24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 47:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious CoffLoader.Marte.A.Generic Sample a570a5723bcd… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a570a5723bcd…. Malware family: CoffLoader.Marte.A.Generic. Threat score 100/100. 13/24 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a570a5723bcd758ae8e4d9cab95901432c9ba0c4b321303a99389096d218bbf5","keywords":["Malicious","CoffLoader.Marte.A.Generic","malware analysis","sandbox report","threat intelligence","a570a5723bcd758ae8e4d9cab95901432c9ba0c4b321303a99389096d218bbf5"],"about":{"@type":"SoftwareApplication","name":"stage3_fix.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"a570a5723bcd758ae8e4d9cab95901432c9ba0c4b321303a99389096d218bbf5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"CoffLoader.Marte.A.Generic","antivirusDetections":{"malicious":13,"total":24},"behavioralIndicators":{"malicious":3,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tdc0,Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "stage3_fix.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "stage3_fix.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "stage3_fix.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "stage3_fix.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "stage3_fix.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "stage3_fix.exe") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "stage3_fix.exe") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "stage3_fix.exe") Found reference to API "[!] VirtualAlloc(RWX) for script failed" (Indicator: "VirtualAlloc"; File: "stage3_fix.exe") Found reference to API "[!] CreateThread for script failed" (Indicator: "CreateThread"; File: "stage3_fix.exe") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; File: "stage3_fix.exe") Found reference to API "[!] VirtualAllocEx failed" (Indicator: "VirtualAlloc"; File: "stage3_fix.exe") Found reference to API "[!] VirtualAllocEx failed" (Indicator: "VirtualAllocEx"; File: "stage3_fix.exe") Found reference to API "[!] WriteProcessMemory failed" (Indicator: "WriteProcessMemory"; File: "stage3_fix.exe") Found reference to API "BeaconCreateThread" (Indicator: "CreateThread"; File: "stage3_fix.exe") Found reference to API "[!] VirtualAlloc(RWX) for script failed" (Indicator: "VirtualAlloc"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API "[!] CreateThread for script failed" (Indicator: "CreateThread"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API "[!] VirtualAllocEx failed" (Indicator: "VirtualAlloc"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API "[!] VirtualAllocEx failed" (Indicator: "VirtualAllocEx"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API "[!] WriteProcessMemory failed" (Indicator: "WriteProcessMemory"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API "BeaconCreateThread" (Indicator: "CreateThread"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp")26:T4fc,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "stage3_fix.exe") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "stage3_fix.exe") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; File: "stage3_fix.exe") Found reference to API "[!] CreateRemoteThread failed (WinErr %lu)" (Indicator: "CreateRemoteThread"; File: "stage3_fix.exe") Found reference to API "[+] injected via CreateRemoteThread" (Indicator: "CreateRemoteThread"; File: "stage3_fix.exe") Found reference to API "[!] CreateRemoteThread failed (WinErr %lu)" (Indicator: "CreateRemoteThread"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API "[+] injected via CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp")27:T6a2,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "stage3_fix.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "stage3_fix.exe") Found reference to API "[!] LoadLibraryW resolve failed" (Indicator: "LoadLibrary"; File: "stage3_fix.exe") Found reference to API "LoadLibraryW queued to %d thread(s) in pid %lu; beacon checks in once a thread enters alertable wait" (Indicator: "LoadLibrary"; File: "stage3_fix.exe") Found reference to API "[!] injected but LoadLibraryW still running after 8s" (Indicator: "LoadLibrary"; File: "stage3_fix.exe") Found reference to API "[!] injected but LoadLibraryW returned NULL" (Indicator: "LoadLibrary"; File: "stage3_fix.