34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 70:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4a0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious IL:Trojan.MSILZilla Sample 8fa095b2a5d9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8fa095b2a5d9…. Malware family: IL:Trojan.MSILZilla. Threat score 100/100. 22/35 AV engines flagged this file. 19 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8fa095b2a5d9876f09f6275545fe61a06b51ba771f2ee2d873b2914a63243a70","keywords":["Malicious","IL:Trojan.MSILZilla","malware analysis","sandbox report","threat intelligence","8fa095b2a5d9876f09f6275545fe61a06b51ba771f2ee2d873b2914a63243a70"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","assembly","executable"],"identifier":"8fa095b2a5d9876f09f6275545fe61a06b51ba771f2ee2d873b2914a63243a70","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"IL:Trojan.MSILZilla","antivirusDetections":{"malicious":22,"total":35},"behavioralIndicators":{"malicious":19,"suspicious":28},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:Tb53,Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "read_buf" (Indicator: "read"; Source: "sample.bin"), Found reference to API "get_CreationTime" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "get_CreationTime" (Indicator: "time"; Source: "sample.bin"), Found reference to API "CreateEncryptor" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "CreateEncryptor" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "close"; Source: "sample.bin"), Found reference to API "Saving_AfterWriteEntry" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "Saving_AfterWriteEntry" (Indicator: "write"; Source: "sample.bin"), Found reference to API "_GzipMtime" (Indicator: "time"; Source: "sample.bin"), Found reference to API "CreateForWriter" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "CreateForWriter" (Indicator: "write"; Source: "sample.bin"), Found reference to API "CreateFromFile" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "FileSelector" (Indicator: "select"; Source: "sample.bin"), Found reference to API "get_AlternateEncodingUsage" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "the file {0} exists; will overwrite it..." (Indicator: "write"; Source: "sample.bin"), Found reference to API "ReadTransformOneBlock" (Indicator: "read"; Source: "sample.bin"), Found reference to API "_Mtime" (Indicator: "time"; Source: "sample.bin"), Found reference to API "The entry '{0}' already exists in the zip archive." (Indicator: "read"; Source: "sample.bin"), Found reference to API "WriteEnter" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "WriteEnter" (Indicator: "write"; Source: "sample.bin"), Found reference to API "Reading zip {0}..." (Indicator: "read"; Source: "sample.bin"), Found reference to API " Timeblob: 0x{0:X8} " (Indicator: "time"; Source: "sample.bin"), Found reference to API "WritePasswords" (Indicator: "write"; Source: "sample.bin"), Found reference to API "_SetTimes" (Indicator: "time"; Source: "sample.bin"), Found reference to API "_SetTimes" (Indicator: "times"; Source: "sample.bin"), Found reference to API "GetLastWriteTime" (Indicator: "time"; Source: "sample.bin"), Found reference to API "GetLastWriteTime" (Indicator: "write"; Source: "sample.bin"), Found reference to API "static_len" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "use AlternateEncoding instead." (Indicator: "tee"; Source: "sample.bin"), Found reference to API "set_ReadProgress" (Indicator: "read"; Source: "sample.bin"), Found reference to API "Saving_BeforeWriteEntry" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "Saving_BeforeWriteEntry" (Indicator: "write"; Source: "sample.bin")37:T8ef,Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptDestroyKey"; Source: "sample.bin"), Found reference to API (Indicator: "SendARP"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptGetProperty"; Source: "sample.bin"), Found reference to API (Indicator: "EncryptMessage"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptImportKey"; Source: "sample.bin"), Found reference to API (Indicator: "DecryptMessage"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectory"; Source: "sample.bin"), Found reference to API (Indicator: "GetLength"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "GetParent"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessage"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "CloseClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "CryptUnprotectData"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptEncrypt"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "QueueUserWorkItem"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptSetProperty"; Source: "sample.bin"), Found reference to API (Indicator: "GetObject"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileName"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "GetClipboardData"; Source: "sample.bin"), Found reference to API (Indicator: "OpenClipboard"; Source: "sample.bin")38:T8fd,Found string "CreateEncryptor" (Indicator: "createencryptor"; Source: "sample.bin"), Found string "GZipStream" (Indicator: "GzipStream"; Source: "sample.bin"), Found string "The archive requires a ZIP64 Central Directory. Consider setting the ZipFile.UseZip64WhenSaving property." (Indicator: "zipfile"; Source: "sample.bin"), Found string "_aesCipher" (Indicator: "aes"; Source: "sample.bin"), Found string "_aesCrypto_forWrite" (Indicator: "aes"; Source: "sample.bin"), Found string "ZipFile::{0}" (Indicator: "zipfile"; Source: "sample.bin"), Found string "WinZipAesCipherStream" (Indicator: "aes"; Source: "sample.bin"), Found string "AesBlockSize" (Indicator: "aes"; Source: "sample.bin"), Found string " Inconsistent size (0x{0:X4}) in WinZip AES field at position 0x{1:X16}" (Indicator: "aes"; Source: "sample.bin"), Found string "Twofish" (Indicator: "twofish"; Source: "sample.bin"), Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "sample.bin"), Found string "_CompressionMethod_FromZipFile" (Indicator: "zipfile"; Source: "sample.bin"), Found string "ToBase64String" (Indicator: "base64"; Source: "sample.bin"), Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "sample.bin"), Found string "zipFile" (Indicator: "zipfile"; Source: "sample.bin"), Found string "WinZipAesCrypto" (Indicator: "aes"; Source: "sample.bin"), Found string "cAesGcm" (Indicator: "aes"; Source: "sample.bin"), Found string "ProcessExtraFieldWinZipAes" (Indicator: "aes"; Source: "sample.bin"), Found string "You must call ZipFile.Save before calling any Extract method" (Indicator: "zipfile"; Source: "sample.bin"), Found string " Unexpected vendor version number (0x{0:X4}) for WinZip AES metadata at position 0x{1:X16}" (Indicator: "aes"; Source: "sample.bin"), Found string "Use Extract() only with ZipFile." (Indicator: "zipfile"; Source: "sample.bin"), Found string "IsZipFile" (Indicator: "zipfile"; Source: "sample.bin"), Found string "Supply a password to use AES encryption." (Indicator: "aes"; Source: "sample.bin"), Found string "Maestro Card" (Indicator: "aes"; Source: "sample.bin"), Found string "AesKeySize" (Indicator: "aes"; Source: "sample.bin"), Found string " ZipFile: {0} " (Indicator: "zipfile"; Source: "sample.bin")39:T56c,Observed string: "\LitecoinCore\wallet.dat" (Indicator: "\litecoincore\wallet.dat") in Source: sample.bin, Observed string: "\Coinomi\Coinomi\wallets" (Indicator: "\coinomi\coinomi\wallets") in Source: sample.bin, Observed string: "\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb" (Indicator: "\com.liberty.jaxx\indexeddb") in Source: sample.bin, Observed string: "\atomic\Local Storage\leveldb" (Indicator: "\atomic\local storage") in Source: sample.bin, Observed string: "\Electrum\wallets" (Indicator: "\electrum\wallets") in Source: sample.bin, Observed string: "\Wallets\Zcash\" (Indicator: "\zcash\") in Source: sample.bin, Observed string: "\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\" (Indicator: "\com.liberty.jaxx\indexeddb") in Source: sample.bin, Observed string: "\Ethereum\keystore" (Indicator: "\ethereum\keystore") in Source: sample.bin, Observed string: "\Wallets\Jaxx\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\" (Indicator: "\com.liberty.jaxx\indexeddb") in Source: sample.bin, Observed string: "\Exodus\exodus.wallet" (Indicator: "\exodus\exodus.wallet") in Source: sample.bin, Observed string: "\Wallets\Monero\" (Indicator: "\monero\") in Source: sample.bin, Observed string: "\Guarda\Local Storage\leveldb" (Indicator: "\guarda\local storage") in Source: sample.bin, Observed string: "\Zcash\" (Indicator: "\zcash\") in Source: sample.bin3a:T8cb,"\7Star\7Star\User Data\" (Indicator: "7star\user data") in Source: sample.bin, "\CatalinaGroup\Citrio\User Data\" (Indicator: "catalinagroup\citrio\user data") in Source: sample.bin, "\Google\Chrome\User Data\" (Indicator: "google\chrome\user data") in Source: sample.bin, "\Elements Browser\User Data\" (Indicator: "elements browser\user data") in Source: sample.bin, "\Orbitum\User Data\" (Indicator: "orbitum\user data") in Source: sample.bin, "\uCozMedia\Uran\User Data\" (Indicator: "ucozmedia\uran\user data") in Source: sample.bin, "\Sputnik\Sputnik\User Data\" (Indicator: "sputnik\user data") in Source: sample.bin, "\Chromodo\User Data\" (Indicator: "chromodo\user data") in Source: sample.bin, "\CocCoc\Browser\User Data\" (Indicator: "coccoc\browser\user data") in Source: sample.bin, "\Torch\User Data\" (Indicator: "torch\user data") in Source: sample.bin, "\BraveSoftware\Brave-Browser\User Data\" (Indicator: "bravesoftware\brave-browser\user data") in Source: sample.bin, "\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\" (Indicator: "fenrir inc\sleipnir5\setting\modules\chromiumviewer") in Source: sample.bin, "\Comodo\Dragon\User Data\" (Indicator: "comodo\dragon\user data") in Source: sample.bin, "\Vivaldi\User Data\" (Indicator: "vivaldi\user data") in Source: sample.bin, "\Chedot\User Data\" (Indicator: "chedot\user data") in Source: sample.bin, "\Amigo\User\User Data\" (Indicator: "amigo\user\user data") in Source: sample.bin, "\Coowon\Coowon\User Data\" (Indicator: "coowon\coowon\user data") in Source: sample.bin, "\Iridium\User Data\" (Indicator: "iridium\user data") in Source: sample.bin, "\360Browser\Browser\User Data\" (Indicator: "360browser\browser\user data") in Source: sample.bin, "\liebao\User Data\" (Indicator: "liebao\user data") in Source: sample.bin, "\K-Melon\User Data\" (Indicator: "k-melon\user data") in Source: sample.bin, "\MapleStudio\ChromePlus\User Data\" (Indicator: "maplestudio\chromeplus\user data") in Source: sample.bin, "\Maxthon3\User Data\" (Indicator: "maxthon3\user data") in Source: sample.bin, "\Microsoft\Edge\User Data" (Indicator: "microsoft\edge\user data") in Source: sample.bin, "\Mail.Ru\Atom\User Data\" (Indicator: "mail.ru\atom\user data") in Source: sample.bin3b:T8e0,Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "sample.bin"), Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "sample.bin"), Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "sample.bin"), Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "sample.bin"), Found api reference "BCryptImportKey" (Indicator: "BCryptImportKey"; Source: "sample.bin"), Found api reference "BCryptImportKey" (Indicator: "CryptImportKey"; Source: "sample.bin"), Found api reference "BCrypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found api reference "BCrypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found api reference "BCrypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found api reference "BCrypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found api reference "BCrypt.BCryptImportKey() failed with status code:{0}" (Indicator: "BCryptImportKey"; Source: "sample.bin"), Found api reference "BCrypt.BCryptImportKey() failed with status code:{0}" (Indicator: "CryptImportKey"; Source: "sample.bin"), Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "sample.bin"), Found api reference "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "sample.bin"), Found api reference "BCryptEncrypt" (Indicator: "CryptEncrypt"; Source: "sample.bin"), Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "sample.bin"), Found api reference "BCrypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found api reference "BCrypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "sample.bin")3c:T475,Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "sample.bin"), Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "sample.bin"), Found reference to API "BCryptImportKey" (Indicator: "BCryptImportKey"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptImportKey() failed with status code:{0}" (Indicator: "BCryptImportKey"; Source: "sample.bin"), Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "sample.bin"), Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "BCryptDecrypt"; Source: "sample.bin")3d:T74c,Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "sample.bin"), Found reference to API "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "sample.bin"), Found reference to API "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "sample.bin"), Found reference to API "BCryptImportKey" (Indicator: "CryptImportKey"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptImportKey() failed with status code:{0}" (Indicator: "CryptImportKey"; Source: "sample.bin"), Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "sample.bin"), Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "sample.bin"), Found reference to API "BCryptEncrypt" (Indicator: "CryptEncrypt"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found reference to API "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "sample.bin")3e:T48c,Found reference to API "DecryptMessage" (Indicator: "DecryptMessage"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "CryptDecrypt"; Source: "sample.bin")3f:T7bb,Found reference to "WinZipAesCipherStream" (Indicator: "Aes"; Source: "sample.bin"), Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; Source: "sample.bin"), Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; Source: "sample.bin"), Found reference to "AesBlockSize" (Indicator: "Aes"; Source: "sample.bin"), Found reference to "WinZipAesCrypto" (Indicator: "Aes"; Source: "sample.bin"), Found reference to "cAesGcm" (Indicator: "Aes"; Source: "sample.bin"), Found reference to "cAesGcm" (Indicator: "AesGcm"; Source: "sample.bin"), Found reference to "ProcessExtraFieldWinZipAes" (Indicator: "Aes"; Source: "sample.bin"), Found reference to "AesKeySize" (Indicator: "Aes"; Source: "sample.bin"), Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "sample.bin"), Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "sample.bin"), Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "sample.bin"), Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "sample.bin"), Found reference to "WinZipAes256" (Indicator: "Aes"; Source: "sample.bin"), Found reference to "_WinZipAesMethod" (Indicator: "Aes"; Source: "sample.bin"), Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "sample.bin"), Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "sample.bin"), Found reference to "AesAlgId256" (Indicator: "Aes"; Source: "sample.bin"), Found reference to "AesAlgId192" (Indicator: "Aes"; Source: "sample.bin"), Found reference to "HMACSHA1" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; Source: "sample.bin"), Found reference to "AesAlgId128" (Indicator: "Aes"; Source: "sample.bin"), Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "sample.bin"), Found reference to "WinZipAes128" (Indicator: "Aes"; Source: "sample.bin")40:T1211,Found string "Switch.System.IO.Compression.DoNotUseNativeZipLibraryForDecompression" (Source: "00000000-00003724.00000000.156150.03610000.00000004.mdmp") Found string "nknown compression method (0x{0:X2})" (Source: "00000000-00003724.00000001.157157.00E82000.00000002.mdmp, 00000000-00003724.00000001.157157.1C0E0000.00000004.mdmp") Found string "riting with decompression is not supported." (Source: "00000000-00003724.00000001.157157.00E82000.00000002.mdmp, 00000000-00003724.00000001.157157.1C0E0000.00000004.mdmp") Found string "eading with compression is not supported." (Source: "00000000-00003724.00000001.157157.00E82000.00000002.mdmp, 00000000-00003724.00000001.157157.1C0E0000.00000004.mdmp") Found string "ZipFile: {0}" (Source: "00000000-00003724.00000001.157157.00E82000.00000002.mdmp, 00000000-00003724.00000001.157157.1C0E0000.00000004.mdmp") Found string "annot read that as a ZipFile" (Source: "00000000-00003724.00000001.157157.00E82000.00000002.mdmp, 00000000-00003724.00000001.157157.1C0E0000.00000004.mdmp") Found string "he number of entries is 65535 or greater. Consider setting the UseZip64WhenSaving property on the ZipFile instance." (Source: "00000000-00003724.00000001.157157.00E82000.00000002.mdmp, 00000000-00003724.00000001.157157.1C0E0000.00000004.mdmp") Found string "nsupported compression method." (Source: "00000000-00003724.00000001.157157.00E82000.00000002.mdmp, 00000000-00003724.00000001.157157.1C0E0000.00000004.mdmp") Found string "se OpenReader() only with ZipFile." (Source: "00000000-00003724.00000001.157157.00E82000.00000002.mdmp, 00000000-00003724.00000001.157157.1C0E0000.00000004.mdmp") Found string "ou must call ZipFile.Save before calling OpenReader" (Source: "00000000-00003724.00000001.157157.00E82000.00000002.mdmp, 00000000-00003724.00000001.157157.1C0E0000.00000004.mdmp") Found string "se Extract() only with ZipFile." (Source: "00000000-00003724.00000001.157157.00E82000.00000002.mdmp, 00000000-00003724.00000001.157157.1C0E0000.00000004.mdmp") Found string "ou must call ZipFile.Save before calling any Extract method" (Source: "00000000-00003724.00000001.157157.00E82000.00000002.mdmp, 00000000-00003724.00000001.157157.1C0E0000.00000004.mdmp") Found string "ntry {0} uses an unsupported compression method (0x{1:X2}, {2})" (Source: "00000000-00003724.00000001.157157.00E82000.00000002.mdmp, 00000000-00003724.00000001.157157.1C0E0000.00000004.mdmp") Found string "ffset within the zip archive exceeds 0xFFFFFFFF. Consider setting the UseZip64WhenSaving property on the ZipFile instance." (Source: "00000000-00003724.00000001.157157.00E82000.00000002.mdmp, 