23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 38:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 24:T5af,Found string "[System.IO.Compression.ZipFile]::ExtractToDirectory(" (Source: "00000000-00004528.00000000.293503.00940000.00000004.mdmp, 00000000-00004528.00000000.293503.205D7000.00000004.mdmp, 00000000-00004528.00000000.293503.29A00000.00000004.mdmp, 00000000-00004528.00000000.293503.91940000.00000004.mdmp, 00000000-00004528.00000000.293503.BEF00000.00000004.mdmp") Found string "internal/webstreams/compression" (Source: "00000000-00004528.00000000.293503.1DE80000.00000004.mdmp, 00000000-00004528.00000000.293503.1FBA4000.00000004.mdmp, 00000000-00004528.00000000.293503.A40C0000.00000004.mdmp, 00000000-00004528.00000000.293503.E2640000.00000004.mdmp") Found string "pkg: unknown compression codec id" (Source: "00000000-00004528.00000000.293503.91940000.00000004.mdmp") Found string "compression" (Source: "00000000-00004528.00000000.293503.C8540000.00000004.mdmp") Found string "ZSTD_c_compressionLevel" (Source: "00000000-00004528.00000000.293503.E2640000.00000004.mdmp") Found string "DecompressionStream" (Source: "00000000-00004528.00000000.293503.E2640000.00000004.mdmp") Found string "v8_enable_pointer_compression" (Source: "00000000-00004528.00000000.293503.E2640000.00000004.mdmp") Found string "v8_enable_pointer_compression_shared_cage" (Source: "00000000-00004528.00000000.293503.E2640000.00000004.mdmp") Found string "lib/internal/webstreams/compression.js" (Source: "00000000-00004528.00000000.293503.E9A40000.00000004.mdmp")25:Te47,Found reference to "HKDFJob" (Indicator: "HKDF"; Source: "00000000-00004528.00000000.293503.040C0000.00000004.mdmp") Found reference to "kTicketKeyHMACIndex" (Indicator: "HMAC"; Source: "00000000-00004528.00000000.293503.040C0000.00000004.mdmp") file/memory contains long string with (Indicator: "SHA384"; Source: "00000000-00004528.00000000.293503.1DE80000.00000004.mdmp") Found reference to "SHA512-224" (Indicator: "SHA512"; Source: "00000000-00004528.00000000.293503.1DE80000.00000004.mdmp") Found reference to "SHA512-256" (Indicator: "SHA512"; Source: "00000000-00004528.00000000.293503.1DE80000.00000004.mdmp") Found reference to "HMAC-DRBG" (Indicator: "HMAC"; Source: "00000000-00004528.00000000.293503.1DE80000.00000004.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00004528.00000000.293503.1DF39000.00000004.mdmp, 00000000-00004528.00000000.293503.20550000.00000004.mdmp, 00000000-00004528.00000000.293503.205D7000.00000004.mdmp, 00000000-00004528.00000000.293503.20750000.00000004.mdmp, 00000000-00004528.00000000.293503.20802000.00000004.mdmp, 00000000-00004528.00000000.293503.42340000.00000004.mdmp") Found reference to "AES-128-CBC-HMAC-SHA256" (Indicator: "HMAC"; Source: "00000000-00004528.00000000.293503.1DF39000.00000004.mdmp") Found reference to "AES-256-CBC-HMAC-SHA1" (Indicator: "HMAC"; Source: "00000000-00004528.00000000.293503.1DF39000.00000004.mdmp") Found reference to "AES-256-CBC-HMAC-SHA256" (Indicator: "HMAC"; Source: "00000000-00004528.00000000.293503.1DF39000.00000004.mdmp") Found reference to "AES-128-CBC-HMAC-SHA1" (Indicator: "HMAC"; Source: "00000000-00004528.00000000.293503.1DF39000.00000004.mdmp") Found reference to "ecdsa-with-SHA512" (Indicator: "SHA512"; Source: "00000000-00004528.00000000.293503.1FC6B000.00000004.mdmp") Found reference to "ecdsa-with-SHA384" (Indicator: "SHA384"; Source: "00000000-00004528.00000000.293503.1FC6B000.00000004.mdmp") Found reference to "ECDSA-SHA384" (Indicator: "SHA384"; Source: "00000000-00004528.00000000.293503.1FC6B000.00000004.mdmp") Found reference to "ECDSA-SHA512" (Indicator: "SHA512"; Source: "00000000-00004528.00000000.293503.1FC6B000.00000004.mdmp") Found reference to "HKDF" (Indicator: "HKDF"; Source: "00000000-00004528.00000000.293503.20550000.00000004.mdmp, 00000000-00004528.00000000.293503.205D7000.00000004.mdmp, 00000000-00004528.00000000.293503.2071E000.00000004.mdmp, 00000000-00004528.00000000.293503.42340000.00000004.mdmp") Found reference to "HMAC-DRBG-KDF" (Indicator: "HMAC"; Source: "00000000-00004528.00000000.293503.205D7000.00000004.mdmp") Found reference to "SSHKDF" (Indicator: "HKDF"; Source: "00000000-00004528.00000000.293503.2071E000.00000004.mdmp, 00000000-00004528.00000000.293503.20750000.00000004.mdmp") Found reference to "RSA-SHA512-224" (Indicator: "SHA512"; Source: "00000000-00004528.00000000.293503.2071E000.00000004.mdmp") Found reference to "RSA-SHA384" (Indicator: "SHA384"; Source: "00000000-00004528.00000000.293503.2071E000.00000004.mdmp") Found reference to "RSA-SHA512-256" (Indicator: "SHA512"; Source: "00000000-00004528.00000000.293503.2071E000.00000004.mdmp") Found reference to "RSA-SHA512" (Indicator: "SHA512"; Source: "00000000-00004528.00000000.293503.2071E000.00000004.mdmp") Found reference to "dsa_with_SHA384" (Indicator: "SHA384"; Source: "00000000-00004528.00000000.293503.2071E000.00000004.mdmp") Found reference to "dsa_with_SHA512" (Indicator: "SHA512"; Source: "00000000-00004528.00000000.293503.2071E000.00000004.mdmp") Found reference to "DSA-SHA512" (Indicator: "SHA512"; Source: "00000000-00004528.00000000.293503.2071E000.00000004.mdmp")26:T1ec1,Observed string: "node:internal/crypto/random" (Indicator: "node:internal/crypto/random") in Source: 00000000-00004528.00000000.293503.00940000.00000004.mdmp 00000000-00004528.00000000.293503.040C0000.00000004.mdmp 00000000-00004528.00000000.293503.5D400000.00000004.mdmp 00000000-00004528.00000000.293503.BEF00000.00000004.mdmp Observed string: "node:internal/crypto/pbkdf2" (Indicator: "node:internal/crypto/pbkdf2") in Source: 00000000-00004528.00000000.293503.00940000.00000004.mdmp 00000000-00004528.00000000.293503.040C0000.00000004.mdmp 00000000-00004528.00000000.293503.5D400000.00000004.mdmp 00000000-00004528.00000000.293503.BEF00000.00000004.mdmp Observed string: "node:internal/crypto/util" (Indicator: "node:internal/crypto/util") in Source: 00000000-00004528.00000000.293503.00940000.00000004.mdmp 00000000-00004528.00000000.293503.42340000.00000004.mdmp 00000000-00004528.00000000.293503.5D400000.00000004.mdmp 00000000-00004528.00000000.293503.BEF00000.00000004.mdmp Observed string: "node:internal/crypto/hashnames" (Indicator: "node:internal/crypto/hashnames") in Source: 00000000-00004528.00000000.293503.00940000.00000004.mdmp 00000000-00004528.00000000.293503.42340000.00000004.mdmp 00000000-00004528.00000000.293503.5D400000.00000004.mdmp 00000000-00004528.00000000.293503.BEF00000.00000004.mdmp Observed string: "node:internal/crypto/scrypt" (Indicator: "node:internal/crypto/scrypt") in Source: 00000000-00004528.00000000.293503.00940000.00000004.mdmp 00000000-00004528.00000000.293503.42340000.00000004.mdmp 00000000-00004528.00000000.293503.5D400000.00000004.mdmp 00000000-00004528.00000000.293503.BEF00000.00000004.mdmp Observed string: "node:internal/crypto/hkdf" (Indicator: "node:internal/crypto/hkdf") in Source: 00000000-00004528.00000000.293503.00940000.00000004.mdmp 00000000-00004528.00000000.293503.42340000.00000004.mdmp 00000000-00004528.00000000.293503.5D400000.00000004.mdmp 00000000-00004528.00000000.293503.BEF00000.00000004.mdmp Observed string: "node:internal/crypto/keys" (Indicator: "node:internal/crypto/keys") in Source: 00000000-00004528.00000000.293503.00940000.00000004.mdmp 00000000-00004528.00000000.293503.42340000.00000004.mdmp 00000000-00004528.00000000.293503.5D400000.00000004.mdmp 00000000-00004528.00000000.293503.BEF00000.00000004.mdmp Observed string: "node:internal/crypto/keygen" (Indicator: "node:internal/crypto/keygen") in Source: 00000000-00004528.00000000.293503.00940000.00000004.mdmp 00000000-00004528.00000000.293503.42340000.00000004.mdmp 00000000-00004528.00000000.293503.5D400000.00000004.mdmp 00000000-00004528.00000000.293503.BEF00000.00000004.mdmp Observed string: "node:internal/crypto/diffiehellman" (Indicator: "node:internal/crypto/diffiehellman") in Source: 00000000-00004528.00000000.293503.00940000.00000004.mdmp 00000000-00004528.00000000.293503.42340000.00000004.mdmp 00000000-00004528.00000000.293503.5D400000.00000004.mdmp 00000000-00004528.00000000.293503.BEF00000.00000004.mdmp Observed string: "node:internal/crypto/cipher" (Indicator: "node:internal/crypto/cipher") in Source: 00000000-00004528.00000000.293503.00940000.00000004.mdmp 00000000-00004528.00000000.293503.42340000.00000004.mdmp 00000000-00004528.00000000.293503.5D400000.00000004.mdmp 00000000-00004528.00000000.293503.BEF00000.00000004.mdmp Observed string: "node:internal/crypto/sigp" (Indicator: "node:internal/crypto/sigp") in Source: 00000000-00004528.00000000.293503.00940000.00000004.mdmp Observed string: "node:internal/crypto/hash" (Indicator: "node:internal/crypto/hash") in Source: 00000000-00004528.00000000.293503.00940000.00000004.mdmp 00000000-00004528.00000000.293503.42340000.00000004.mdmp 00000000-00004528.00000000.293503.5D400000.00000004.mdmp 00000000-00004528.00000000.293503.BEF00000.00000004.mdmp Observed string: "node:internal/crypto/x509" (Indicator: "node:internal/crypto/x509") in Source: 00000000-00004528.00000000.293503.00940000.00000004.mdmp 00000000-00004528.00000000.293503.42340000.00000004.mdmp 00000000-00004528.00000000.293503.5D400000.00000004.mdmp 00000000-00004528.00000000.293503.BEF00000.00000004.mdmp Observed string: "node:internal/crypto/certificate" (Indicator: "node:internal/crypto/certificate") in Source: 00000000-00004528.00000000.293503.00940000.00000004.mdmp Observed string: "internal/crypto/pbkdf2" (Indicator: "internal/crypto/pbkdf2") in Source: 00000000-00004528.00000000.293503.040C0000.00000004.mdmp 00000000-00004528.00000000.293503.1DE80000.00000004.mdmp 00000000-00004528.00000000.293503.1FBA4000.00000004.mdmp 00000000-00004528.00000000.293503.A40C0000.00000004.mdmp Observed string: "internal/crypto/scrypt" (Indicator: "internal/crypto/scrypt") in Source: 00000000-00004528.00000000.293503.040C0000.00000004.mdmp 00000000-00004528.00000000.293503.1DE80000.00000004.mdmp 00000000-00004528.00000000.293503.1FBA4000.00000004.mdmp 00000000-00004528.00000000.293503.A40C0000.00000004.mdmp Observed string: "internal/crypto/hkdf" (Indicator: "internal/crypto/hkdf") in Source: 00000000-00004528.00000000.293503.040C0000.00000004.mdmp 00000000-00004528.00000000.293503.1DE80000.00000004.mdmp 00000000-00004528.00000000.293503.1FBA4000.00000004.mdmp 00000000-00004528.00000000.293503.A40C0000.00000004.mdmp Observed string: "internal/crypto/keygen" (Indicator: "internal/crypto/keygen") in Source: 00000000-00004528.00000000.293503.040C0000.00000004.mdmp 00000000-00004528.00000000.293503.1DE80000.00000004.mdmp 