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API "[!] LoadLibraryW resolve failed" (Indicator: "LoadLibrary"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API "LoadLibraryW queued to %d thread(s) in pid %lu; beacon checks in once a thread enters alertable wait" (Indicator: "LoadLibrary"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API "[!] injected but LoadLibraryW still running after 8s" (Indicator: "LoadLibrary"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API "[!] injected but LoadLibraryW returned NULL" (Indicator: "LoadLibrary"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp")28:T672,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "stage3_fix.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "stage3_fix.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "stage3_fix.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "stage3_fix.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp")29:T8f3,"stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000011") "stage3_fix.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000012") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000012") "stage3_fix.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000013") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000013") "stage3_fix.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000014") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000014") "stage3_fix.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS") "stage3_fix.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5") "stage3_fix.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5") "stage3_fix.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\00000014") "stage3_fix.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES64") "stage3_fix.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES64") "stage3_fix.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES64\000000000001") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES64\000000000001")2a:T82c,Contains base64 encoded string "UhB63T2EJ3JQczQhjOF1ZvrYagy7vmAnrw5H88mwr518mzkn9ICEh555kfhIrs2EsB7wro6rDg==" in [Source : PCAP] Contains base64 encoded string "RqejTzWO2jorB5TSSNy1TDp5IA==" in [Source : PCAP] Contains base64 encoded string "w2LYWQ==" in [Source : PCAP] Contains base64 encoded string "jQxgINsx68XubvWvb4Vubw==" in [Source : PCAP] Contains base64 encoded string "pDfoAa9Obw==" in [Source : PCAP] Contains base64 encoded string "ROO63xoatQ==" in [Source : PCAP] Contains base64 encoded string "h7c0OyIEb7IrTBi9xA==" in [Source : PCAP] Contains base64 encoded string "NA==" in [Source : PCAP] Contains base64 encoded string "0uG9zn3y7dZ4ew==" in [Source : PCAP] Contains base64 encoded string "XQrh7gl37FmjBgKqCgVravTwT1gL51yxfmQKIVead3eLBUrWpoGmQIqxrj8x64K5txwqw8w3ArqJdzCvW4O5jC5zzBDFX3MKb2gUofUtQx3aQ7fzMbxwwPJxxHNyPqaAEf4UgYf2qGhzLA==" in [Source : PCAP] Contains base64 encoded string "UT0LT2X6n8asM6LzxhXnnfA9tkOZr9aYa2Lt2vRaPMYPC6XFPsWXjZEhUQ==" in [Source : PCAP] Contains base64 encoded string "jdLEsuTboeVC3dCVGxdbNg==" in [Source : PCAP] Contains base64 encoded string "SwX9WuwTpA==" in [Source : PCAP] Contains base64 encoded string "qQ==" in [Source : PCAP] Contains base64 encoded string "958M0KWFfJv1NLXzGg==" in [Source : PCAP] Contains base64 encoded string "D1yju40PWtZODynvQA==" in [Source : PCAP] Contains base64 encoded string "jatx4XL8ewpQzAH48FubVs6OHKpgVw==" in [Source : PCAP] Contains base64 encoded string "06EW1NQ5gXNuUDWJbkOz3SvFzA==" in [Source : PCAP] Contains base64 encoded string "528K2VywQImdxClmfxR5JGsoTKkRavNJb4Jg4BnSWEQUJM849A==" in [Source : PCAP] Contains base64 encoded string "CRzZi5SrSg==" in [Source : PCAP] Contains base64 encoded string "NP8eBuqzrtbQwVXUJzg43z5RwBbAdHJjQzrC3ltktNxyzBzhphPKLg==" in [Source : PCAP] Contains base64 encoded string "fA==" in [Source : PCAP] Contains base64 encoded string "pA==" in [Source : PCAP] Contains base64 encoded string "8cKiZsHt2WzMLLeSimTxOzx91QqtqNGbVSOLYg==" in [Source : PCAP] Contains base64 encoded string "0Kt21ISsjlHlTtNwb4iMXSUS2Yx40w==" in [Source : PCAP]2b:T46c,Assembly shows XOR instruction xor ecx ebx in Stream UID: 31269-1-0000000140006430 Assembly shows XOR instruction xor esi edi in Stream UID: 31269-60-000000014000B520 Assembly shows XOR instruction xor eax 