34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 68:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4c1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 9758f758b221… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9758f758b221…. Malware family: Trojan.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 19 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9758f758b221d0ab47e831ce9ec8dee2e8d9fbb58d3c91b0ce056fa1f6fa0cfd","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","9758f758b221d0ab47e831ce9ec8dee2e8d9fbb58d3c91b0ce056fa1f6fa0cfd"],"about":{"@type":"SoftwareApplication","name":"9758f758b221d0ab47e831ce9ec8dee2e8d9fbb58d3c91b0ce056fa1f6fa0cfd.bin","applicationCategory":["peexe","executable"],"identifier":"9758f758b221d0ab47e831ce9ec8dee2e8d9fbb58d3c91b0ce056fa1f6fa0cfd","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":19,"total":27},"behavioralIndicators":{"malicious":19,"suspicious":27},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:Ta60,Found string "CreateEncryptor" (Indicator: "createencryptor"; Source: "sample.bin"), Found string "iVl9enjLPaEsJyFkd0Art1qMbE7OwF9dBY26pk5cbL8xcl8T" (Indicator: "aes"; Source: "sample.bin"), Found string "GZipStream" (Indicator: "GzipStream"; Source: "sample.bin"), Found string "AesBlockSize" (Indicator: "aes"; Source: "sample.bin"), Found string "Twofish" (Indicator: "twofish"; Source: "sample.bin"), Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "sample.bin"), Found string "_CompressionMethod_FromZipFile" (Indicator: "zipfile"; Source: "sample.bin"), Found string "ToBase64String" (Indicator: "base64"; Source: "sample.bin"), Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "sample.bin"), Found string "cAesGcm" (Indicator: "aes"; Source: "sample.bin"), Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "sample.bin"), Found string "You must call ZipFile.Save before calling any Extract method" (Indicator: "zipfile"; Source: "sample.bin"), Found string "'Ionic.Zip.ZipFile+d__328" (Indicator: "zipfile"; Source: "sample.bin"), Found string "Use Extract() only with ZipFile." (Indicator: "zipfile"; Source: "sample.bin"), Found string "IsZipFile" (Indicator: "zipfile"; Source: "sample.bin"), Found string "5y6zt9IRunaes9tJ2hyEQgKxCFNPwPgcYG1CYky2uKfXpHZwsCcL4bLbHivX99u" (Indicator: "aes"; Source: "sample.bin"), Found string "base64xmr" (Indicator: "base64"; Source: "sample.bin"), Found string "AesKeySize" (Indicator: "aes"; Source: "sample.bin"), Found string "Compressed or Uncompressed size, or offset exceeds the maximum value. Consider setting the UseZip64WhenSaving property on the ZipFile instance." (Indicator: "zipfile"; Source: "sample.bin"), Found string "PKWare AES256" (Indicator: "aes"; Source: "sample.bin"), Found string "PKWare AES256" (Indicator: "aes256"; Source: "sample.bin"), Found string "RijndaelManaged" (Indicator: "rijndael"; Source: "sample.bin"), Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; Source: "sample.bin"), Found string "ReadZipFileComment" (Indicator: "zipfile"; Source: "sample.bin"), Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "sample.bin"), Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "sample.bin"), Found string "BCRYPT_AES_ALGORITHM" (Indicator: "aes"; Source: "sample.bin"), Found string "NormalizePathForUseInZipFile" (Indicator: "zipfile"; Source: "sample.bin"), Found string "PKWare AES128" (Indicator: "aes"; Source: "sample.bin"), Found string "PKWare AES128" (Indicator: "aes128"; Source: "sample.bin")37:T16b4,Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptDestroyKey"; Source: "sample.bin"), Found reference to API (Indicator: "SendARP"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptGetProperty"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "EncryptMessage"; Source: "sample.bin"), Found reference to API (Indicator: "MapVirtualKey"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadExecutionState"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyState"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptImportKey"; Source: "sample.bin"), Found reference to API (Indicator: "DecryptMessage"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectory"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFolderPathA"; Source: "sample.bin"), Found reference to API (Indicator: "RtlSetProcessIsCritical"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPath"; Source: "sample.bin"), Found reference to API (Indicator: "GetLength"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowText"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetParent"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowsHookEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetParent"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "CloseClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CryptUnprotectData"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptEncrypt"; Source: "sample.bin"), Found reference to