00000000-00004528.00000000.293503.1FBA4000.00000004.mdmp 00000000-00004528.00000000.293503.A40C0000.00000004.mdmp Observed string: "internal/crypto/diffiehellman" (Indicator: "internal/crypto/diffiehellman") in Source: 00000000-00004528.00000000.293503.040C0000.00000004.mdmp 00000000-00004528.00000000.293503.1DE80000.00000004.mdmp 00000000-00004528.00000000.293503.1FBA4000.00000004.mdmp 00000000-00004528.00000000.293503.A40C0000.00000004.mdmp Observed string: "internal/crypto/cipher" (Indicator: "internal/crypto/cipher") in Source: 00000000-00004528.00000000.293503.040C0000.00000004.mdmp 00000000-00004528.00000000.293503.1DE80000.00000004.mdmp 00000000-00004528.00000000.293503.1FBA4000.00000004.mdmp 00000000-00004528.00000000.293503.A40C0000.00000004.mdmp Observed string: "internal/crypto/sig" (Indicator: "internal/crypto/sig") in Source: 00000000-00004528.00000000.293503.040C0000.00000004.mdmp 00000000-00004528.00000000.293503.1DE80000.00000004.mdmp 00000000-00004528.00000000.293503.1FBA4000.00000004.mdmp 00000000-00004528.00000000.293503.A40C0000.00000004.mdmp Observed string: "internal/crypto/hash" (Indicator: "internal/crypto/hash") in Source: 00000000-00004528.00000000.293503.040C0000.00000004.mdmp 00000000-00004528.00000000.293503.1DE80000.00000004.mdmp 00000000-00004528.00000000.293503.1FBA4000.00000004.mdmp 00000000-00004528.00000000.293503.A40C0000.00000004.mdmp Observed string: "internal/crypto/x509" (Indicator: "internal/crypto/x509") in Source: 00000000-00004528.00000000.293503.040C0000.00000004.mdmp 00000000-00004528.00000000.293503.1DE80000.00000004.mdmp 00000000-00004528.00000000.293503.1FBA4000.00000004.mdmp 00000000-00004528.00000000.293503.A40C0000.00000004.mdmp Observed string: "internal/crypto/util" (Indicator: "internal/crypto/util") in Source: 00000000-00004528.00000000.293503.040C0000.00000004.mdmp 00000000-00004528.00000000.293503.1DE80000.00000004.mdmp 00000000-00004528.00000000.293503.1FBA4000.00000004.mdmp 00000000-00004528.00000000.293503.A40C0000.00000004.mdmp Observed string: "internal/crypto/certificate" (Indicator: "internal/crypto/certificate") in Source: 00000000-00004528.00000000.293503.040C0000.00000004.mdmp 00000000-00004528.00000000.293503.1DE80000.00000004.mdmp 00000000-00004528.00000000.293503.1FBA4000.00000004.mdmp 00000000-00004528.00000000.293503.A40C0000.00000004.mdmp27:T9e2,"CalmEagle.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004528) "CalmEagle.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000090e2ba1f4401000070df7fd51c0000000126c11f01000000e0de7fd51c00000054f643b4f67f00000c000000250200000126c11f01000000e026c11f4401000009aab1c3250200000126c11f0100000000000000380000000000000044010000b78606b4f67f00008a3300000000000000df7fd51c00000000e0ba1f440100009825c11f4401000010e07fd51c000000160a34b4f67f000090e2ba1f4401000010e07fd51c00000011df7fd51c00000050df7fd51c000000c00ff81d4401000000000000440100000000f81d44010000d033c41f440100008800552044010000b0df7fd51c000000d018f41d44010000d026c11f440100008ab3bb2b (UID: 00000000-00004528) "CalmEagle.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004528) "CalmEagle.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f000002000000000000000000000000000000d0eec51f4401000000e0ba1f4401000026000000000000003e696ab4f67f000080e0ba1f4401000080df7fd51c0000001003c21f4401000080df7fd51c00000028e77fd51c000000280780b4f67f0000b8df7fd51c00000000e0ba1f440100006000000000000000df9755b5f67f000028e77fd51c000000efdfccb3f67f0000000a5920440100000001000000000000600d592044010000df686ab4f67f000049fa415dcb01000008000000000000004016f51d44010000d025c11f440100001003c21f4401000000e0ba1f44010000d025c11f440100000045c11f440100002054592044010000ea9144b4f67f0000b0cbf1b5 (UID: 00000000-00004528)28:Tc30,"CalmEagle.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")29:T499,"CalmEagle.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004528) "CalmEagle.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004528) "CalmEagle.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00004528) "CalmEagle.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004528) "CalmEagle.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004528) "CalmEagle.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004528) "CalmEagle.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004528) "CalmEagle.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004528) "CalmEagle.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00004528) "CalmEagle.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004528) "CalmEagle.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004528)2a:T117a,"CalmEagle.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter RtlNtStatusToDosError (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter NtDeviceIoControlFile (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter NtSetInformationFile (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter NtQueryVolumeInformationFile (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter NtQueryDirectoryFile (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter SetWinEventHook (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter GetHostNameW (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter GetFileInformationByName (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter RtlCaptureStackBackTrace (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter RtlAddGrowableFunctionTable (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter RtlDeleteGrowableFunctionTable (UID: 00000000-00004528) "CalmEagle.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00004528)2b:T16e3,"var elem = list$1[i$1]; if (elem) { this.checkLValInnerPattern(elem, bindingType, checkClashes); } } break default: this.checkLValSimple(expr, bindingType, checkClashes); } }; pp$7.checkLValInnerPattern = function(expr, bindingType, checkClashes) { if ( bindingType === void 0 ) bindingType = BIND_NONE; switch (expr.type) { case "Property": // AssignmentProperty has type === "Property" this.checkLValInnerPattern(expr.value, bindingType, checkClashes); break case "AssignmentPattern": this.checkLValPattern(expr.left, bindingType, checkClashes); break case "RestElement": this.checkLValPattern(expr.argument, bindingType, checkClashes); break default: this.checkLValPattern(expr, bindingType, checkClashes); } }; // The algorithm used to determine whether a regexp can appear at a // given point in the program is loosely based on sweet.js' approach. // See https://github.com/mozilla/" (Indicator: "github.com") "if (node.name === "await" && !this.awaitIdentPos) { this.awaitIdentPos = node.start; } } return node }; pp$5.parseIdentNode = function() { var node = this.startNode(); if (this.type === types$1.name) { node.name = this.value; } else if (this.type.keyword) { node.name = this.type.keyword; // To fix https://github.com/acornjs/acorn/issues/575 // `class` and `function` keywords push new context into this.context. // But there is no chance to pop the context if the keyword is consumed as an identifier such as a property name. // If the previous token is a dot, this does not apply because the context-managing code already ignored the keyword if ((node.name === "class" || node.name === "function") && (this.lastTokEnd !== this.lastTokStart + 1 || this.input.charCodeAt(this.lastTokStart) !== 46)) { this.context.pop(); } this.type = types$1.name; } else { this.unexpected(); } return node }; p" (Indicator: "github.com") "); if (lineBreak.test(ch)) { this.raise(start, "Unterminated regular expression"); } if (!escaped) { if (ch === "[") { inClass = true; } else if (ch === "]" && inClass) { inClass = false; } else if (ch === "/" && !inClass) { break } escaped = ch === "\\"; } else { escaped = false; } ++this.pos; } var pattern = this.input.slice(start, this.pos); ++this.pos; var flagsStart = this.pos; var flags = this.readWord1(); if (this.containsEsc) { this.unexpected(flagsStart); } // Validate pattern var state = this.regexpState || (this.regexpState = new RegExpValidationState(this)); state.reset(start, pattern, flags); this.validateRegExpFlags(state); this.validateRegExpPattern(state); // Create Literal#value property value. var value = null; try { value = new RegExp(pattern, flags); } catch (e) { // ESTree requires null if it failed to instantiate RegExp object. // https://github.com/estr" (Indicator: "github.com") "erbeke, Ingvar Stepanyan, and // various contributors and released under an MIT license. // // Git repositories for Acorn are available at // // http://marijnhaverbeke.nl/git/acorn // https://github.com/acornjs/acorn.git // // Please use the [github bug tracker][ghbt] to report issues. // // [ghbt]: https://github.com/acornjs/acorn/issues var version = "8.16.0"; Parser.acorn = { Parser: Parser, version: version, defaultOptions: defaultOptions, Position: Position, SourceLocation: SourceLocation, getLineInfo: getLineInfo, Node: Node, TokenType: TokenType, tokTypes: types$1, keywordTypes: keywords, TokContext: TokContext, tokContexts: types, isIdentifierChar: isIdentifierChar, isIdentifierStart: isIdentifierStart, Token: Token, isNewLine: isNewLine, lineBreak: lineBreak, lineBreakG: lineBreakG, nonASCIIwhitespace: nonASCIIwhitespace }; // The main exported interface (under `self.acorn` when in the" (Indicator: "github.com") "// browser) is a `parse` function that takes a code string and returns // an abstract syntax tree as specified by the [ESTree spec][estree]. // // [estree]: https://github.com/estree/estree function parse(input, options) { return Parser.parse(input, options) } // This function tries to parse a single expression at a given // offset in a string. Useful for parsing mixed-language formats // that embed JavaScript expressions. function parseExpressionAt(input, pos, options) { return Parser.parseExpressionAt(input, pos, options) } // Acorn is organized as a tokenizer and a recursive-descent parser. // The `tokenizer` export provides an interface to the tokenizer. function tokenizer(input, options) { return Parser.tokenizer(input, options) } exports.Node = Node; exports.Parser = Parser; exports.Position = Position; exports.SourceLocation = SourceLocation; exports.TokContext = TokContext; exports.Token = Token; exports.TokenType = TokenType; exports.def" (Indicator: "github.com") "'use strict';const { ArrayPrototypeJoin, ArrayPrototypeMap, MathCeil, MathMax, MathMaxApply, ObjectPrototypeHasOwnProperty, StringPrototypeRepeat,} = primordials;const { getStringWidth } = require('internal/util/inspect');// The use of Unicode characters below is the only non-comment use of non-ASCII// Unicode characters in Node.js built-in modules. If they are ever removed or// rewritten with \u escapes, then a test will need to be (re-)added to Node.js// core to verify that Unicode characters work in built-ins.