public key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "error recovering GOST3410_2012 public key" (Indicator: "public key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "invalid length for GOST3410_2012 public key" (Indicator: "public key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "algorithm identifier in public key not recognised:" (Indicator: "public key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "Expected a public key" (Indicator: "public key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "Expected a private key" (Indicator: "private key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "invalid DH public key" (Indicator: "public key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "OID is not a valid public key parameter set" (Indicator: "public key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "EOF encountered in middle of Ed25519 private key" (Indicator: "private key"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin")2c:T6ab,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Decrypted SSL network traffic Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Reads the cryptographic machine GUID Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: YARA signature match - AES encryption Matched sigs: Contains ability to perform asymmetric crypto operations Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains symmetric decryption functionality in .NET code2d:T4061,Found XOR loop in file "Chrome.exe.bin" at offset 258202; code bytes = 30d0 Found XOR loop in file "Chrome.exe.bin" at offset 259603; code bytes = 30d0 Found XOR loop in file "Chrome.exe.bin" at offset 990241; code bytes = 30d0 Found XOR loop in file "Chrome.exe.bin" at offset 1770740; code bytes = 30d0 Found XOR loop in file "Chrome.exe.bin" at offset 1896163; code bytes = 30d0 Found XOR loop in file "Chrome.exe.bin" at offset 1259439; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1259547; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1482808; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1841690; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1841744; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1848494; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1848566; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1864046; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1864082; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1864100; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1864316; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1864388; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1864604; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1864622; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1864640; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1864658; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1864676; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1865000; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1865162; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1865378; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1865648; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1865666; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1877384; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1877402; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1877420; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1877438; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1877474; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1930952; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 1967816; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 2000036; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 2000054; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 2000180; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 2018324; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 2018666; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 2018846; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 2024692; code bytes = 33c1 Found XOR loop in file "Chrome.exe.bin" at offset 312990; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 733714; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1028021; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1190651; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1227510; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1347553; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1382402; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1395450; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1407626; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1498080; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1522495; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1529421; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1625455; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1625475; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1625505; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1625845; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1626825; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1627215; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1627625; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1627955; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1628325; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1629215; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1632265; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1638625; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1657595; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1680145; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1691365; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 1695425; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 2401016; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 3140560; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 3160897; code bytes = 8030 Found XOR loop in file "Chrome.exe.bin" at offset 3196662; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 258202; code bytes = 30d0 Found XOR loop in file "Chrome.exe" at offset 259603; code bytes = 30d0 Found XOR loop in file "Chrome.exe" at offset 990241; code bytes = 30d0 Found XOR loop in file "Chrome.exe" at offset 1770740; code bytes = 30d0 Found XOR loop in file "Chrome.exe" at offset 1896163; code bytes = 30d0 Found XOR loop in file "Chrome.exe" at offset 