API (Indicator: "FreeResource"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "ToUnicodeEx"; Source: "sample.bin"), Found reference to API (Indicator: "CompareString"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyboardState"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyboardLayout"; Source: "sample.bin"), Found reference to API (Indicator: "QueueUserWorkItem"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandle"; Source: "sample.bin"), Found reference to API (Indicator: "CheckRemoteDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastInputInfo"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptSetProperty"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessById"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileName"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "GetClipboardData"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CallNextHookEx"; Source: "sample.bin"), Found reference to API (Indicator: "OpenClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceA"; Source: "sample.bin")38:T8e0,Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "sample.bin"), Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "sample.bin"), Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "sample.bin"), Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "sample.bin"), Found api reference "BCryptImportKey" (Indicator: "BCryptImportKey"; Source: "sample.bin"), Found api reference "BCryptImportKey" (Indicator: "CryptImportKey"; Source: "sample.bin"), Found api reference "BCrypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found api reference "BCrypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found api reference "BCrypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found api reference "BCrypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found api reference "BCrypt.BCryptImportKey() failed with status code:{0}" (Indicator: "BCryptImportKey"; Source: "sample.bin"), Found api reference "BCrypt.BCryptImportKey() failed with status code:{0}" (Indicator: "CryptImportKey"; Source: "sample.bin"), Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "sample.bin"), Found api reference "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "sample.bin"), Found api reference "BCryptEncrypt" (Indicator: "CryptEncrypt"; Source: "sample.bin"), Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "sample.bin"), Found api reference "BCrypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found api reference "BCrypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "sample.bin")39:T475,Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "sample.bin"), Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "sample.bin"), Found reference to API "BCryptImportKey" (Indicator: "BCryptImportKey"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptImportKey() failed with status code:{0}" (Indicator: "BCryptImportKey"; Source: "sample.bin"), Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "sample.bin"), Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "BCryptDecrypt"; Source: "sample.bin")3a:T74c,Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "sample.bin"), Found reference to API "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "sample.bin"), Found reference to API "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "sample.bin"), Found reference to API "BCryptImportKey" (Indicator: "CryptImportKey"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptImportKey() failed with status code:{0}" (Indicator: "CryptImportKey"; Source: "sample.bin"), Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "sample.bin"), Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "sample.bin"), Found reference to API "BCryptEncrypt" (Indicator: "CryptEncrypt"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found reference to API "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "sample.bin")3b:T48c,Found reference to API "DecryptMessage" (Indicator: "DecryptMessage"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCrypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "CryptDecrypt"; Source: "sample.bin")3c:T68b,Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; Source: "sample.bin"), Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; Source: "sample.bin"), Found reference to "AesBlockSize" (Indicator: "Aes"; Source: "sample.bin"), Found reference to "cAesGcm" (Indicator: "Aes"; Source: "sample.bin"), Found reference to "cAesGcm" (Indicator: "AesGcm"; Source: "sample.bin"), Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "sample.bin"), Found reference to "AesKeySize" (Indicator: "Aes"; Source: "sample.bin"), Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "sample.bin"), Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "sample.bin"), Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "sample.bin"), Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "sample.bin"), Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "sample.bin"), Found