// Refs: https://github.com/nodejs/node/issues/10673const tableChars = { /* eslint-disable node-core/non-ascii-character */ middleMiddle: '" (Indicator: "github.com") "https://github.com/nodejs/node/issues" (Indicator: "github.com")2c:T5f4,"CalmEagle.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe67710000 "CalmEagle.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffea89a0000 "CalmEagle.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffea89a0000 "CalmEagle.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffea89a0000 "CalmEagle.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffea89a0000 "CalmEagle.exe" loaded module "KERNEL32" at base 7ffeab610000 "CalmEagle.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffea89a0000 "CalmEagle.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffea89a0000 "CalmEagle.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffea89a0000 "CalmEagle.exe" loaded module "POWRPROF.DLL" at base 7ffea85f0000 "CalmEagle.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffea6bd0000 "CalmEagle.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffea7e20000 "CalmEagle.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffea79d0000 "CalmEagle.exe" loaded module "KERNEL32.DLL" at base 7ffeab610000 "CalmEagle.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffea8590000 "CalmEagle.exe" loaded module "NTDLL.DLL" at base 7ffeac240000 "CalmEagle.exe" loaded module "RPCRT4.DLL" at base 7ffeaafb0000 "CalmEagle.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffea0f90000 "CalmEagle.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffea16900002d:T55d,"CalmEagle.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: ""; Value: "") "CalmEagle.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\DNSCLIENT"; Key: ""; Value: "") "CalmEagle.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEM\DNSCLIENT"; Key: ""; Value: "") "CalmEagle.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: ""; Value: "") "CalmEagle.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNS"; Key: ""; Value: "") "CalmEagle.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "CalmEagle.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "CalmEagle.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "CalmEagle.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "CalmEagle.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "CalmEagle.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "")2e:T909,"CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "")2f:T5c2,"CalmEagle.exe" trying to access non-existent file "C:\DBGHELP.DLL" "CalmEagle.exe" trying to access non-existent file "C:\dbghelp.dll" "CalmEagle.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "CalmEagle.exe" trying to access non-existent file "C:\USERENV.DLL" "CalmEagle.exe" trying to access non-existent file "C:\USERENV.dll" "CalmEagle.exe" trying to access non-existent file "C:\WINMM.DLL" "CalmEagle.exe" trying to access non-existent file "C:\WINMM.dll" "CalmEagle.exe" trying to access non-existent file "C:\WINMMBASE.DLL" "CalmEagle.exe" trying to access non-existent file "C:\WINMMBASE.dll" "CalmEagle.exe" trying to access non-existent file "C:\DBGCORE.DLL" "CalmEagle.exe" trying to access non-existent file "C:\dbgcore.DLL" "CalmEagle.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "CalmEagle.exe" trying to access non-existent file "C:\FLTLIB.DLL" "CalmEagle.exe" trying to access non-existent file "C:\MSVCP140.DLL" "CalmEagle.exe" trying to access non-existent file "C:\MSVCP140.dll" "CalmEagle.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "CalmEagle.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "CalmEagle.exe" trying to access non-existent file "C:\VCRUNTIME140_1.DLL" "CalmEagle.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "CalmEagle.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "CalmEagle.exe" trying to access non-existent file "C:\BCRYPT.DLL"30:T47a,Found string "--use-openssl-ca" (Indicator: "openssl-"; Source: "00000000-00004528.00000000.293503.1DE80000.00000004.mdmp, 00000000-00004528.00000000.293503.C8540000.00000004.mdmp") Found string "--openssl-shared-config" (Indicator: "openssl-"; Source: "00000000-00004528.00000000.293503.1DE80000.00000004.mdmp, 00000000-00004528.00000000.293503.C8540000.00000004.mdmp") Found string "--openssl-config" (Indicator: "openssl-"; Source: "00000000-00004528.00000000.293503.1DE80000.00000004.mdmp, 00000000-00004528.00000000.293503.C8540000.00000004.mdmp") Found string "--openssl-legacy-provider" (Indicator: "openssl-"; Source: "00000000-00004528.00000000.293503.1DE80000.00000004.mdmp, 00000000-00004528.00000000.293503.C8540000.00000004.mdmp") Found string "--no-use-openssl-ca" (Indicator: "openssl-"; Source: "00000000-00004528.00000000.293503.C8540000.00000004.mdmp") Found string "--no-openssl-legacy-provider" (Indicator: "openssl-"; Source: "00000000-00004528.00000000.293503.C8540000.00000004.mdmp") Found string "--no-openssl-shared-config" (Indicator: "openssl-"; Source: "00000000-00004528.00000000.293503.C8540000.00000004.mdmp")31:T92f,file/memory contains long string with (Indicator: " bind "; File: "CalmEagle.exe") Found reference to API "socket != 0 && socket != INVALID_SOCKET" (Indicator: " socket "; File: "CalmEagle.exe") Found reference to API "GetHostNameW" (Indicator: "gethostname"; Source: "00000000-00004528-00000C2C-3112106966") Found reference to API "cbreamytroyyCallbacksartting to connect to %s:%d (addressType: %d)ddressType: %d)" (Indicator: " connect "; Source: "00000000-00004528.00000000.293503.2071E000.00000004.mdmp") Found reference to API "connect/multiple: attempting to connect to %s:%d (addressType: %d)" (Indicator: " connect "; Source: "00000000-00004528.00000000.293503.AE400000.00000004.mdmp") Found reference to API "getHostname" (Indicator: "gethostname"; Source: "00000000-00004528.00000000.293503.E2640000.00000004.mdmp") Found reference to API "The socket has been disconnected from the Http2Session" (Indicator: " socket "; Source: "00000000-00004528.00000000.293503.E2640000.00000004.mdmp") Found reference to API "Changing the socket encoding is not allowed per RFC7230 Section 3." (Indicator: " socket "; Source: "00000000-00004528.00000000.293503.E2640000.00000004.mdmp") Found reference to API "The socket is already bound to an Http2Session" (Indicator: " socket "; Source: "00000000-00004528.00000000.293503.E2640000.00000004.mdmp") Found reference to API ":authority header is required for CONNECT requests" (Indicator: " connect "; Source: "00000000-00004528.00000000.293503.E2640000.00000004.mdmp") Found reference to API "Bad socket type specified. Valid types are: udp4, udp6" (Indicator: " socket "; Source: "00000000-00004528.00000000.293503.E2640000.00000004.mdmp") Found reference to API "The :scheme header is forbidden for CONNECT requests" (Indicator: " connect "; Source: "00000000-00004528.00000000.293503.E2640000.00000004.mdmp") Found reference to API "The :path header is forbidden for CONNECT requests" (Indicator: " connect "; Source: "00000000-00004528.00000000.293503.E2640000.00000004.mdmp") Found reference to API "TLS socket connection must be securely established" (Indicator: " socket "; Source: "00000000-00004528.00000000.293503.E2640000.00000004.mdmp") Found reference to API "Cannot copy a socket file" (Indicator: " socket "; Source: "00000000-00004528.00000000.293503.E2640000.00000004.mdmp")32:T2ac1,Pattern match: "https://webidl.spec.whatwg.org/#es-any" Pattern match: "https://webidl.spec.whatwg.org/#abstract-opdef-integerpartconst" Pattern match: "https://tc39.es/ecma262/#eqn-modulo//" Pattern match: "https://webidl.spec.whatwg.org/#abstract-opdef-converttointfunction" Pattern match: "https://webidl.spec.whatwg.org/#es-domstring" Pattern match: "https://tc39.es/ecma262/#sec-ecmascript-data-types-and-valuesfunction" Pattern match: "https://webidl.spec.whatwg.org/#js-dictionaryfunction" Pattern match: "https://webidl.spec.whatwg.org/#es-sequencefunction" Pattern match: "https://bugzilla.mozilla.org/show_bug.cgi?id=745678" Heuristic match: "if (allowempty && this.type === types$1.comma) { elts.push(null); } else if (allowtrailingcomma && this.aftertrailingcomma(close)) { break } else if (this.type === types$1.ellipsis) { var rest = this.parserestbinding(); " Pattern match: "https://github.com/mozilla/" Pattern match: "sweet.js/wiki/design" Pattern match: "http://en.wikipedia.org/wiki/operator-precedence_parser" Heuristic match: "case types$1._new: return this.parsenew() case types$1.backquote: return this.parsetemplate() case types$1._import: if (this.options.ecmaversion >= 11) { return this.parseexprimport(fornew) } else { return this.unexp" Pattern match: "https://github.com/acornjs/acorn/issues/575" Heuristic match: "p$5.parseprivateident = function() { var node = this.startnode(); if (this.type === types$1.privateid) { node.name = this.value; } else { this.unexpected(); } this.next(); this.finishnode(node, privateidentifier); // for va" Heuristic match: "return next >= 0xdc00 && next <= 0xdfff ? (c << 10) + next - 0x35fdc00 : c }; regexpvalidationstate.prototype.nextindex = function nextindex (i, forceu) { if ( forceu === void 0 ) forceu = false; var s = this.source; var l = s.length; if (i" Pattern match: "https://www.ecma-international.org/ecma-262/8.0/#prod-pattern" Pattern match: "https://www.ecma-international.org/ecma-262/8.0/#prod-disjunction" Pattern match: "https://www.ecma-international.org/ecma-262/8.0/#prod-alternative" Pattern match: "https://www.ecma-international.org/ecma-262/8.0/#prod-annexb-assertion" Pattern match: "https://www.ecma-international.org/ecma-262/8.0/#prod-quantifier" Pattern match: "https://www.ecma-international.org/ecma-262/8.0/#sec-term" Pattern match: "https://www.ecma-international.org/ecma-262/8.0/#prod-annexb-extendedatom" Pattern match: "https://www.ecma-international.org/ecma-262/8.0/#prod-annexb-invalidbracedquantifier" Pattern match: "https://www.ecma-international.org/ecma-262/8.0/#prod-patterncharacter" Pattern match: "https://www.ecma-international.org/ecma-262/8.0/#prod-annexb-atomescape" Pattern match: "https://www.ecma-international.org/ecma-262/8.0/#sec-atomescape" Pattern match: "https://www.ecma-international.org/ecma-262/8.0/#prod-controlescape" Pattern match: "https://www.ecma-international.org/ecma-262/8.0/#prod-controlletter" Pattern match: "https://www.ecma-international.org/ecma-262/8.0/#prod-annexb-identityescape" Pattern match: "https://www.ecma-international.org/ecma-262/8.0/#prod-characterclassescape" Pattern match: "https://www.ecma-international.org/ecma-262/8.0/#prod-characterclass" Pattern match: "https://www.ecma-international.org/ecma-262/8.0/#prod-nonemptyclassranges" Pattern match: "https://www.ecma-international.org/ecma-262/8.0/#prod-annexb-classescape" Pattern match: "https://tc39.es/ecma262/#prod-classsetexpression" Pattern match: "https://tc39.es/ecma262/#prod-classsubtraction" Pattern match: "https://tc39.es/ecma262/#prod-classsetoperand" Pattern match: "https://tc39.es/ecma262/#prod-classstringdisjunction" Pattern match: "https://tc39.es/ecma262/#prod-classstring" Pattern match: "https://tc39.es/ecma262/#prod-classsetreserveddoublepunctuator" Pattern match: "https://tc39.es/ecma262/#prod-classsetreservedpunctuator" Pattern match: "https://www.ecma-international.org/ecma-262/8.0/#prod-decimaldigits" Pattern match: "https://www.ecma-international.org/ecma-262/8.0/#prod-annexb-legacyoctalescapesequence" Pattern match: "https://www.ecma-international.org/ecma-262/8.0/#prod-octaldigit" Pattern match: "https://github.com/estr" Pattern match: "http://marijnhaverbeke.nl/git/acorn" Pattern match: "https://github.com/estree/estree" Pattern match: "https://github.com/nodejs/node/issues/10673const" Heuristic match: "c:\users\runneradmin\appdata\local\temp\pkg.410bb0b98f5dad11e6199b4f\node\deps\v8\third_party\abseil-cpp\absl\container\internal\raw_hash_set.cc" Pattern match: "https://corretto.aws/downloads/resources/8.492.09.1/amazon-corretto-8.492.09.1-windows-x64-jdk.zip" Heuristic match: "performanceentry.name" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%20ev%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0f" Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0c" Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl" Heuristic match: ".wsh;.ms" Pattern match: "https://nodejs.org/download/release/v22.23.2/node-v22.23.2.tar.gz" Pattern match: "https://nodejs.org/download/release/v22.23.2/node-v22.23.2-headers.tar.gz" Pattern match: "https://nodejs.org/download/release/v22.23.2/win-x64/node.lib" Pattern match: "0www.entrust.net/cps" Pattern match: "www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl" Heuristic match: "izenpe.com" Pattern match: "www.digicert.com" Pattern match: "http://repository.swisssign.com/" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1" Pattern match: "www.entrust.net/cps" Pattern match: "http://www.quovadisglobal.com/cps" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl0y" Pattern match: "directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist" Pattern match: "crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl0y" Pattern match: "directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist" Pattern match: "http://www.accv.es" Pattern match: "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0" Pattern match: "http://ocsp.accv.es" Pattern match: "http://www.firmaprofesional.com/cps0\" Pattern match: "crl.r2m04.amazontrust.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0" Pattern match: "www.digicert.com1!0" Heuristic match: "info@e-szigno.hu" Pattern match: "http://crl.certigna.fr/certignarootca.crl01" Pattern match: "http://crl.dhimyotis.com/certignarootca.crl" Pattern match: "http://www.accv.es/legislacion_c.htm" Pattern match: "http://crl.securetrust.com/sgca.crl" Pattern match: "http://crl.securetrust.com/stca.crl" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.securetrust.com/sgca.crl0" Pattern match: "crl.comodoca.com/comodocertificationauthority.crl" Heuristic match: "accv@accv.es" Pattern match: "www.entrust.net/legal-terms" Heuristic match: "info@izenpe.com" Pattern match: "https://wwww.certigna.fr/autorites/0m" Pattern match: "http://www.cert.fnmt.es/dpcs/m8vg" Pattern match: "http://ocsp.accv.es0" Pattern match: "http://www.accv.es/legislacion_c.htm0u" Pattern match: "www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl0" Heuristic match: "=g2x.st" Heuristic match: "m .ph" Pattern match: "http://www.cert.fnmt.es/dpcs/" Pattern match: "crl.r2m04.amazontrust.com/mitmproxy-236356893075616227624110519622398477259530153583.crl" Heuristic match: "mx.sk" Pattern match: "directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlistd" Pattern match: "directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist----" Pattern match: "http://www.quovadisglobal.com/cps0" Pattern match: "https://wwww.certigna.fr/autorites/" Pattern match: "crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl" Pattern match: "crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl" Pattern match: "crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crld" Pattern match: "http://crl.r2m04.amazontrust.com/mitmproxy-236356893075616227624110519622398477259530153583.crl" Pattern match: "crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crlh" Pattern match: "crl.r2m04.amazontrust.com/mitmproxy-236356893075616227624110519622398477259530153583.crle" Heuristic match: "string.prototype.at" Heuristic match: "%typedarray%.prototype.at" Heuristic match: "src/node_snapshot_stub.cc" Heuristic match: "test/cctest/inspector/test_network_requests_buffer.cc" Heuristic match: "test/cctest/inspector/test_node_protocol.cc" Heuristic match: "test/cctest/node_test_fixture.cc" Heuristic match: "test/cctest/test_aliased_buffer.cc" Heuristic match: "test/cctest/test_base64.cc" Heuristic match: "test/cctest/test_base_object_ptr.cc" Heuristic match: "test/cctest/test_cppgc.cc" Heuristic match: "test/cctest/test_crypto_clienthello.cc" Heuristic match: "test/cctest/test_dataqueue.cc" Heuristic match: "test/cctest/test_environment.cc" Heuristic match: "test/cctest/test_inspector_socket.cc" Heuristic match: "test/cctest/test_inspector_socket_server.cc" Heuristic match: "test/cctest/test_json_utils.cc" Heuristic match: "test/cctest/test_linked_binding.cc" Heuristic match: "test/cctest/test_node_api.cc" Heuristic match: "test/cctest/test_node_crypto.cc" Heuristic match: "test/cctest/test_node_crypto_env.cc" Heuristic match: "test/cctest/test_node_postmortem_metadata.cc" Heuristic match: "test/cctest/test_node_task_runner.cc" Heuristic match: "test/cctest/test_path.cc" Heuristic match: "test/cctest/test_per_process.cc" Heuristic match: "test/cctest/test_platform.cc" Heuristic match: "test/cctest/test_quic_cid.cc" Heuristic match: "test/cctest/test_quic_error.cc" Heuristic match: "test/cctest/test_quic_tokens.cc" Heuristic match: "test/cctest/test_report.cc" Heuristic match: "test/cctest/test_sockaddr.cc" Heuristic match: "test/cctest/test_traced_value.cc" Heuristic match: "test/cctest/test_util.cc" Heuristic match: "{.wf" Heuristic match: "-y.om" Pattern match: "https://github.com/nodejs/node/issues" Pattern match: "https://json-schema.org/draft/2020-12/schema" Heuristic match: "options.name" Pattern match: "https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode" Pattern match: "https://nodejs.org/api/fs.html" Pattern match: "https://nodejs.org/api/permissions.html#file-system-permissions" Heuristic match: "console.info"33:T27e4,Found URL "https://corretto.aws/downloads/resources/8.492.09.1/amazon-corretto-8.492.09.1-windows-x64-jdk.zip" - Source: "00000000-00004528.00000000.293503.00940000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crlarizona1scottsdale1%0" - Source: "00000000-00004528.00000000.293503.1DE80000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlgggggnarrowgggglongshortgebze" - Source: "00000000-00004528.00000000.293503.1DE80000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v22.23.2/node-v22.23.2.tar.gz" - Source: "00000000-00004528.00000000.293503.1DE80000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v22.23.2/node-v22.23.2-headers.tar.gzkill" - Source: "00000000-00004528.00000000.293503.1DE80000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v22.23.2/win-x64/node.libset" - Source: "00000000-00004528.00000000.293503.1DE80000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl" - Source: "00000000-00004528.00000000.293503.1FBA4000.00000004.mdmp") Found URL "http://repository.swisssign.com/(h" - Source: "00000000-00004528.00000000.293503.1FC6B000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cpsnz/" - Source: "00000000-00004528.00000000.293503.1FC6B000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlistarizona1scottsdale1%0" - Source: "00000000-00004528.00000000.293503.20550000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist\\?\c:\users\gy1kmdd\appdata\local\temp\amazon-corretto-8.zip&y" - Source: "00000000-00004528.00000000.293503.20550000.00000004.mdmp") Found URL "http://www.accv.esautoridad" - Source: "00000000-00004528.00000000.293503.205D7000.00000004.mdmp") Found URL "http://www.accv.esecurity=impersonation" - Source: "00000000-00004528.00000000.293503.205D7000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.es" - Source: "00000000-00004528.00000000.293503.205D7000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\(b" - Source: "00000000-00004528.00000000.293503.205D7000.00000004.mdmp") Found URL "http://crl.r2m04.amazontrust.