1259439; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1259547; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1482808; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1841690; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1841744; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1848494; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1848566; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1864046; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1864082; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1864100; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1864316; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1864388; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1864604; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1864622; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1864640; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1864658; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1864676; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1865000; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1865162; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1865378; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1865648; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1865666; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1877384; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1877402; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1877420; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1877438; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1877474; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1930952; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 1967816; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 2000036; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 2000054; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 2000180; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 2018324; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 2018666; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 2018846; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 2024692; code bytes = 33c1 Found XOR loop in file "Chrome.exe" at offset 312990; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 733714; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1028021; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1190651; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1227510; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1347553; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1382402; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1395450; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1407626; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1498080; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1522495; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1529421; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1625455; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1625475; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1625505; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1625845; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1626825; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1627215; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1627625; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1627955; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1628325; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1629215; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1632265; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1638625; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1657595; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1680145; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1691365; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 1695425; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 2401016; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 3140560; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 3160897; code bytes = 8030 Found XOR loop in file "Chrome.exe" at offset 3196662; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 258202; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 259603; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 990241; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1770740; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1896163; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1259439; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1259547; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1482808; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1841690; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1841744; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1848494; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1848566; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864046; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864082; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864100; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864316; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864388; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864604; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864622; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864640; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864658; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864676; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1865000; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1865162; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1865378; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1865648; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1865666; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1877384; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1877402; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1877420; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1877438; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1877474; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1930952; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1967816; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2000036; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2000054; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2000180; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2018324; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2018666; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2018846; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2024692; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 312990; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 