9E3779B9h in Stream UID: 31269-60-000000014000B520 Assembly shows XOR instruction xor rbx rax in Stream UID: 31269-133-0000000140011140 Assembly shows XOR instruction xor ebx eax in Stream UID: 31269-133-0000000140011140 Assembly shows XOR instruction xor r9 rbx in Stream UID: 31269-133-0000000140011140 Assembly shows XOR instruction xor ecx ebx in Stream UID: 31269-133-0000000140011140 Assembly shows XOR instruction xor eax r13d in Stream UID: 31269-134-00000001400109D0 Assembly shows XOR instruction xor eax ebp in Stream UID: 31269-134-00000001400109D0 Assembly shows XOR instruction xor eax ebp in Stream UID: 31269-241-0000000140008306 Assembly shows XOR instruction xor eax ebp in Stream UID: 31269-242-0000000140010C10 Assembly shows XOR instruction xor eax r13d in Stream UID: 31269-243-0000000140010D60 Assembly shows XOR instruction xor eax ebp in Stream UID: 31269-243-0000000140010D602c:T76c,"stage3_fix.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007312) "stage3_fix.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007312) "stage3_fix.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007312)2d:T9e8,Found string "Query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325";" (Indicator: "select * from "; File: "stage3_fix.exe") Found string "SELECT * FROM %s WHERE Name='%s'" (Indicator: "select * from "; File: "stage3_fix.exe") Found string "SELECT * FROM __FilterToConsumerBinding" (Indicator: "select * from "; File: "stage3_fix.exe") Found string "SSELECT * FROM __EventFilter" (Indicator: "select * from "; File: "stage3_fix.exe") Found string ")SELECT * FROM __EventFilter WHERE Query LIKE '%%SystemUpTime >= 240%%' AND Name != '%s'" (Indicator: "select * from "; File: "stage3_fix.exe") Found string "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325" (Indicator: "select * from "; File: "stage3_fix.exe") Found string "SELECT * FROM __EventFilter" (Indicator: "select * from "; File: "stage3_fix.exe") Found string "SELECT * FROM __EventFilter WHERE Query LIKE '%%SystemUpTime >= 240%%' AND Name != '%s'" (Indicator: "select * from "; File: "stage3_fix.exe") Found string "SELECT * FROM %s WHERE Name='%s'" (Indicator: "select * from "; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found string "SELECT * FROM __FilterToConsumerBinding" (Indicator: "select * from "; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found string "SELECT * FROM __EventFilter" (Indicator: "select * from "; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found string "SELECT * FROM __EventFilter WHERE Query LIKE '%%SystemUpTime >= 240%%' AND Name != '%s'" (Indicator: "select * from "; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found string "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325" (Indicator: "select * from "; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found string "Query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325";" (Indicator: "select * from "; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp")2e:T50b,"stage3_fix.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "stage3_fix.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "stage3_fix.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "stage3_fix.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "stage3_fix.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "stage3_fix.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "stage3_fix.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "stage3_fix.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "stage3_fix.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "stage3_fix.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")2f:T870,"SELECT * FROM %s WHERE Name='%s'" (Source: stage3_fix.exe, Indicator: "select * from %s where name='%s'") "SELECT * FROM __FilterToConsumerBinding" (Source: stage3_fix.exe, Indicator: "select * from __filtertoconsumerbinding") "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325" (Source: stage3_fix.exe, Indicator: "select * from __instancemodificationevent within 60 where targetinstance isa 'win32_perfformatteddata_perfos_system' and targetinstance.systemuptime >= 240 and targetinstance.systemuptime < 325") "SELECT * FROM __EventFilter" (Source: stage3_fix.exe, Indicator: "select * from __eventfilter") "SELECT * FROM __EventFilter WHERE