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0?" - Source: "00000000-00004528.00000000.293503.205D7000.00000004.mdmp") Found URL "https://corretto.aws/downloads/resources/8.492.09.1/amazon-corretto-8.492.09.1-windows-x64-jdk.ziptmpdirjava-8-correttoamazon-corretto-8.zipjavaw-pack.jarjdk1.8.0_492java.exe@)e" - Source: "00000000-00004528.00000000.293503.205D7000.00000004.mdmp") Found URL "http://crl.certigna.fr/certignarootca.crl01+http://crl.dhimyotis.com/certignarootca.crl" - Source: "00000000-00004528.00000000.293503.205D7000.00000004.mdmp") Found URL "http://www.accv.es/legislacion_c.htm$i" - Source: "00000000-00004528.00000000.293503.205D7000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crltyz" - Source: "00000000-00004528.00000000.293503.205D7000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crlde1+0)" - Source: "00000000-00004528.00000000.293503.205D7000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crl/h" - Source: "00000000-00004528.00000000.293503.205D7000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlhi" - Source: "00000000-00004528.00000000.293503.205D7000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0,h" - Source: "00000000-00004528.00000000.293503.205D7000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crl0@\i" - Source: "00000000-00004528.00000000.293503.205D7000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crl" - Source: "00000000-00004528.00000000.293503.205D7000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites/0mf0d0/)http://crl.certigna.fr/certignarootca.crl01+http://crl.dhimyotis.com/certignarootca.crlbudapest1microsec" - Source: "00000000-00004528.00000000.293503.205D7000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/m8vgamazon1amazon" - Source: "00000000-00004528.00000000.293503.205D7000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.es0$http://www.accv.es/legislacion_c.htm0un0l0jdhttp://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl0accv@accv.esns" - Source: "00000000-00004528.00000000.293503.205D7000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/ssl.com" - Source: "00000000-00004528.00000000.293503.205D7000.00000004.mdmp") Found URL "http://crl.r2m04.amazontrust.com/mitmproxy-236356893075616227624110519622398477259530153583.crlc:\users\runneradmin\appdata\local\temp\pkg.410bb0b98f5dad11e6199b4f\node\deps\openssl\openssl\crypto\evp\p_lib.cc:\users\runneradmin\appdata\local\temp\pkg.410bb0b98f5dad11e6199b4f\node\deps\openssl\openssl\crypto\evp\p_lib.cus1)0'" - Source: "00000000-00004528.00000000.293503.205D7000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlistdd-trust" - Source: "00000000-00004528.00000000.293503.2071E000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist----" - Source: "00000000-00004528.00000000.293503.2071E000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00004528.00000000.293503.2071E000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\0stategcbtetickinfovalueextdressesfile" - Source: "00000000-00004528.00000000.293503.2071E000.00000004.mdmp") Found URL "http://repository.swisssign.com/certsign1certsign" - Source: "00000000-00004528.00000000.293503.20750000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crldsa-sha2-256fid-slh-dsa-sha2-256f2.16.840.1.101.3.4.3.25!t" - Source: "00000000-00004528.00000000.293503.20750000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites/unitrust1%0" - Source: "00000000-00004528.00000000.293503.20750000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crld-trust" - Source: "00000000-00004528.00000000.293503.20750000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crl-9mqwsey8%nob[" - Source: "00000000-00004528.00000000.293503.20750000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crld" - Source: "00000000-00004528.00000000.293503.20750000.00000004.mdmp") Found URL "http://crl.r2m04.amazontrust.com/mitmproxy-236356893075616227624110519622398477259530153583.crls?" - Source: "00000000-00004528.00000000.293503.20750000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crlhswisssign" - Source: "00000000-00004528.00000000.293503.20750000.00000004.mdmp") Found URL "http://crl.r2m04.amazontrust.com/mitmproxy-236356893075616227624110519622398477259530153583.crle" - Source: "00000000-00004528.00000000.293503.20802000.00000004.mdmp") Found URL "https://corretto.aws/downloads/resources/8.492.09.1/amazon-corretto-8.492.09.1-windows-x64-jdk.zip" - Source: "00000000-00004528.00000000.293503.29A00000.00000004.mdmp") Found URL "http://requesturlupdated" - Source: "00000000-00004528.00000000.293503.4CB00000.00000004.mdmp") Found URL "https://corretto.aws/downloads/resources/8.492.09.1/amazon-corretto-8.492.09.1-windows-x64-jdk.zip9-a]y+a]9+a]y*a]!*a]a*a])o1<)o1<)o1<)o1<)o1<)o1<)o1<)o1<)o1<)o1<)o1<)o1<)o1<)o1<96a]a6a]a5a]a5a]a" - Source: "00000000-00004528.00000000.293503.5D400000.00000004.mdmp") Found URL "https://corretto.aws/downloads/resources/8.492.09.1/amazon-corretto-8.492.09.1-windows-x64-jdk.zipa" - Source: "00000000-00004528.00000000.293503.5E2C0000.00000004.mdmp") Found URL "https://corretto.aws/downloads/resources/8.492.09.1/amazon-corretto-8.492.09.1-windows-x64-jdk.zip>[>ejava-8-correttoamazon-corretto-8.zipjavaw-pack.jarjdk1.8.0_492java.exe13p" - Source: "00000000-00004528.00000000.293503.91940000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v22.23.2/win-x64/node.libnodehttps://nodejs.org/download/release/v22.23.2/node-v22.23.2.tar.gzhttps://nodejs.org/download/release/v22.23.2/node-v22.23.2-headers.tar.gzwin321.34.61.1.02.2.048.078.29.4.30.1.30.0.11.69.03.5.74.5.06.4.23.51.32026a6.28.017.01.51.00.0.2312.4.254.21-node.561.3.1-e00f7031.5.722.23.28.16.02.9.21.1.8\usr\localexecutabletools/icu/icu-generic.gypdeps/icu-small..\..\deps\icu-tmp\icudt78l.dat)" - Source: "00000000-00004528.00000000.293503.A40C0000.00000004.mdmp") Found URL "https://corretto.aws/downloads/resources/8.492.09.1/amazon-corretto-8.492.09.1-windows-x64-jdk.zip" - Source: "00000000-00004528.00000000.293503.BEF00000.00000004.mdmp") Found URL "https://github.com/nodejs/node/issueshostinvalid" - Source: "00000000-00004528.00000000.293503.E2640000.00000004.mdmp") Found URL "https://json-schema.org/draft/2020-12/schemaadditionalpropertiespropertiesoneofitems*+rdminitemsrefreshoptionsnode_tls_reject_unauthorizedsetting" - Source: "00000000-00004528.00000000.293503.E2640000.00000004.mdmp") Found URL "https://nodejs.org/api/cli.html" - Source: "00000000-00004528.00000000.293503.E2640000.00000004.mdmp") Found URL "https://nodejs.org/api/fs.htmldereferenceoptions.dereferenceerroronexistoptions.erroronexistoptions.forcepreservetimestampsoptions.preservetimestampsverbatimsymlinksoptions.verbatimsymlinksoptions.filterexpectdirenoentis" - Source: "00000000-00004528.00000000.293503.E2640000.00000004.mdmp") Found URL "https://nodejs.org/api/permissions.html" - Source: "00000000-00004528.00000000.293503.E2640000.00000004.mdmp")34:T6ec,Found string "HTTP/1.1 400 Bad Request" (Indicator: "HTTP/1.1"; Source: "00000000-00004528.00000000.293503.20550000.00000004.mdmp, 00000000-00004528.00000000.293503.5E2C0000.00000004.mdmp") Found string "HTTP/1.1 408 Request Timeout" (Indicator: "HTTP/1.1"; Source: "00000000-00004528.00000000.293503.20550000.00000004.mdmp, 00000000-00004528.00000000.293503.5E2C0000.00000004.mdmp") Found string "HTTP/1.1 431 Request Header Fields Too Large" (Indicator: "HTTP/1.1"; Source: "00000000-00004528.00000000.293503.20550000.00000004.mdmp, 00000000-00004528.00000000.293503.5E2C0000.00000004.mdmp") Found string "HTTP/1.1 413 Payload Too Large" (Indicator: "HTTP/1.1"; Source: "00000000-00004528.00000000.293503.20550000.00000004.mdmp, 00000000-00004528.00000000.293503.5E2C0000.00000004.mdmp") Found string "GET /downloads/resources/8.492.09.1/amazon-corretto-8.492.09.1-windows-x64-jdk.zip HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004528.00000000.293503.20750000.00000004.mdmp, 00000000-00004528.00000000.293503.5D400000.00000004.mdmp") Found string "HTTP/1.1 400" (Indicator: "HTTP/1.1"; Source: "00000000-00004528.00000000.293503.4CB00000.00000004.mdmp") Found string "HTTP/1.1 408" (Indicator: "HTTP/1.1"; Source: "00000000-00004528.00000000.293503.4CB00000.00000004.mdmp") Found string "HTTP/1.1 431" (Indicator: "HTTP/1.1"; Source: "00000000-00004528.00000000.293503.4CB00000.00000004.mdmp") Found string "HTTP/1.1 413" (Indicator: "HTTP/1.1"; Source: "00000000-00004528.00000000.293503.4CB00000.00000004.mdmp") Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004528.00000000.293503.4CB00000.00000004.mdmp") Found string "HTTP/1.1\r\n" (Indicator: "HTTP/1.1"; Source: "00000000-00004528.00000000.293503.4CB00000.00000004.mdmp")35:T107d,Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; File: "CalmEagle.exe") Found string "Guyanaese dollar" (Indicator: "aes"; File: "CalmEagle.exe") Found string "Guyanaese dollars" (Indicator: "aes"; File: "CalmEagle.exe") Found string "function extractZip(zipFile, destination) {" (Indicator: "zipfile"; Source: "00000000-00004528.00000000.293503.00940000.00000004.mdmp, 00000000-00004528.00000000.293503.29A00000.00000004.mdmp, 00000000-00004528.00000000.293503.BEF00000.00000004.mdmp") Found string "[System.IO.Compression.ZipFile]::ExtractToDirectory(" (Indicator: "zipfile"; Source: "00000000-00004528.00000000.293503.00940000.00000004.mdmp, 00000000-00004528.00000000.293503.205D7000.00000004.mdmp, 00000000-00004528.00000000.293503.29A00000.00000004.mdmp, 00000000-00004528.00000000.293503.91940000.00000004.mdmp, 00000000-00004528.00000000.293503.BEF00000.00000004.mdmp") Found string "'${zipFile.replace(/'/g, "''")}'," (Indicator: "zipfile"; Source: "00000000-00004528.00000000.293503.00940000.00000004.mdmp, 00000000-00004528.00000000.293503.29A00000.00000004.mdmp, 00000000-00004528.00000000.293503.BEF00000.00000004.mdmp") Found string "AESCipherJob" (Indicator: "aes"; Source: "00000000-00004528.00000000.293503.040C0000.00000004.mdmp") Found string "kKeyVariantAES_CTR_128" (Indicator: "aes"; Source: "00000000-00004528.00000000.293503.040C0000.00000004.mdmp") Found string "kKeyVariantAES_CTR_192" (Indicator: "aes"; Source: "00000000-00004528.00000000.293503.040C0000.00000004.mdmp") Found string "kKeyVariantAES_CTR_256" (Indicator: "aes"; Source: "00000000-00004528.00000000.293503.040C0000.00000004.mdmp") Found string "kKeyVariantAES_CBC_128" (Indicator: "aes"; Source: "00000000-00004528.00000000.293503.040C0000.00000004.mdmp") Found string "kKeyVariantAES_CBC_192" (Indicator: "aes"; Source: "00000000-00004528.00000000.293503.040C0000.00000004.mdmp") Found string "kKeyVariantAES_CBC_256" (Indicator: "aes"; Source: "00000000-00004528.00000000.293503.040C0000.00000004.mdmp") Found string "kKeyVariantAES_GCM_128" (Indicator: "aes"; Source: "00000000-00004528.00000000.293503.040C0000.00000004.mdmp") Found string "kKeyVariantAES_GCM_192" (Indicator: "aes"; Source: "00000000-00004528.00000000.293503.040C0000.00000004.mdmp") Found string "kKeyVariantAES_GCM_256" (Indicator: "aes"; Source: "00000000-00004528.00000000.293503.040C0000.00000004.mdmp") Found string "kKeyVariantAES_KW_128" (Indicator: "aes"; Source: "00000000-00004528.00000000.293503.040C0000.00000004.mdmp") Found string "kKeyVariantAES_KW_192" (Indicator: "aes"; Source: "00000000-00004528.00000000.293503.040C0000.00000004.mdmp") Found string "kKeyVariantAES_KW_256" (Indicator: "aes"; Source: "00000000-00004528.00000000.293503.040C0000.00000004.mdmp") Found string "kTicketKeyAESIndex" (Indicator: "aes"; Source: "00000000-00004528.00000000.293503.040C0000.00000004.mdmp") Found string "internal/crypto/aes" (Indicator: "aes"; Source: "00000000-00004528.00000000.293503.1DE80000.00000004.mdmp, 00000000-00004528.00000000.293503.1FBA4000.00000004.mdmp, 00000000-00004528.00000000.293503.42340000.00000004.mdmp, 00000000-00004528.00000000.293503.A40C0000.00000004.