733714; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1028021; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1190651; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1227510; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1347553; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1382402; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1395450; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1407626; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1498080; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1522495; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1529421; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1625455; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1625475; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1625505; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1625845; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1626825; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1627215; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1627625; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1627955; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1628325; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1629215; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1632265; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1638625; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1657595; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1680145; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1691365; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1695425; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2401016; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3140560; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3160897; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3196662; code bytes = 80302e:T114d,"73^j8" - Source: "00000000-00000400.00000000.167990.02D90000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2004/09/policy" - Source: "00000000-00000400.00000000.167990.02D90000.00000004.mdmp") Found URL "http://flst>x;6bsjbv4.0.30319" - Source: "00000000-00000400.00000000.167990.02D90000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%ydigicert" - Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000400.00000000.167990.1D430000.00000004.mdmp") Found URL "http://www.microsoft.com0e66fgnan3e:aitt'qc1.3.6.1.4.1.311.10.1250826195646z0" - Source: "00000000-00000400.00000000.167990.1D430000.00000004.mdmp") Found URL "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabisallowedcert_autoupdate_1subcamicrosoftisallowedcert_autoupdate_1subcamicrosoftrpc" - Source: "00000000-00000400.00000000.167990.1D630000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00000400.00000000.167990.1D630000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00000400.00000000.167990.1D630000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00000400.00000000.167990.1D630000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000400.00000000.167990.1D630000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l>2" - Source: "00000000-00000400.00000000.167990.1D630000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l2&,lfzed929xeb1.3.6.1.5.5.7.3.3lmemlmem1.3.14.3.2.26c/gp-ldap]" - Source: "00000000-00000400.00000000.167990.1D630000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00000400.00000000.167990.1D6F7000.00000004.mdmp") Found URL "http://www.microsoft.com0e66fgnan3e:aitt'qcipwho.is" - Source: "00000000-00000400.00000000.167990.1D6F7000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2004/09/policy" - Source: "00000000-00000400.00000000.167990.1D6F7000.00000004.mdmp") Found URL "http://schemas.microsofnonicnonicnonicwashington1redmond1microsoft" - Source: "00000000-00000400.00000000.167990.1D6F7000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000400.00000000.167990.1D6F7000.00000004.mdmp") Found URL "http://docs.oasis->73^j8" - Source: "00000000-00000400.00000001.169910.02D90000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2004/09/policy" - Source: "00000000-00000400.00000001.169910.02D90000.00000004.mdmp") Found URL "http://flst>x;6bsjbv4.0.30319" - Source: "00000000-00000400.00000001.169910.02D90000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%ydigicert" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp") Found URL "http://www.microsoft.com0e66fgnan3e:aitt'qcus" - Source: "00000000-00000400.00000001.169910.1D430000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000400.00000001.169910.1D630000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l>2" - Source: "00000000-00000400.00000001.169910.1D630000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lrsa1(]b,=t]o-rsa1(]b,=t]o-rsa1" - Source: "00000000-00000400.00000001.169910.1D630000.00000004.mdmp") Found URL "http://www.microsoft.com0e66fgnan3e:aitt'qc932,<7cbe0,4,01000000" - Source: "00000000-00000400.00000001.169910.1D630000.00000004.mdmp") Found URL "https://cdn.ipwhois.io/flags/us.svg" - Source: "00000000-00000400.00000001.169910.1D630000.00000004.mdmp") Found URL "https://ipwhois.io/documentation" - Source: "00000000-00000400.00000001.169910.1D630000.00000004.mdmp") Found URL "http://docs.oasis->73^j8" - Source: "00000000-00000400.00000002.171832.02D90000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2004/09/policy" - Source: "00000000-00000400.00000002.171832.02D90000.00000004.mdmp") Found URL "http://flst>x;6bsjbv4.0.30319" - Source: "00000000-00000400.00000002.171832.02D90000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%ydigicert" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found URL "http://www.microsoft.com0e66fgnan3e:aitt'qcus" - Source: "00000000-00000400.00000002.171832.1D430000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000400.00000002.171832.1D630000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l>2" - Source: "00000000-00000400.00000002.171832.1D630000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lrsa1(]b,=t]o-rsa1(]b,=t]o-rsa1" - Source: "00000000-00000400.00000002.171832.1D630000.00000004.mdmp") Found URL "http://www.microsoft.com0e66fgnan3e:aitt'qc932,<7cbe0,4,01000000" - Source: "00000000-00000400.00000002.171832.1D630000.00000004.mdmp") Found URL "https://cdn.ipwhois.io/flags/us.svg" - Source: "00000000-00000400.00000002.171832.1D630000.00000004.mdmp") Found URL "https://ipwhois.io/documentation" - Source: "00000000-00000400.00000002.171832.1D630000.00000004.mdmp")4e:T527,Found string "+ncalrpc:[OLE1F2C927F480E0D17049ADF698C50]" (Indicator: "ncalrpc"; Source: "00000000-00000400.00000000.167990.02D90000.00000004.mdmp, 00000000-00000400.00000001.169910.02D90000.00000004.mdmp, 00000000-00000400.00000002.171832.02D90000.00000004.mdmp") Found string "B+ncalrpc:[OLEFD6AABAE1C6FEF9C1751A8B6AB26]" (Indicator: "ncalrpc"; Source: "00000000-00000400.00000001.169910.02D90000.00000004.mdmp, 00000000-00000400.00000001.169910.1D630000.00000004.mdmp, 00000000-00000400.00000002.171832.02D90000.00000004.mdmp, 00000000-00000400.00000002.171832.1D630000.00000004.mdmp") Found string "+ncalrpc:[OLEFD6AABAE1C6FEF9C1751A8B6AB26]" (Indicator: "ncalrpc"; Source: "00000000-00000400.00000001.169910.1D630000.00000004.mdmp, 00000000-00000400.00000002.171832.1D630000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00000400.00000001.169910.1D630000.00000004.mdmp, 00000000-00000400.00000002.171832.1D630000.00000004.mdmp") Found string "+ncalrpc:[OLEFF939C5B995E21E7A4AE551E108E]" (Indicator: "ncalrpc"; Source: "00000000-00002500.00000000.167833.035DB000.00000004.mdmp") Found string "+ncalrpc:[OLE76CA234B02C58082698F238AC64F]" (Indicator: "ncalrpc"; Source: "00000000-00006956.00000000.177639.034F0000.00000004.mdmp")4f:T4c0,Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp, 00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp, 00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp, 00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp, 00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp, 00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp, 00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp, 00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp, 00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00002500.00000000.167833.03500000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00006956.00000000.177639.034F0000.00000004.mdmp")50:T67d,"Chrome.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.ServiceModel\* (UID: 00000000-00000400) "Chrome.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00000400) "Chrome.exe" called "FindNextFileW" with parameter 3b9cf8abf6d42fe62158f8da994ecc20 (UID: 00000000-00000400) "Chrome.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Runteb92aa12#\* (UID: 00000000-00000400) "Chrome.exe" called "FindNextFileW" with parameter 59a4984a6afe6b209eaaa379927ab81d (UID: 00000000-00000400) "Chrome.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Security\* (UID: 00000000-00000400) "Chrome.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Accessibility\* (UID: 00000000-00000400) "Chrome.exe" called "FindNextFileW" with parameter af089aca36389b4c976815f39c9d7669 (UID: 00000000-00000400) "Chrome.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\* (UID: 00000000-00000400) "Chrome.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\SMDiagnostics\* (UID: 00000000-00000400) "Chrome.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Servd1dec626#\* (UID: 00000000-00000400) "Chrome.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\* (UID: 00000000-00000400) "Chrome.exe" called "FindNextFileW" with parameter b221af81285c1305324612e6dc9c88ff (UID: 00000000-00000400)51:Tf25,Found string "P~AeS" (Indicator: "aes"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "PQAeS~" (Indicator: "aes"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "mChacha20" (Indicator: "chacha"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "ecdsa_plain_RIPEMD160" (Indicator: "ecdsa"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "SRTP_AES128_CM_HMAC_SHA1_80" (Indicator: "aes"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "SRTP_AES128_CM_HMAC_SHA1_80" (Indicator: "aes128"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "ecdsa_plain_SHA1" (Indicator: "ecdsa"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "id_TA_ECDSA_SHA_1" (Indicator: "ecdsa"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "EncryptionECDsaWithSha1" (Indicator: "ecdsa"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "ecdsa_sha1" (Indicator: "ecdsa"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "ecdsa_plain_SHA512" (Indicator: "ecdsa"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "IdEcdsaWithSha3_512" (Indicator: "ecdsa"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "id_TA_ECDSA_SHA_512" (Indicator: "ecdsa"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "THREEFISH_512" (Indicator: "threefish"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "EncryptionECDsaWithSha512" (Indicator: "ecdsa"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "ecdsa_secp521r1_sha512" (Indicator: "ecdsa"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "ecdsa_brainpoolP512r1tls13_sha512" (Indicator: "ecdsa"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "SRTP_AES128_CM_HMAC_SHA1_32" (Indicator: "aes"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "SRTP_AES128_CM_HMAC_SHA1_32" (Indicator: "aes128"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "ecka_eg_SessionKDF_AES192" (Indicator: "aes"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "ecka_eg_SessionKDF_AES192" (Indicator: "aes192"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "AES_192" (Indicator: "aes"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "Aes192" (Indicator: "aes"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "Aes192" (Indicator: "aes192"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "ECDsaWithSha2" (Indicator: "ecdsa"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "THREEFISH_1024" (Indicator: "threefish"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "ecdsa_plain_SHA224" (Indicator: "ecdsa"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "IdEcdsaWithSha3_224" (Indicator: "ecdsa"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "id_TA_ECDSA_SHA_224" (Indicator: "ecdsa"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin")52:Tdcf,Found string "passwordBasedMac" (Indicator: "password"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "password_value" (Indicator: "password"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "Export of key material requires extended_master_secret" (Indicator: "secret"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "no password supplied when one expected" (Indicator: "password"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "cannot export keying material without extended_master_secret" (Indicator: "secret"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "BCrypt password must be <= 72 bytes" (Indicator: "password"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "Missing password." (Indicator: "password"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "extended_master_secret" (Indicator: "secret"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "password" (Indicator: "password"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "extended master secret" (Indicator: "secret"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "master secret" (Indicator: "secret"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "PKCS12 key store MAC invalid - wrong password or corrupted file." (Indicator: "password"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "password supplied for keystore that does not require one" (Indicator: "password"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "No password finder specified, but a password is