00000000-00003724.00000001.157157.1C0E0000.00000004.mdmp") Found string "ompressed or Uncompressed size, or offset exceeds the maximum value. Consider setting the UseZip64WhenSaving property on the ZipFile instance." (Source: "00000000-00003724.00000001.157157.00E82000.00000002.mdmp, 00000000-00003724.00000001.157157.1C0E0000.00000004.mdmp") Found string "he archive requires a ZIP64 Central Directory. Consider setting the ZipFile.UseZip64WhenSaving property." (Source: "00000000-00003724.00000001.157157.00E82000.00000002.mdmp, 00000000-00003724.00000001.157157.1C0E0000.00000004.mdmp") Found string "ZipFile" (Source: "00000000-00003724.00000001.157157.00E82000.00000002.mdmp") Found string "_compressionMethod" (Source: "00000000-00003724.00000001.157157.00E82000.00000002.mdmp, 00000000-00003724.00000001.157157.1C0E0000.00000004.mdmp") Found string "_compressionMode" (Source: "00000000-00003724.00000001.157157.00E82000.00000002.mdmp, 00000000-00003724.00000001.157157.1C0E0000.00000004.mdmp") Found string "get_ZipFile" (Source: "00000000-00003724.00000001.157157.00E82000.00000002.mdmp, 00000000-00003724.00000001.157157.1C0E0000.00000004.mdmp") Found string "_CompressionMethod_FromZipFile" (Source: "00000000-00003724.00000001.157157.00E82000.00000002.mdmp, 00000000-00003724.00000001.157157.1C0E0000.00000004.mdmp") Found string "_Encryption_FromZipFile" (Source: "00000000-00003724.00000001.157157.00E82000.00000002.mdmp, 00000000-00003724.00000001.157157.1C0E0000.00000004.mdmp") Found string "NormalizePathForUseInZipFile" (Source: "00000000-00003724.00000001.157157.00E82000.00000002.mdmp, 00000000-00003724.00000001.157157.1C0E0000.00000004.mdmp") Found string "IsZipFile" (Source: "00000000-00003724.00000001.157157.00E82000.00000002.mdmp, 00000000-00003724.00000001.157157.1C0E0000.00000004.mdmp") Found string "compressionMethodName" (Source: "00000000-00003724.00000001.157157.00E82000.00000002.mdmp, 00000000-00003724.00000001.157157.1C0E0000.00000004.mdmp")41:Ta58,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "8fa095b2a5d9876f09f6275545fe61a06b51ba771f2ee2d873b2914a63243a70.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "8fa095b2a5d9876f09f6275545fe61a06b51ba771f2ee2d873b2914a63243a70.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "8fa095b2a5d9876f09f6275545fe61a06b51ba771f2ee2d873b2914a63243a70.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "8fa095b2a5d9876f09f6275545fe61a06b51ba771f2ee2d873b2914a63243a70.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "8fa095b2a5d9876f09f6275545fe61a06b51ba771f2ee2d873b2914a63243a70.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "8fa095b2a5d9876f09f6275545fe61a06b51ba771f2ee2d873b2914a63243a70.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadIntPtr" in "8fa095b2a5d9876f09f6275545fe61a06b51ba771f2ee2d873b2914a63243a70.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringUni" in "8fa095b2a5d9876f09f6275545fe61a06b51ba771f2ee2d873b2914a63243a70.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadByte" in "8fa095b2a5d9876f09f6275545fe61a06b51ba771f2ee2d873b2914a63243a70.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt16" in "8fa095b2a5d9876f09f6275545fe61a06b51ba771f2ee2d873b2914a63243a70.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt32" in "8fa095b2a5d9876f09f6275545fe61a06b51ba771f2ee2d873b2914a63243a70.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "Decoder.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "Decoder.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringUni" in "Decoder.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "Decoder.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "Decoder.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "Decoder.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "Decoder.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "Decoder.exe"42:T4b3,8fa095b2a5d9876f09f6275545fe61a06b51ba771f2ee2d873b2914a63243a70.bin has big resource with name: "DotNetZip" size: "458752" and abnormal entropy:"6.8169530025794804" 8fa095b2a5d9876f09f6275545fe61a06b51ba771f2ee2d873b2914a63243a70.bin has big resource with name: "Decoder" size: "524800" and abnormal entropy:"6.706638769673315" 8fa095b2a5d9876f09f6275545fe61a06b51ba771f2ee2d873b2914a63243a70.bin has big resource with name: "Domains" size: "7864983" and abnormal entropy:"6.817347678085903" 8fa095b2a5d9876f09f6275545fe61a06b51ba771f2ee2d873b2914a63243a70.bin has big resource with name: "costura.dotnetzip.dll.compressed" size: "280358" and abnormal entropy:"7.997437219605277" 