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00004528.00000000.293503.1DE80000.00000004.mdmp") file/memory contains long string with (Indicator: "aes128"; Source: "00000000-00004528.00000000.293503.1DE80000.00000004.mdmp") file/memory contains long string with (Indicator: "aes256"; Source: "00000000-00004528.00000000.293503.1DE80000.00000004.mdmp") file/memory contains long string with (Indicator: "chacha"; Source: "00000000-00004528.00000000.293503.1DE80000.00000004.mdmp") file/memory contains long string with (Indicator: "ecdsa"; Source: "00000000-00004528.00000000.293503.1DE80000.00000004.mdmp") Found string "AES-192-CFB" (Indicator: "aes"; Source: "00000000-00004528.00000000.293503.1DE80000.00000004.mdmp") Found string "id-smime-alg-CMS3DESwrap" (Indicator: "3des"; Source: "00000000-00004528.00000000.293503.1DE80000.00000004.mdmp") Found string "AES-192-CBC" (Indicator: "aes"; Source: "00000000-00004528.00000000.293503.1DE80000.00000004.mdmp")36:T909,"CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "CalmEagle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "")37:T400,AAABAAEAICAQrAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAyd3cAAAAAAAAAAAAAAAAzInd3dwAAAAAAAAAAAAAyIiN3d3d3AAAAAAAAAAByMiInd3d3d3cAAAAAAAADMiIiN3d3d3d3cAAAAAADMiIiInd3d3d3d3NwAAADIyIiIid3d3d3d3dzIjAAMyIiIiInd3d3d3d3cyIiAHcyIiIid3d3d3d3d3MiMgB3ciIiInd3d3d3d3dzI3cAd3MiIid3d3d3d3d3cyd3AHd3IiInd3d3d3d3d3J3dwB3d3Iid3d3d3d3d3dzd3cAd3dzI3d3d3d3d3d3d3d3AHd3dyd3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3AHd3d3d3d3d3d3d3d3czIgB3d3d3d3d3d3d3d3d3IiIAd3d3d3d3d3d3d3d3dyIiAHd3d3d3d3d3d3d3d3dyIgB3d3d3d3d3d3d3d3d3ciIAd3d3d3d3d3d3d3d3d3ciAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3d3cAB3d3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3dwAAAAAAd3d3d3d3d3d3dwAAAAAAAAN3d3d3d3d3d3AAAAAAAAAAB3d3d3d3d3AAAAAAAAAAAAAHd3d3d3AAAAAAAAAAAAAAAAd3d3AAAAAAAAD//D////AP///gB///gAH//gAAf/gAAB/wAAAPwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAAD8AAAD/gAAB/+AAB//4AB///gB///8A////w//w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample 8615400bcf92… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample 8615400bcf92…. Threat score 0/100. 0/26 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/8615400bcf929661e1999f3ce277cc478bd619dcfffa241ea6cb747fe12cea30\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"8615400bcf929661e1999f3ce277cc478bd619dcfffa241ea6cb747fe12cea30\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"CalmEagle.exe\",\"applicationCategory\":[\"peexe\",\"64bits\",\"executable\"],\"identifier\":\"8615400bcf929661e1999f3ce277cc478bd619dcfffa241ea6cb747fe12cea30\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":26},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":10},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"8615400bcf929661e1999f3ce277cc478bd619dcfffa241ea6cb747fe12cea30","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1792247814085,"unified_at":"2026-10-17T14:36:54.085Z","metadata":{"hashes":{"sha256":"8615400bcf929661e1999f3ce277cc478bd619dcfffa241ea6cb747fe12cea30","sha1":"fe6d44cb1356b9f56b23a40dbf0497afb5da9020","md5":"6d29690777bcbd59550ccbbd519ec54a","sha512":"57b5ad1a2c37dfdfa9738f7d20daa4e8ef66356d6d4663c0325ad6868f2abec4f58cf9e7db4eed926f50886fdccf3a0be2d2d2e64119746e13671c9de812bdf7","ssdeep":"Unknown","imphash":"9eba512b03d8cac8a6c4424e25e9f06e","pehash":"b61711519aae4fe193c7895b909419409eeab2f7"},"file_info":{"file_name":"CalmEagle.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":78151355,"entropy":7.2,"compile_timestamp":"2026-07-30T07:24:57","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792207885000,"last_seen":1792247613000,"last_multi_scan":1792247613000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":7,"import_count":0,"export_count":0,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":30438580,"raw_size":30438912},{"name":".rdata","virtual_address":"0x1d09000","virtual_size":25039338,"raw_size":25039360},{"name":".data","virtual_address":"0x34eb000","virtual_size":3195756,"raw_size":295424},{"name":".pdata","virtual_address":"0x37f8000","virtual_size":1356144,"raw_size":1356288},{"name":".fptable","virtual_address":"0x3944000","virtual_size":256,"raw_size":512},{"name":".rsrc","virtual_address":"0x3945000","virtual_size":141944,"raw_size":142336},{"name":".reloc","virtual_address":"0x3968000","virtual_size":170232,"raw_size":170496}],"section_names":[".text",".rdata",".data",".pdata",".fptable",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":43},"sandbox_signatures":{"informative_count":89,"suspicious_count":10,"malicious_count":0,"total":99},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Credential Access","technique":"Golden Ticket","attack_id":"T1558.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1558/001","identifiers":[{"type":"suspicious","value":"Able to forge Kerberos ticket"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"suspicious","value":"Attempts to retrieve geographical location information"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"suspicious","value":"Read windows product name from registry"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to retrieve system network configuration"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"informative","value":"YARA signature match - Zlib compression"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains reference to OpenSSL library string"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"YARA signature match – Zlib compression file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains possible references to Golang crypto modules"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$24","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$25","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\nul; Source: \"00000000-00004528.00000000.293503.42340000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"CalmEagle.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at A0540000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"CalmEagle.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"CalmEagle.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"CalmEagle.exe\" queried SystemProcessInformation at 00000000-00004528-00000C15-3111577380 [PID: 4528]\n \"CalmEagle.exe\" queried SystemProcessInformation at 00000000-00004528-00000C15-3111593676 [PID: 4528]\n \"CalmEagle.exe\" queried SystemProcessInformation at 00000000-00004528-00000C15-3111783992 [PID: 4528]\n \"CalmEagle.exe\" queried SystemProcessInformation at 00000000-00004528-00000C15-3111794252 [PID: 4528]\n \"CalmEagle.exe\" queried SystemProcessInformation at 00000000-00004528-00000C15-3112193732 [PID: 4528]\n \"CalmEagle.exe\" queried SystemProcessInformation at 00000000-00004528-00000C15-3112206727 [PID: 4528]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"fromcharcode\"; File: \"CalmEagle.exe\")\n Found reference to API \"fromCharCode\" (Indicator: \"fromcharcode\"; Source: \"00000000-00004528.00000000.293503.3C300000.00000002.mdmp\")\n Found reference to API \"StringFromCharCodeApply\" (Indicator: \"fromcharcode\"; Source: \"00000000-00004528.00000000.293503.E2640000.00000004.mdmp\")\n Found reference to API \"StringFromCharCode\" (Indicator: \"fromcharcode\"; Source: \"00000000-00004528.00000000.293503.E2640000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains possible references to Golang crypto modules","description":"$26","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004528.00000000.293503.1DE80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"Public key is not valid for specified curve\" (Indicator: \"public key\"; Source: \"00000000-00004528.00000000.293503.E2640000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - PowerShell with Base64 encoding\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to decrypt/decode data\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains possible references to Golang crypto modules\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: YARA signature match - PowerShell with Base64 encoding\n Matched sigs: YARA signature match - ChaCha20 encryption algorithm\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match – cryptographic algorithms","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; File: \"CalmEagle.exe\")\n Found string \"https://github.com/nodejs/node/issues\" (Indicator: \"github.com\"; Source: \"00000000-00004528.00000000.293503.E2640000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004528-00000C2C-3112072453\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"getOSVersion\" (Source: \"00000000-00004528.00000000.293503.42340000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004528-00000C2C-3112072453\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"getCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00004528.00000000.293503.91940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"C:\\Users\\runneradmin\\AppData\\Local\\Temp\\pkg.410bb0b98f5dad11e6199b4f\\node\\deps\\uv\\src\\win\\getaddrinfo.c\" (Indicator: \"getaddrinfo\"; File: \"CalmEagle.exe\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00004528.00000000.293503.040C0000.00000004.mdmp\")\n Found reference to API \"GetAddrInfoReqWrap\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00004528.00000000.293503.040C0000.00000004.mdmp\")\n Found reference to API \"GETADDRINFOREQWRAP\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00004528.00000000.293503.E2640000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"postMessageToThread\" (Indicator: \"postmessage\"; Source: \"00000000-00004528.00000000.293503.91940000.00000004.mdmp\")\n Found reference to API \"sendMessageToWorker\" (Indicator: \"sendmessage\"; Source: \"00000000-00004528.00000000.293503.91940000.00000004.mdmp\")\n Found reference to API \"postMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00004528.00000000.293503.E2640000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"CalmEagle.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00004528)\n \"CalmEagle.exe\" called \"GetAdaptersAddresses\" with parameters (UID: 00000000-00004528)\n \"CalmEagle.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004528)\n \"CalmEagle.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00004528)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"CalmEagle.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004528)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"CalmEagle.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004528)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"CalmEagle.