required" (Indicator: "password"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "Password is null, but a password is required" (Indicator: "password"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "Partner MacTag validation failed. Therefore, the password, MAC, or digest algorithm of each participant does not match." (Indicator: "password"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "verification requires password check" (Indicator: "password"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "can't create secret key object:" (Indicator: "secret"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "exception decrypting secret key" (Indicator: "secret"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "secret key ring doesn't start with secret key tag: tag 0x" (Indicator: "secret"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00002500.00000000.167833.03500000.00000004.mdmp") Found string "aster secret" (Indicator: "secret"; Source: "00000000-00002500.00000000.167833.1DE12000.00000004.mdmp") Found string "xtended master secret," (Indicator: "secret"; Source: "00000000-00002500.00000000.167833.1DE12000.00000004.mdmp")53:T5c6,Found string "SELECT Caption FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "SELECT * FROM Win32_BIOS" (Indicator: " Win32_BIOS"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "SELECT * FROM Win32_BaseBoard" (Indicator: " Win32_BaseBoard"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "Select * From Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "SELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Indicator: " Win32_OperatingSystem"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "SELECT * FROM AntivirusProduct" (Indicator: "antivirusproduct"; File: "7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin") Found string "M Win32_BIOS" (Indicator: " Win32_BIOS"; Source: "00000000-00000400.00000001.169910.1D630000.00000004.mdmp, 00000000-00000400.00000002.171832.1D630000.00000004.mdmp")54:T688,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00000400.00000000.167990.02D90000.00000004.mdmp, 00000000-00000400.00000001.169910.02D90000.00000004.mdmp, 00000000-00000400.00000002.171832.02D90000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000400.00000000.167990.02D90000.00000004.mdmp, 00000000-00000400.00000001.169910.02D90000.00000004.mdmp, 00000000-00000400.00000002.171832.02D90000.00000004.mdmp") Found string "m32\drivers\SandboxFltr.sys" (Indicator: "\drivers\"; Source: "00000000-00000400.00000000.167990.03450000.00000002.mdmp, 00000000-00000400.00000001.169910.03450000.00000002.mdmp, 00000000-00000400.00000002.171832.03450000.00000002.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00002500.00000000.167833.03500000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002500.00000000.167833.03500000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00002500.00000000.167833.03500000.00000004.mdmp, 00000000-00002500.00000000.167833.035DB000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00006956.00000000.177639.034F0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006956.00000000.177639.034F0000.00000004.mdmp")55:Tae8,">) at 0d59800d2c3053699a175b176422a11e-60001d3-_~_","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network adapter information (Dotnet)","description":"Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin\"\n Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"Chrome.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-137","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00000400.00000000.167990.02D90000.00000004.mdmp\n 00000000-00000400.00000001.169910.02D90000.00000004.mdmp\n 00000000-00000400.00000002.171832.02D90000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"Gma.System.MouseKeyHook.WinApi.KeyboardNativeMethods::GetKeyboardLayout(System.Int32) at 0d59800d2c3053699a175b176422a11e-6000980-KeyboardNativeMethods~GetActiveKeyboard","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"SMBIOS|CSMBios|GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00000400.00000001.169910.1D430000.00000004.mdmp, 00000000-00000400.00000002.171832.1D430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"Chrome.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Security\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Security.dll\" at 00000000-00000400-00000C17-1557917215\n \"Chrome.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Data.SqlXml\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.SqlXml.dll\" at 00000000-00000400-00000C17-1558126504\n \"Chrome.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\SMDiagnostics\\v4.0_4.0.0.0__b77a5c561934e089\\SMDiagnostics.dll\" at 00000000-00000400-00000C17-1561086151\n \"Chrome.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ServiceModel.Internals\\v4.0_4.0.0.0__31bf3856ad364e35\\System.ServiceModel.Internals.dll\" at 00000000-00000400-00000C17-1561125006","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\" HTTP/1.1 200 OK\nDate: Tue\n 10 Mar 2026 20:46:26 GMT\nContent-Type: application/json; charset=utf-8\nContent-Length: 954\nConnection: keep-alive\ncf-cache-status: HIT\nAccess-Control-Allow-Origin: *\nAccept-Ranges: bytes\nServer: cloudflare\nCF-RAY: 9da52b381a3c7a73-SJC\nalt-svc: h3=\":443\"; ma=86400 with response body ==>7B0A20202020226970223A202236342E3132342E31322E313632222C0A202020202273756363657373223A20747275652C0A202020202274797065223A202249.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\" nuldel /a /q /f \"\" (Indicator: \"ping -\"; File: \"7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin\"), Found string \"@echo off\\r\\nchcp 65001\\r\\necho DONT CLOSE THIS WINDOW!\\r\\nping -n 10 localhost > nul\\r\\ndel /a /q /f \\\"\" (Indicator: \"ping -\"; File: \"7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin\")\n Found string \"@echo off\\r\\nchcp 65001\\r\\necho DONT CLOSE THIS WINDOW!\\r\\nping -n 10 localhost > nul\\r\\nstart \\\"\\\" \\\"\" (Indicator: \"ping -\"; File: \"7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-5070","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files (.NET)","description":"Observed dotnet function \"WebRequest.GetResponse\" in \"7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin\"\n Observed dotnet function \"WebResponse.GetResponseStream\" in \"7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin\"\n Observed dotnet function \"WebRequest.GetResponse\" in \"Chrome.exe.bin\"\n Observed dotnet function \"WebResponse.GetResponseStream\" in \"Chrome.