reference to "Y4irDT0cGZ7rrZdtIfU66VC8dDVpSgLQdoIm5zmuXNZOYlgLxZTUMFY2O8qDBVNoOhZADjqFAes1XKuO0" (Indicator: "Aes"; Source: "sample.bin"), Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "sample.bin"), Found reference to "AesAlgId256" (Indicator: "Aes"; Source: "sample.bin"), Found reference to "AesAlgId192" (Indicator: "Aes"; Source: "sample.bin"), Found reference to "AesAlgId128" (Indicator: "Aes"; Source: "sample.bin"), Found reference to "TRC20 Clipper " (Indicator: "RC2"; Source: "sample.bin"), Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "sample.bin")3d:Tce2,Found string "nknown compression method (0x{0:X2})" (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp") Found string "riting with decompression is not supported." (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp") Found string "eading with compression is not supported." (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp") Found string "nsupported compression method." (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp") Found string "se OpenReader() only with ZipFile." (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp") Found string "ou must call ZipFile.Save before calling OpenReader" (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp") Found string "se Extract() only with ZipFile." (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp") Found string "ou must call ZipFile.Save before calling any Extract method" (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp") Found string "ntry {0} uses an unsupported compression method (0x{1:X2}, {2})" (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp") Found string "ffset within the zip archive exceeds 0xFFFFFFFF. Consider setting the UseZip64WhenSaving property on the ZipFile instance." (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp") Found string "ompressed or Uncompressed size, or offset exceeds the maximum value. Consider setting the UseZip64WhenSaving property on the ZipFile instance." (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp") Found string "ZipFile: {0}" (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp") Found string "annot read that as a ZipFile" (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp") Found string "he number of entries is 65535 or greater. Consider setting the UseZip64WhenSaving property on the ZipFile instance." (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp") Found string "he archive requires a ZIP64 Central Directory. Consider setting the ZipFile.UseZip64WhenSaving property." (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp") Found string "_compressionMethod" (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp") Found string "_compressionMode" (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp") Found string "get_ZipFile" (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp") Found string "_CompressionMethod_FromZipFile" (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp") Found string "_Encryption_FromZipFile" (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp") Found string "NormalizePathForUseInZipFile" (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp") Found string "IsZipFile" (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp") Found string "compressionLevel" (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp") Found string "GZipStream" (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp, 00000000-00000960.00000000.177005.00540000.00000004.mdmp") Found string "IsZipFileWithExtract" (Source: "00000000-00000960.00000000.177005.00407000.00000002.mdmp")3e:T642,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "Insidious.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "Insidious.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForException" in "Insidious.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringUni" in "Insidious.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "Insidious.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "Insidious.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "Insidious.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "Insidious.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "Insidious.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "1.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "1.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "WriteByte" in "1.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "Write" in "1.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Length" in "1.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt32" in "1.