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver D\" (Indicator: \"ver \") in Source: 00000000-00004528.00000000.293503.205D7000.00000004.mdmp\n 00000000-00004528.00000000.293503.20750000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"Found string \"kPerfHooksDnsLookupContext\" (Indicator: \"nslookup\"; Source: \"00000000-00004528.00000000.293503.4CB00000.00000004.mdmp\")\n Found string \"kPerfHooksDnsLookupServiceContext\" (Indicator: \"nslookup\"; Source: \"00000000-00004528.00000000.293503.4CB00000.00000004.mdmp\")\n Found string \"kPerfHooksDnsLookupResolveContext\" (Indicator: \"nslookup\"; Source: \"00000000-00004528.00000000.293503.4CB00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\%d\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: CalmEagle.exe","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$28","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"CalmEagle.exe\" queried token user identity (UID: 00000000-00004528)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"CalmEagle.exe\" queries volume information of \"C:\\CalmEagle.exe\" at 00000000-00004528-00000C17-3112460812\n \"CalmEagle.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\amazon-corretto-8.zip\" at 00000000-00004528-00000C17-3113029755","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"CalmEagle.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"CalmEagle.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$29","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"18.164.96.84:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"getsockname\"; Source: \"00000000-00004528.00000000.293503.040C0000.00000004.mdmp\")\n Found reference to API (Indicator: \"getpeername\"; Source: \"00000000-00004528.00000000.293503.040C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"r || GetLastError() == ERROR_NOT_FOUND\" (Indicator: \"GetLastError\"; File: \"CalmEagle.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"Found string \"`Start-Process -FilePath '${javaExe}' ` +\" (Indicator: \"Start-Process\"; Source: \"00000000-00004528.00000000.293503.00940000.00000004.mdmp, 00000000-00004528.00000000.293503.29A00000.00000004.mdmp, 00000000-00004528.00000000.293503.BEF00000.00000004.mdmp\")\n Found string \"Start-Process -FilePath '\" (Indicator: \"Start-Process\"; Source: \"00000000-00004528.00000000.293503.91940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-250","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\%d\" in Source: CalmEagle.exe\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\" in Source: CalmEagle.exe\n \"SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps\" in Source: CalmEagle.exe\n \"SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\" in Source: CalmEagle.exe\n \"SYSTEM\\CurrentControlSet\\Services\\Tcpip6\\Parameters\\Interfaces\" in Source: CalmEagle.exe\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\" in Source: CalmEagle.exe","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process CalmEagle.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:4528:304:WilStaging_02\"\n Process CalmEagle.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4528:304:WilStaging_02\"\n Process CalmEagle.exe created mutex with name \"Local\\SM0:4528:304:WilStaging_02\"\n Process CalmEagle.exe created mutex with name \"SM0:4528:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"appro@openssl.org\"\n Pattern match: \"info@e-szigno.hu\"\n Pattern match: \"accv@accv.es\"\n Pattern match: \"info@izenpe.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"$2b","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"CalmEagle.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at A8640000\n \"CalmEagle.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at A80F0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"CalmEagle.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at AAFB0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"CalmEagle.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"CalmEagle.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"corretto.aws\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"CalmEagle.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"CalmEagle.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"CalmEagle.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NATION\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Amazon RSA 2048 M04, O=Amazon, C=US\" (SHA1: 1F:EC:D9:1A:88:0F:D2:EC:20:3C:AA:36:35:97:BC:BB:2C:0D:EF:72; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Amazon Root CA 1, O=Amazon, C=US\" (SHA1: E7:B8:B5:A6:74:3C:E1:B2:F1:7B:04:1D:E5:95:58:A4:14:72:D7:0C; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Starfield Services Root Certificate Authority - G2, O=\"Starfield Technologies\n Inc.\", L=Scottsdale, ST=Arizona, C=US\" (SHA1: 06:B2:59:27:C4:2A:72:16:31:C1:EF:D9:43:1E:64:8F:A6:2E:1E:39; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"Found string \"Add-Type -AssemblyName System.IO.Compression.FileSystem;\" (Indicator: \"Add-Type\"; Source: \"00000000-00004528.00000000.293503.00940000.00000004.mdmp, 00000000-00004528.00000000.293503.205D7000.00000004.mdmp, 00000000-00004528.00000000.293503.29A00000.00000004.mdmp, 00000000-00004528.00000000.293503.91940000.00000004.mdmp, 00000000-00004528.00000000.293503.BEF00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"CalmEagle.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"CalmEagle.exe\" queries basic process information of the \"C:\\CalmEagle.exe\" (UID: 4528)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"CalmEagle.exe\" reads file \"c:\\calmeagle.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"CalmEagle.exe\" trying to touch file \"\\Device\\ConDrv\\Server\"\n \"CalmEagle.exe\" trying to touch file \"\\Device\\ConDrv\\\\Reference\"\n \"CalmEagle.exe\" trying to touch file \"\\Device\\ConDrv\\\\Connect\"\n \"CalmEagle.exe\" trying to touch file \"C:\\DBGHELP.DLL\"\n \"CalmEagle.exe\" trying to touch file \"C:\\dbghelp.dll\"\n \"CalmEagle.exe\" trying to touch file \"C:\\Windows\\System32\\dbghelp.dll\"\n \"CalmEagle.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\dbghelp.dll\"\n \"CalmEagle.exe\" trying to touch file \"C:\\IPHLPAPI.DLL\"\n \"CalmEagle.exe\" trying to touch file \"C:\\Windows\\System32\\IPHLPAPI.DLL\"\n \"CalmEagle.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\IPHLPAPI.DLL\"\n \"CalmEagle.exe\" trying to touch file \"C:\\USERENV.DLL\"\n \"CalmEagle.exe\" trying to touch file \"C:\\USERENV.dll\"\n \"CalmEagle.exe\" trying to touch file \"C:\\Windows\\System32\\userenv.dll\"\n \"CalmEagle.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\USERENV.dll\"\n \"CalmEagle.exe\" trying to touch file \"C:\\WINMM.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$2f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"CalmEagle.exe\" trying to access non-existent file \"C:\\PACKAGE.JSON\"\n \"CalmEagle.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AMAZON-CORRETTO-8.ZIP\"\n \"CalmEagle.exe\" trying to access non-existent file \"C:\\Users\\gY1kMDd\\AppData\\Local\\Temp\\amazon-corretto-8.zip\"\n \"CalmEagle.exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}\"\n \"CalmEagle.exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}\"\n \"CalmEagle.exe\" trying to access non-existent file \"\\Device\\RasAcd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Network Related","name":"Contains reference to OpenSSL library string","description":"$30","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-494","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"mx.sk\" [Source: 00000000-00004528.00000000.293503.205D7000.00000004.mdmp\n 00000000-00004528.00000000.293503.20750000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"27.0.0.1\"\n Potential IP \"12.4.254.21\" found in string \"12.4.254.21-node.56\"\n \"3.4.1.6\"\n \"1.3.101.112\"\n \"1.3.101.113\"\n \"1.3.101.111\"\n \"1.3.101.110\"\n \"127.0.0.1\"\n \"2.2.1.16\"\n \"12.2.2.8\"\n \"18.164.96.84\"\n \"18.164.96.55\"\n \"18.164.96.38\"\n \"18.164.96.121\"\n \"0.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$32","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$33","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$34","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://webidl.spec.whatwg.org\"\n Found HTTPS url \"https://tc39.es\"\n Found HTTPS url \"https://bugzilla.mozilla.org\"\n Found HTTPS url \"https://github.com\"\n Found HTTPS url \"https://www.ecma\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"18.164.96.84\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Zlib compression","description":"YARA signature for zlib compression library used in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1560","relevance":2,"id":"yara-137","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Zlib compression file detected","description":"YARA signature for file using Zlib compression matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1132.001","relevance":3,"id":"yara-161","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"CalmEagle.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"CalmEagle.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$35","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"Dir D\" (Indicator: \"dir \"; Source: \"00000000-00004528.00000000.293503.20750000.00000004.mdmp\")\n Found string \"dir D\" (Indicator: \"dir \"; Source: \"00000000-00004528.00000000.293503.20750000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00004528.00000000.293503.040C0000.00000004.mdmp\")\n Found reference to API \"_getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00004528.00000000.293503.205D7000.00000004.mdmp, 00000000-00004528.00000000.293503.C8540000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"secret\" (Indicator: \"secret\"; Source: \"00000000-00004528.00000000.293503.42340000.00000004.mdmp\")\n Found string \"by writing secret key material to file\" (Indicator: \"secret\"; Source: \"00000000-00004528.00000000.293503.4CB00000.00000004.mdmp\")\n Found string \"get password\" (Indicator: \"password\"; Source: \"00000000-00004528.00000000.293503.70580000.00000004.mdmp\")\n Found string \"set password\" (Indicator: \"password\"; Source: \"00000000-00004528.00000000.293503.70580000.00000004.mdmp\")\n Found string \"data (such as passwords, tokens and authentication headers)\" (Indicator: \"password\"; Source: \"00000000-00004528.00000000.293503.E2640000.00000004.mdmp\")\n Found string \"password\" (Indicator: \"password\"; Source: \"00000000-00004528.00000000.293503.E2640000.00000004.mdmp\")\n Found string \"per_realm_crypto_key_object_secret_constructor\" (Indicator: \"secret\"; Source: \"00000000-00004528.00000000.293503.E2640000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"get hostname\" (Indicator: \"hostname\"; Source: \"00000000-00004528.00000000.293503.70580000.00000004.mdmp\")\n Found string \"set hostname\" (Indicator: \"hostname\"; Source: \"00000000-00004528.00000000.293503.70580000.00000004.mdmp\")\n Found string \"hostname\" (Indicator: \"hostname\"; Source: \"00000000-00004528.00000000.293503.E2640000.00000004.mdmp\")\n Found string \"The provided hostname \"\" (Indicator: \"hostname\"; Source: \"00000000-00004528.00000000.293503.E2640000.00000004.mdmp\"), Found string \"HTTP2 ping cancelled\" (Indicator: \"ping\"; Source: \"00000000-00004528.00000000.293503.E2640000.00000004.mdmp\"), Found string \"HTTP2 ping payload must be 8 bytes\" (Indicator: \"ping\"; Source: \"00000000-00004528.00000000.293503.E2640000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\Afd\" (Indicator: \"\\Device\\\"; File: \"CalmEagle.exe\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00004528.00000000.293503.1DE80000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\CalmEagle.