Query LIKE '%%SystemUpTime >= 240%%' AND Name != '%s'" (Source: stage3_fix.exe, Indicator: "select * from __eventfilter where query like '%%systemuptime >= 240%%' and name != '%s'") "SELECT * FROM %s WHERE Name='%s'" (Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp, Indicator: "select * from %s where name='%s'") "SELECT * FROM __FilterToConsumerBinding" (Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp, Indicator: "select * from __filtertoconsumerbinding") "SELECT * FROM __EventFilter" (Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp, Indicator: "select * from __eventfilter") "SELECT * FROM __EventFilter WHERE Query LIKE '%%SystemUpTime >= 240%%' AND Name != '%s'" (Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp, Indicator: "select * from __eventfilter where query like '%%systemuptime >= 240%%' and name != '%s'") "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325" (Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp, Indicator: "select * from __instancemodificationevent within 60 where targetinstance isa 'win32_perfformatteddata_perfos_system' and targetinstance.systemuptime >= 240 and targetinstance.systemuptime < 325")30:T4425,Found reference to API (Indicator: "RegDeleteKeyW"; File: "stage3_fix.exe") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; File: "stage3_fix.exe") Found reference to API (Indicator: "OpenThreadToken"; File: "stage3_fix.exe") Found reference to API (Indicator: "CheckTokenMembership"; File: "stage3_fix.exe") Found reference to API (Indicator: "FreeSid"; File: "stage3_fix.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "stage3_fix.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "stage3_fix.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "stage3_fix.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "stage3_fix.exe") Found reference to API (Indicator: "RegCloseKey"; File: "stage3_fix.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "stage3_fix.exe") Found reference to API (Indicator: "RevertToSelf"; File: "stage3_fix.exe") Found reference to API (Indicator: "GetUserNameW"; File: "stage3_fix.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "stage3_fix.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "stage3_fix.exe") Found reference to API (Indicator: "DeleteFileW"; File: "stage3_fix.exe") Found reference to API (Indicator: "GetExitCodeThread"; File: "stage3_fix.exe") Found reference to API (Indicator: "ReadFile"; File: "stage3_fix.exe") Found reference to API (Indicator: "CloseHandle"; File: "stage3_fix.exe") Found reference to API (Indicator: "GetTickCount"; File: "stage3_fix.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "stage3_fix.exe") Found reference to API (Indicator: "VirtualFreeEx"; File: "stage3_fix.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "stage3_fix.exe") Found reference to API (Indicator: "CreateMutexW"; File: "stage3_fix.exe") Found reference to API (Indicator: "Process32NextW"; File: "stage3_fix.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "stage3_fix.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "stage3_fix.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "stage3_fix.exe") Found reference to API (Indicator: "GetComputerNameW"; File: "stage3_fix.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "stage3_fix.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "stage3_fix.exe") Found reference to API (Indicator: "GetStdHandle"; File: "stage3_fix.exe") Found reference to API (Indicator: "OpenProcess"; File: "stage3_fix.exe") Found reference to API (Indicator: "MoveFileExW"; File: "stage3_fix.exe") Found reference to API (Indicator: "GetProcAddress"; File: "stage3_fix.exe") Found reference to API (Indicator: "OpenThread"; File: "stage3_fix.exe") Found reference to API (Indicator: "GetTempPathW"; File: "stage3_fix.exe") Found reference to API (Indicator: "Thread32Next"; File: "stage3_fix.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "stage3_fix.exe") Found reference to API (Indicator: "CreateProcessA"; File: "stage3_fix.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "stage3_fix.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "stage3_fix.exe") Found reference to API (Indicator: "VirtualAllocEx"; File: "stage3_fix.