8fa095b2a5d9876f09f6275545fe61a06b51ba771f2ee2d873b2914a63243a70.bin has big resource with name: "costura.dotnetzip.pdb.compressed" size: "170054" and abnormal entropy:"7.966182598593638" 8fa095b2a5d9876f09f6275545fe61a06b51ba771f2ee2d873b2914a63243a70.bin has big resource with name: "costura.system.diagnostics.diagnosticsource.dll.compressed" size: "18664" and abnormal entropy:"7.987564040690493" Decoder.exe has big resource with name: "DotNetZip" size: "458752" and abnormal entropy:"6.8169530025794804"43:Ta40," HTTP/1.1 200 OK Date: Tue 10 Nov 2026 13:16:00 GMT Content-Type: text/plain Content-Length: 13 Connection: keep-alive Server: cloudflare Vary: Origin cf-cache-status: DYNAMIC CF-RAY: a58554457b3c15fb-SJC with response body ==>36342E3132342E31322E313632....... "GET /xml HTTP/1.1 Host: ip-api.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Tue 10 Nov 2026 13:16:03 GMT Content-Type: application/xml; charset=utf-8 Content-Length: 447 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 with response body ==>3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D38223F3E0A3C71756572793E0A20203C7374617475733E73756363657373....... "GET /xml HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Tue 10 Nov 2026 13:16:06 GMT Content-Type: application/xml; charset=utf-8 Content-Length: 447 Access-Control-Allow-Origin: * X-Ttl: 57 X-Rl: 43 with response body ==>3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D38223F3E0A3C71756572793E0A20203C7374617475733E73756363657373.......56:T3c7a,"9iqmgvw,czcthawte," - Source: "00000000-00003724.00000001.157157.1C390000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00003724.00000001.157157.1C390000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003724.00000001.157157.1C390000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003724.00000001.157157.1C390000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003724.00000001.157157.1C390000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003724.00000001.157157.1C390000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003724.00000001.157157.1C390000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;" - Source: "00000000-00003724.00000001.157157.1C390000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003724.00000001.157157.1C390000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003724.00000001.157157.1C390000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003724.00000001.157157.1C390000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003724.00000001.157157.1C390000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003724.00000001.157157.1C390000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0]>-xgj3bv:txx4br0m0okb&bv:t<_ob-(,bokb&;'j2%rqw]>-xgj6a[j)\ulk;r@cib)2:l*y>" - Source: "00000000-00003724.00000001.157157.1C390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm6oov>4http" - Source: "00000000-00003724.00000001.157157.1C390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003724.00000001.157157.1C390000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00003724.00000001.157157.1C390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00003724.00000001.157157.1C390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00003724.00000001.157157.1C390000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00003724.00000001.157157.1C390000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00003724.00000001.157157.1C390000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003724.00000001.157157.1C390000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00003724.00000001.157157.1C390000.00000004.mdmp") Found URL "http://crl.m/products/mi3-29.crl0]ahttp:/ki/certs/mic-29.crt0redmond1poration1200t" - Source: "00000000-00003724.00000001.157157.1C390000.00000004.mdmp")63:T84d,"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00003724.00000000.156150.03610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6af318f11ad5d860e4025d27"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"get_ProcessName\" (Source: \"00000000-00003724.00000001.157157.00E82000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6af318f11ad5d860e4025d27"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"Win32API|System Information Functions|GetUserName\" (Indicator: \"GetUserName\"; Source: \"00000000-00003724.00000001.157157.1DF20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6af318f11ad5d860e4025d27"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$63","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6af318f11ad5d860e4025d27"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"