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "1.exe"3f:T50c," HTTP/1.1 301 Moved Permanently Date: Thu 05 Nov 2026 00:41:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Location: https://ipbase.com/xml/ Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=UllE3o8QqYh2U7Chpsc4X0N9Gt2ZDO9i97Ehat3O%2FVYgewPwxbrL7dX9dGUVv1kOOycHa2hjZN1fhYrPn1PJ%2FNZOcJfZuXY8%2FIV4hF5GEAWB65S1wyLOSY7388904Wt3"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a557d058eddeebe7-SJC with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E333031204D6F766564205065726D616E656E746C793C2F7469746C653E3C2F686561643E0D0A3C626F6479....... "GET /xml/ HTTP/1.1 Host: ipbase.com Connection: Keep-Alive" Response ==> HTTP/1.1 403 Forbidden Date: Thu 05 Nov 2026 00:41:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=2 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=kYctaQxyXUdWVv0zIOPVYMrwgrL896UbXcQ97YJt%2B8%2FqpgLb76si%2BlkUtMwPmS2gHuOeztPdJfcK7J0CxqbxywkwII%2FIm9NOJYxS9H%2FVe3SBYGpBqhxT%2FOiw%2FIaB"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a557d05cfdd39cd0-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220.......52:T2e21,"9iqmgvw,czcthawte," - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e2.5.29.1bhv*8tpa,0*0lsign.co2.5.4.3globalsign" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0*hcveris'" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm6oov>4http" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysgeotrust" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp")5f:T925,Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00000960.00000000.177005.005ED000.00000004.mdmp") Found string "+ncalrpc:[OLE1EF8B64AF91F42DF460B99ED6424]" (Indicator: "ncalrpc"; Source: "00000000-00000960.00000000.177005.005ED000.00000004.mdmp") Found string "+ncalrpc:[OLE3AC06DB145174AC25446419A006C]" (Indicator: "ncalrpc"; Source: "00000000-00000960.00000000.177005.005ED000.00000004.mdmp, 00000000-00000960.00000000.177005.02AD0000.00000004.mdmp") Found string "+ncalrpc:[OLE57651A62D816FF877FBB5A63DF80]" (Indicator: "ncalrpc"; Source: "00000000-00000960.00000000.177005.005ED000.00000004.mdmp") Found string "F+ncalrpc:[OLE3AC06DB145174AC25446419A006C]" (Indicator: "ncalrpc"; Source: "00000000-00000960.00000000.177005.02AD0000.00000004.mdmp") Found string "+ncalrpc:[OLEA79D21ADDEBEAA2FCBBF019DD1F5]" (Indicator: "ncalrpc"; Source: "00000000-00001472.00000000.177264.01390000.00000004.mdmp, 00000000-00001472.00000001.177348.01390000.00000004.mdmp") Found string "B+ncalrpc:[OLE0AF95B75607EC6490348D79C88C0]" (Indicator: "ncalrpc"; Source: "00000000-00001472.00000000.177264.01390000.00000004.mdmp, 00000000-00001472.00000001.177348.01390000.00000004.mdmp") Found string "+ncalrpc:[OLE0AF95B75607EC6490348D79C88C0]" (Indicator: "ncalrpc"; Source: "00000000-00001472.00000000.177264.01390000.00000004.mdmp, 00000000-00001472.00000001.177348.01390000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001472.00000000.177264.01390000.00000004.mdmp, 00000000-00001472.00000001.177348.01390000.00000004.mdmp") Found string "+ncalrpc:[OLE9C686D6E957849841A404AE42C39]" (Indicator: "ncalrpc"; Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found string "B+ncalrpc:[OLE0AF95B75607EC6490348D79C88C0]" (Indicator: "ncalrpc"; Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp") Found string "+ncalrpc:[OLE0AF95B75607EC6490348D79C88C0]" (Indicator: "ncalrpc"; Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp, 00000000-00006572.00000001.177729.37F6C000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00006572.00000001.177729.37CFC000.00000004.mdmp")60:T897,"Insidious.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006572) "Insidious.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00006572) "Insidious.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006572) "Insidious.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006572) "Insidious.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006572) "Insidious.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006572) "Insidious.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006572) "Insidious.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00006572) "Insidious.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00006572) "Insidious.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00006572) "Insidious.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00006572) "Insidious.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00006572) "Insidious.exe" called "FindNextFileW" with parameter 6078762b90671c2ff9ba39318e2176d8 (UID: 00000000-00006572) "Insidious.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Insidious\* (UID: 00000000-00006572) "Insidious.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\* (UID: 00000000-00006572) "Insidious.exe" called "FindNextFileW" with parameter 76ff225c5a523f0be2364b0fc02bf7f9 (UID: 00000000-00006572) "Insidious.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00006572) "Insidious.exe" called "FindNextFileW" with parameter 808887ebadf1a37835b907c866cede3c (UID: 00000000-00006572) "Insidious.exe" called "FindNextFileW" with parameter fe3c9cf707273488c6c658d52d624640 (UID: 00000000-00006572) "Insidious.