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "stage3_fix.exe") Found reference to API (Indicator: "CreateThread"; File: "stage3_fix.exe") Found reference to API (Indicator: "Process32FirstW"; File: "stage3_fix.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "stage3_fix.exe") Found reference to API (Indicator: "CreateRemoteThread"; File: "stage3_fix.exe") Found reference to API (Indicator: "IsDBCSLeadByteEx"; File: "stage3_fix.exe") Found reference to API (Indicator: "SetHandleInformation"; File: "stage3_fix.exe") Found reference to API (Indicator: "Sleep"; File: "stage3_fix.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "stage3_fix.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "stage3_fix.exe") Found reference to API (Indicator: "Thread32First"; File: "stage3_fix.exe") Found reference to API (Indicator: "CreatePipe"; File: "stage3_fix.exe") Found reference to API (Indicator: "TerminateProcess"; File: "stage3_fix.exe") Found reference to API (Indicator: "VirtualFree"; File: "stage3_fix.exe") Found reference to API (Indicator: "CreateFileW"; File: "stage3_fix.exe") Found reference to API (Indicator: "ExitProcess"; File: "stage3_fix.exe") Found reference to API (Indicator: "CopyFileW"; File: "stage3_fix.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "stage3_fix.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "stage3_fix.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "stage3_fix.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "stage3_fix.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "stage3_fix.exe") Found reference to API (Indicator: "WriteFile"; File: "stage3_fix.exe") Found reference to API (Indicator: "WTSGetActiveConsoleSessionId"; File: "stage3_fix.exe") Found reference to API (Indicator: "CreateProcessW"; File: "stage3_fix.exe") Found reference to API (Indicator: "GetLastError"; File: "stage3_fix.exe") Found reference to API (Indicator: "WriteProcessMemory"; File: "stage3_fix.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "stage3_fix.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "stage3_fix.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "stage3_fix.exe") Found reference to API (Indicator: "VariantClear"; File: "stage3_fix.exe") Found reference to API (Indicator: "SysFreeString"; File: "stage3_fix.exe") Found reference to API (Indicator: "SysAllocString"; File: "stage3_fix.exe") Found reference to API (Indicator: "VariantInit"; File: "stage3_fix.exe") Found reference to API (Indicator: "WinHttpSetOption"; File: "stage3_fix.exe") Found reference to API (Indicator: "WinHttpConnect"; File: "stage3_fix.exe") Found reference to API (Indicator: "WinHttpQueryDataAvailable"; File: "stage3_fix.exe") Found reference to API (Indicator: "WinHttpOpen"; File: "stage3_fix.exe") Found reference to API (Indicator: "WinHttpCloseHandle"; File: "stage3_fix.exe") Found reference to API (Indicator: "WinHttpOpenRequest"; File: "stage3_fix.exe") Found reference to API (Indicator: "WinHttpReadData"; File: "stage3_fix.exe") Found reference to API (Indicator: "WinHttpReceiveResponse"; File: "stage3_fix.exe") Found reference to API (Indicator: "WinHttpSendRequest"; File: "stage3_fix.exe") Found reference to API (Indicator: "WinHttpSetTimeouts"; File: "stage3_fix.exe") Found reference to API (Indicator: "WTSQuerySessionInformationW"; File: "stage3_fix.exe") Found reference to API (Indicator: "WTSFreeMemory"; File: "stage3_fix.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "stage3_fix.exe") Found reference to API (Indicator: "CoInitializeEx"; File: "stage3_fix.exe") Found reference to API (Indicator: "IsWow64Process"; File: "stage3_fix.exe") Found reference to API (Indicator: "NtCreateSection"; File: "stage3_fix.exe") Found reference to API (Indicator: "NtMapViewOfSection"; File: "stage3_fix.exe") Found reference to API (Indicator: "NtUnmapViewOfSection"; File: "stage3_fix.exe") Found reference to API (Indicator: "NtQueueApcThread"; File: "stage3_fix.