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":7,"id":"static-201","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping 00\" (Indicator: \"ping \"; Source: \"00000000-00000400.00000001.169910.1D430000.00000004.mdmp, 00000000-00000400.00000002.171832.1D430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00000400-00000C2C-1558493882\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTPS web server (GET/POST requests)","description":"Found requests in header \"GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive\"; in File: \"SSL\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-505","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"$47","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000400-00000C2C-1558481119\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00000400-00000C2C-1559923618\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00000400-00000C2C-1560112176\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00000400-00000C2C-1560112212\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00000400-00000C2C-1561055391\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"$48","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicates via socket (possible C&C communication)","description":"$49","origin":"Static Parser","mitre_attack_id":"T1071","relevance":1,"id":"static-151","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin\"\n Observed namespace \"System.Net.Sockets\" in \"7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin\"\n Observed namespace \"System.Net.Security\" in \"7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin\"\n Observed namespace \"System.Net.NetworkInformation\" in \"7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00000400-00000C2C-1558481119\")\n Found reference to API \"Connection is closed, cannot accept any more input\" (Indicator: \" accept \"; File: \"7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin\")\n Found reference to API \"CtsBlockCipher can only accept ECB, or CBC ciphers\" (Indicator: \" accept \"; File: \"7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"Decrypted SSL network traffic","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1573","relevance":3,"id":"string-102","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"fq%umx.0y0\" [Source: 00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp\n 00000000-00000400.00000000.167990.1D430000.00000004.mdmp\n 00000000-00000400.00000001.169910.1D430000.00000004.mdmp\n 00000000-00000400.00000001.169910.1D630000.00000004.mdmp\n 00000000-00000400.00000002.171832.1D430000.00000004.mdmp\n 00000000-00000400.00000002.171832.1D630000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4d","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive\" (Indicator: \"HTTP/1.1\"; File: \"SSL\")\n file/memory contains long string with (Indicator: \"HTTP/1.1\"; File: \"SSL\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00000400.00000000.167990.1D2B2000.00000004.mdmp, 00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp, 00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET / HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0\nHost: ipwho.is\nConnection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: c12f54a3f91dc7bafd92cb59fe009a35\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://ipwho.is\"\n Found HTTPS url \"https://stackoverflow.com\"\n Found HTTPS url \"https://api.ipify.org\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://ipwho.is/","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"ipwho.is\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"172.66.175.107\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"\n YARA signature for AES encryption matched on file \"Chrome.exe.602243925\"\n YARA signature for AES encryption matched on file \"Chrome.exe.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CreateDC\" (Indicator: \"CreateDC\"; File: \"7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"[Esc]

\" (Indicator: \"[esc]\"; File: \"7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"GetMac\" (Indicator: \"getmac\"; File: \"7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin\")\n Found string \"HostName\" (Indicator: \"hostname\"; File: \"7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin\")\n Found string \"hostname\" (Indicator: \"hostname\"; File: \"7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin\")\n Found string \"'name' is not a HostName string\" (Indicator: \"hostname\"; File: \"7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin\")\n Found string \"/K CHCP {0}\" (Indicator: \"chcp\"; File: \"7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin\")\n Found string \"ping 00\" (Indicator: \"ping\"; Source: \"00000000-00000400.00000001.169910.1D430000.00000004.mdmp, 00000000-00000400.00000002.171832.1D430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$53","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$54","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"\"del /a /q /f \"\" (Indicator: \"\"del \") in Source: 7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Chrome.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$55","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$56","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00000400.00000001.169910.1D2B2000.00000004.mdmp, 00000000-00000400.00000002.171832.1D2B2000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin.exe.log]- [targetUID: 00000000-00002500]\n Dropped file: \"77EC63BDA74BD0D0E0426DC8F8008506\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00000400]\n Dropped file: \"77EC63BDA74BD0D0E0426DC8F8008506\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00000400]\n Dropped file: \"Chrome.exe\" - Location: [%APPDATA%\\Google\\Chrome.exe]- [targetUID: 00000000-00002500]\n Dropped file: \"Chrome.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\Chrome.exe.log]- [targetUID: 00000000-00006956]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"DeleteDC\" (Source: 7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin, API is part of module: GDI32.DLL)\n Found string \"CryptHashData\" (Source: 7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin, API is part of module: CRYPTSP.DLL)\n Found string \"GetCurrentThreadId\" (Source: 7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin, API is part of module: KERNELBASE.DLL)\n Found string \"GetWindowThreadProcessId\" (Source: 7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin, API is part of module: USER32.DLL)\n Found string \"shutdown\" (Source: 7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin, API is part of module: WS2_32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"7a706b95301ad94c287c2a3eaa38116fcc7343ca28758a76cbfae2fedc8e7b78.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"Chrome.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69b082fca9eeb256db0aff19"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"