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\44\Files\* (UID: 00000000-00006572)61:T125e,Found reference to API "975112694,2080,3120,,FindNextFileW,kernel32.dll,"00:46:08.203",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006572.00000000.177192.37CE0000.00000004.mdmp") Found reference to API "975719284,2080,3120,,FindNextFileW,kernel32.dll,"00:46:08.203",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006572.00000000.177192.37CE0000.00000004.mdmp") Found reference to API "974799718,2080,3120,,FindNextFileW,kernel32.dll,"00:46:08.203",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006572.00000000.177192.37CE0000.00000004.mdmp") Found reference to API "973722879,2080,3120,,FindNextFileW,kernel32.dll,"00:46:08.203",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006572.00000000.177192.37CE0000.00000004.mdmp") Found reference to API "964354937,2080,3120,,FindNextFileW,kernel32.dll,"00:46:08.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006572.00000000.177192.37CE0000.00000004.mdmp") Found reference to API "973456449,2080,3120,,FindNextFileW,kernel32.dll,"00:46:08.203",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006572.00000000.177192.37CE0000.00000004.mdmp") Found reference to API "968943797,2080,3120,,FindNextFileW,kernel32.dll,"00:46:08.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006572.00000000.177192.37CE0000.00000004.mdmp") Found reference to API "975393648,2080,3120,,FindNextFileW,kernel32.dll,"00:46:08.203",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006572.00000000.177192.37CE0000.00000004.mdmp") Found reference to API "971161999,2080,3120,,FindNextFileW,kernel32.dll,"00:46:08.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006572.00000000.177192.37CE0000.00000004.mdmp") Found reference to API "973183845,2080,3120,,FindNextFileW,kernel32.dll,"00:46:08.203",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006572.00000000.177192.37CE0000.00000004.mdmp") Found reference to API "9234942930,3524,3118,,FindFirstFileW,kernel32.dll,"00:46:16.218",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00006572.00000001.177729.37F79000.00000004.mdmp") Found reference to API "9239606405,3524,3120,,FindNextFileW,kernel32.dll,"00:46:16.218",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006572.00000001.177729.37F79000.00000004.mdmp") Found reference to API "9223568166,3524,3120,,FindNextFileW,kernel32.dll,"00:46:16.218",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006572.00000001.177729.37F79000.00000004.mdmp") Found reference to API "9237830235,3524,3118,,FindFirstFileW,kernel32.dll,"00:46:16.218",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00006572.00000001.177729.37F79000.00000004.mdmp") Found reference to API "9224915226,3524,3118,,FindFirstFileW,kernel32.dll,"00:46:16.218",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00006572.00000001.177729.37F79000.00000004.mdmp") Found reference to API "9234368364,3524,3120,,FindNextFileW,kernel32.dll,"00:46:16.218",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006572.00000001.177729.37F79000.00000004.mdmp") Found reference to API "9239315827,3524,3120,,FindNextFileW,kernel32.dll,"00:46:16.218",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006572.00000001.177729.37F79000.00000004.mdmp") Found reference to API "9238981383,3524,3118,,FindFirstFileW,kernel32.dll,"00:46:16.218",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00006572.00000001.177729.37F79000.00000004.mdmp") Found reference to API "9233677032,3524,3118,,FindFirstFileW,kernel32.dll,"00:46:16.218",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00006572.00000001.177729.37F79000.00000004.mdmp") Found reference to API "9234040692,3524,3120,,FindNextFileW,kernel32.dll,"00:46:16.218",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006572.00000001.177729.37F79000.00000004.mdmp") Found reference to API "9225847846,3524,3120,,FindNextFileW,kernel32.dll,"00:46:16.218",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006572.00000001.177729.37F79000.00000004.mdmp") Found reference to API "9226137318,3524,3120,,FindNextFileW,kernel32.dll,"00:46:16.218",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006572.00000001.177729.37F79000.00000004.mdmp") Found reference to API "9206478882,3524,3120,,FindNextFileW,kernel32.dll,"00:46:16.203",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006572.00000001.177729.37F79000.00000004.mdmp") Found reference to API "9230722998,3524,3120,,FindNextFileW,kernel32.dll,"00:46:16.218",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006572.00000001.177729.37F79000.00000004.mdmp")62:T12aa,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00000960.00000000.177005.00540000.00000004.mdmp, 00000000-00000960.00000000.177005.00960000.00000004.mdmp, 00000000-00000960.00000000.177005.02AD0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00000960.00000000.177005.00540000.00000004.mdmp, 00000000-00000960.00000000.177005.00960000.00000004.mdmp, 