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004528.00000000.293503.1DE80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00004528.00000000.293503.E2640000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"CalmEagle.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"CalmEagle.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00004528.00000000.293503.1DE80000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00004528.00000000.293503.1DE80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"CalmEagle.exe\" called \"CryptAcquireContextW\" with parameters {\"phProv\": \"c03ff61d44010000\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531904\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve geographical location information","description":"\"CalmEagle.exe\" called \"GetUserGeoID\" with parameters {\"GeoClass\": \"16\"}\n \"CalmEagle.exe\" called \"GetGeoInfoW\" with parameters {\"Location\": \"244\"\n \"GeoType\": \"4\"\n \"lpGeoData\": \"5439573\"\n \"cchData\": \"3\"\n \"LangId\": \"0\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-308","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\CalmEagle.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"CalmEagle.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\Ole\" (Filter: 268435457; Subtree: 0)\n \"CalmEagle.exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\\Local Settings\\Software\\Microsoft\" (Filter: 268435457; Subtree: 1)\n \"CalmEagle.exe\" monitors \"HKLM\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 0)\n \"CalmEagle.exe\" monitors \"HKLM\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 0)","origin":"API Call","mitre_attack_id":"T1012","relevance":1,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 18.164.96.84 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to forge Kerberos ticket","description":"Found string \"kTicketKeyReturnIndex\" (Indicator: \"kticket\"; Source: \"00000000-00004528.00000000.293503.040C0000.00000004.mdmp\")\n Found string \"kTicketKeyHMACIndex\" (Indicator: \"kticket\"; Source: \"00000000-00004528.00000000.293503.040C0000.00000004.mdmp\")\n Found string \"kTicketKeyAESIndex\" (Indicator: \"kticket\"; Source: \"00000000-00004528.00000000.293503.040C0000.00000004.mdmp\")\n Found string \"kTicketKeyNameIndex\" (Indicator: \"kticket\"; Source: \"00000000-00004528.00000000.293503.040C0000.00000004.mdmp\")\n Found string \"kTicketKeyIVIndex\" (Indicator: \"kticket\"; Source: \"00000000-00004528.00000000.293503.040C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558.001","relevance":1,"id":"string-755","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"CalmEagle.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"CalmEagle.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\amazon-corretto-8.zip\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"CalmEagle.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\amazon-corretto-8.zip\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00004008-00000BC0-2071208090]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]}],"intel_graph":{"map":{"Domain:e65d356ae9418c8df0b123e49966b00cc40eb8817582066cd1973cc28058df14":{"type":"Domain","value":"corretto.aws","verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},"File:73c176434f1bc6d5adf45b0e76e727287c8de57616c1e6e6141a2b2cbc7d8e4c":{"type":"File","value":"73c176434f1bc6d5adf45b0e76e727287c8de57616c1e6e6141a2b2cbc7d8e4c","filetype":"Certificate, Version=3","filetype_short":"CERT","mime_type":"application/x-x509-ca-cert"},"File:8615400bcf929661e1999f3ce277cc478bd619dcfffa241ea6cb747fe12cea30":{"type":"File","value":"8615400bcf929661e1999f3ce277cc478bd619dcfffa241ea6cb747fe12cea30","filetype":"PE32+ executable (console) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"Ip:18.164.96.121":{"type":"Ip","value":"18.164.96.121"},"Ip:18.164.96.84":{"type":"Ip","value":"18.164.96.84"}},"chains":[{"id":"1561024416748372845","root":"File:8615400bcf929661e1999f3ce277cc478bd619dcfffa241ea6cb747fe12cea30","edges":[{"edge_kind":"contacted_domain","from_key":"File:8615400bcf929661e1999f3ce277cc478bd619dcfffa241ea6cb747fe12cea30","to_key":"Domain:e65d356ae9418c8df0b123e49966b00cc40eb8817582066cd1973cc28058df14"}],"verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},{"id":"1561024402879146626","root":"File:8615400bcf929661e1999f3ce277cc478bd619dcfffa241ea6cb747fe12cea30","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8615400bcf929661e1999f3ce277cc478bd619dcfffa241ea6cb747fe12cea30","to_key":"File:73c176434f1bc6d5adf45b0e76e727287c8de57616c1e6e6141a2b2cbc7d8e4c"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_network","root":"File:8615400bcf929661e1999f3ce277cc478bd619dcfffa241ea6cb747fe12cea30","edges":[{"edge_kind":"contacted_ip","from_key":"File:8615400bcf929661e1999f3ce277cc478bd619dcfffa241ea6cb747fe12cea30","to_key":"Ip:18.164.96.84"},{"edge_kind":"contacted_ip","from_key":"File:8615400bcf929661e1999f3ce277cc478bd619dcfffa241ea6cb747fe12cea30","to_key":"Ip:18.164.96.121"},{"edge_kind":"contacted_domain","from_key":"File:8615400bcf929661e1999f3ce277cc478bd619dcfffa241ea6cb747fe12cea30","to_key":"Domain:e65d356ae9418c8df0b123e49966b00cc40eb8817582066cd1973cc28058df14"},{"edge_kind":"resolves_to","from_key":"Domain:e65d356ae9418c8df0b123e49966b00cc40eb8817582066cd1973cc28058df14","to_key":"Ip:18.164.96.84"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:8615400bcf929661e1999f3ce277cc478bd619dcfffa241ea6cb747fe12cea30","edges":[{"edge_kind":"extracted","from_key":"File:8615400bcf929661e1999f3ce277cc478bd619dcfffa241ea6cb747fe12cea30","to_key":"File:73c176434f1bc6d5adf45b0e76e727287c8de57616c1e6e6141a2b2cbc7d8e4c"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":53,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":7,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":1,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6ad3873a8540824aa90b2603","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"no specific threat","contacted_countries":["USA"],"submit_name":"CalmEagle.exe","analysis_start_time":"2026-10-17T14:33:35+00:00","indicators_count":{"informative":87,"suspicious":15,"malicious":0},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"6ad2ec06fb9667873605049c","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"no specific threat","contacted_countries":["USA"],"submit_name":"CalmEagle.exe","analysis_start_time":"2026-10-17T03:31:29+00:00","indicators_count":{"informative":87,"suspicious":16,"malicious":0},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"18.164.96.84","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"}]},{"address":"18.164.96.121","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]}],"dns_resolutions":[{"domain":"corretto.aws","address":"18.164.96.84","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]}],"http_requests":null,"embedded_domains":[{"value":"corretto.aws","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"}],"processes":[{"pid":4528,"ppid":0,"name":"CalmEagle.exe","command_line":"","sha256":"8615400bcf929661e1999f3ce277cc478bd619dcfffa241ea6cb747fe12cea30","normalized_path":"C:\\CalmEagle.exe","uid":"00000000-00004528","icon":"$37"}],"all_imported_dlls":["kernel32.dll","KernelBase.dll","sechost.dll","ole32.dll","cfgmgr32.dll","SHCore.dll","shlwapi.dll","profapi.dll","ws2_32.dll","msasn1.dll","msvcp_win.dll","kernel.appcore.dll","dbgcore.dll","vcruntime140.dll","dhcpcsvc6.dll","dbghelp.dll","IPHLPAPI.DLL","imm32.dll","rsaenh.dll","bcrypt.dll","dhcpcsvc.dll","FWPUCLNT.DLL","rpcrt4.dll","ucrtbase.dll","shell32.dll","powrprof.dll","userenv.dll","winmm.dll","cryptbase.dll","fltLib.dll","ntdll.dll","crypt32.dll","combase.dll","windows.storage.dll","msvcp140.dll","vcruntime140_1.dll","cryptsp.dll","oleaut32.dll","user32.dll","win32u.dll","bcryptprimitives.dll","nsi.dll","dnsapi.dll","rasadhlp.dll","advapi32.dll","msvcrt.dll","gdi32.dll","gdi32full.dll","winmmbase.dll","VxSSL64.dll","uxtheme.dll","mswsock.dll","umpdc.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"73c176434f1bc6d5adf45b0e76e727287c8de57616c1e6e6141a2b2cbc7d8e4c","sha256":"73c176434f1bc6d5adf45b0e76e727287c8de57616c1e6e6141a2b2cbc7d8e4c","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"}]},{"path":"%TEMP%\\amazon-corretto-8.zip","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"},{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"}]},{"name":"Local\\SM0:4528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"}]},{"name":"SM0:4528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad2ec06fb9667873605049c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4008:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4008:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"name":"SM0:4008:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]},{"name":"Local\\SM0:4008:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad3873a8540824aa90b2603"}]}]}},"report_ids":{"sandbox_job_ids":["6ad3873a8540824aa90b2603","6ad2ec06fb9667873605049c"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Sample 8615400bcf92… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 8615400bcf92…. Threat score 0/100. 0/26 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8615400bcf929661e1999f3ce277cc478bd619dcfffa241ea6cb747fe12cea30"}],["$","meta","4",{"property":"og:title","content":"Sample 8615400bcf92… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 8615400bcf92…. Threat score 0/100. 0/26 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8615400bcf929661e1999f3ce277cc478bd619dcfffa241ea6cb747fe12cea30"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 8615400bcf92… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 8615400bcf92…. Threat score 0/100. 0/26 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L38","11",{}]]