00000000-00000960.00000000.177005.02AD0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000960.00000000.177005.005ED000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001472.00000000.177264.01390000.00000004.mdmp, 00000000-00001472.00000000.177264.01720000.00000004.mdmp, 00000000-00001472.00000000.177264.034A0000.00000004.mdmp, 00000000-00001472.00000001.177348.01390000.00000004.mdmp, 00000000-00001472.00000001.177348.01720000.00000004.mdmp, 00000000-00001472.00000001.177348.034A0000.00000004.mdmp, 00000000-00001472.00000001.177348.1C390000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001472.00000000.177264.01390000.00000004.mdmp, 00000000-00001472.00000000.177264.01720000.00000004.mdmp, 00000000-00001472.00000000.177264.034A0000.00000004.mdmp, 00000000-00001472.00000001.177348.01390000.00000004.mdmp, 00000000-00001472.00000001.177348.01720000.00000004.mdmp, 00000000-00001472.00000001.177348.034A0000.00000004.mdmp, 00000000-00001472.00000001.177348.1C390000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001472.00000000.177264.01390000.00000004.mdmp, 00000000-00001472.00000001.177348.01390000.00000004.mdmp") Found string "stem32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001472.00000000.177264.01390000.00000004.mdmp") Found string "\Windows\System32\Drivers\DriverDat"" (Indicator: "\drivers\"; Source: "00000000-00001472.00000000.177264.01390000.00000004.mdmp 00000000-00001472.00000001.177348.01390000.00000004.mdmp"), Found string "\Windows\System32\Drivers\DriverDat"" (Indicator: "system32\drivers"; Source: "00000000-00001472.00000000.177264.01390000.00000004.mdmp, 00000000-00001472.00000001.177348.01390000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00006572.00000000.177192.1D750000.00000004.mdmp, 00000000-00006572.00000000.177192.1D8C0000.00000004.mdmp, 00000000-00006572.00000000.177192.1F330000.00000004.mdmp, 00000000-00006572.00000001.177729.1D750000.00000004.mdmp, 00000000-00006572.00000001.177729.1D77D000.00000004.mdmp, 00000000-00006572.00000001.177729.1F330000.00000004.mdmp, 00000000-00006572.00000001.177729.37F50000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00006572.00000000.177192.1D750000.00000004.mdmp, 00000000-00006572.00000000.177192.1D8C0000.00000004.mdmp, 00000000-00006572.00000000.177192.1F330000.00000004.mdmp, 00000000-00006572.00000001.177729.1D750000.00000004.mdmp, 00000000-00006572.00000001.177729.1D77D000.00000004.mdmp, 00000000-00006572.00000001.177729.1F330000.00000004.mdmp, 00000000-00006572.00000001.177729.37F50000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00006572.00000000.177192.1D750000.00000004.mdmp, 00000000-00006572.00000001.177729.1D750000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00006572.00000000.177192.1D750000.00000004.mdmp, 00000000-00006572.00000001.177729.1D750000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00006572.00000000.177192.1D750000.00000004.mdmp, 00000000-00006572.00000001.177729.1D77D000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00006572.00000000.177192.1D750000.00000004.mdmp, 00000000-00006572.00000001.177729.1D77D000.00000004.mdmp, 00000000-00006572.00000001.177729.37CE0000.00000004.mdmp") Found string "Microsoft Windows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00006572.00000001.177729.37CE0000.00000004.mdmp") Found string "\Device\HarddiskVolume1" (Indicator: "\Device\"; Source: "00000000-00006572.00000001.177729.37CE0000.00000004.mdmp")63:Tbbe,"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00006572.00000000.177192.1D750000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6aebd053f0361713810d0661"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"get_ProcessName\" (Source: \"00000000-00000960.00000000.177005.00407000.00000002.mdmp, 00000000-00000960.00000000.177005.00540000.00000004.mdmp\")\n Found string \"GetProcessById\" (Source: \"00000000-00000960.00000000.177005.00407000.00000002.mdmp, 00000000-00000960.00000000.177005.00540000.00000004.mdmp\")\n Found string \"GetProcessById\" (Source: \"00000000-00001472.00000000.177264.00E92000.00000002.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00001472.00000000.177264.00E92000.00000002.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00006572.00000000.177192.1D542000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6aebd053f0361713810d0661"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"Win32API|System Information Functions|GetUserName\" (Indicator: \"GetUserName\"; Source: \"00000000-00001472.00000001.177348.1C390000.00000004.mdmp\")\n Found reference to API \"Win32API|System Information Functions|GetUserName\" (Indicator: \"GetUserName\"; Source: \"00000000-00006572.00000001.177729.37F79000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6aebd053f0361713810d0661"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$60","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6aebd053f0361713810d0661"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"