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "stage3_fix.exe") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API (Indicator: "NtCreateSection"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API (Indicator: "NtMapViewOfSection"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API (Indicator: "NtQueueApcThread"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "CreateRemoteThread"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "IsDBCSLeadByteEx"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "OpenThread"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "SetHandleInformation"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "Thread32First"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "Thread32Next"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "VirtualFreeEx"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "WTSGetActiveConsoleSessionId"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp")31:T49a,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "stage3_fix.exe") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "stage3_fix.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "stage3_fix.exe") Found reference to API "[!] CreateThread for script failed" (Indicator: "CreateThread"; File: "stage3_fix.exe") Found reference to API "BeaconCreateThread" (Indicator: "CreateThread"; File: "stage3_fix.exe") Found reference to API "[!] CreateThread for script failed" (Indicator: "CreateThread"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API "BeaconCreateThread" (Indicator: "CreateThread"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp")32:T15ca,"rAction SilentlyContinue;Remove-Item -Path "HKLM:\Software\Classes\CLSID\$c" -Recurse -ErrorAction SilentlyContinue;$ui=(Get-ItemProperty 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' -Name Userinit -ErrorAction SilentlyContinue).Userinit;if($ui){$ui2=(($ui -split ',') | Where-Object {$_ -notlike "*$n*"}) -join ','; Set-ItemProperty 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' -Name Userinit -Value $ui2 -ErrorAction SilentlyContinue};Remove-Item "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\$n.exe" -Force -ErrorAction SilentlyContinue;Remove-Item -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$t" -Recurse -ErrorAction SilentlyContinue;"BURN-CLEANUP name=$n done"" (Indicator: "raction silentlycontinue;remove-item -path "hklm:\software\classes\clsid\$c" -recurse -erroraction silentlycontinue;$ui=(get-itemproperty 'hklm:\software\microsoft\windows nt\currentversion\winlogon' -name userinit -erroraction silentlycontinue).userinit;if($ui){$ui2=(($ui -split ',') | where-object {$_ -notlike "*$n*"}) -join ','; set-itemproperty 'hklm:\software\microsoft\windows nt\currentversion\winlogon' -name userinit -value $ui2 -erroraction silentlycontinue};remove-item "$env:programdata\microsoft\windows\start menu\programs\startup\$n.exe" -force -erroraction silentlycontinue;remove-item -path "hklm:\software\microsoft\windows nt\currentversion\image file execution options\$t" -recurse -erroraction silentlycontinue;"burn-cleanup name=$n done"") in Source: stage3_fix.exe, "%s\Microsoft\Windows\Start Menu\Programs\StartUp\%s.exe" (Indicator: "%s\microsoft\windows\start menu\programs\startup\%s.exe") in Source: stage3_fix.exe, "%s\Microsoft\Windows\Start Menu\Programs\StartUp\%s.exe" (Indicator: "%s\microsoft\windows\start menu\programs\startup\%s.exe") in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp, "$n='%s';$c='%s';$t='%s';Get-WmiObject -Namespace root/subscription -Class __FilterToConsumerBinding | Where-Object {$_.Filter -like "*$n*" -or $_.Consumer -like "*$n*"} | Remove-WmiObject -ErrorAction SilentlyContinue;Get-WmiObject -Namespace root/subscription -Class CommandLineEventConsumer -Filter "Name='$n'" | Remove-WmiObject -ErrorAction SilentlyContinue;Get-WmiObject -Namespace root/subscription -Class __EventFilter -Filter "Name='$n'" | Remove-WmiObject -ErrorAction SilentlyContinue;Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name $n -ErrorAction SilentlyContinue;Remove-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run' -Name $n -ErrorAction SilentlyContinue;Unregister-ScheduledTask -TaskName $n -Confirm:$false -ErrorAction SilentlyContinue;Stop-Service -Name $n -ErrorAction SilentlyContinue;$svc=Get-WmiObject Win32_Service -Filter "Name='$n'"; if($svc){$svc.Delete() | Out-Null};Remove-Item -Path "HKCU:\Software\Classes\CLSID\$c" -Recurse -ErrorAction SilentlyContinue;Remove-Item -Path "HKLM:\Software\Classes\CLSID\$c" -Recurse -ErrorAction SilentlyContinue;$ui=(Get-ItemProperty 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' -Name Userinit -ErrorAction SilentlyContinue).Userinit;if($ui){$ui2=(($ui -split ',') | Where-Object {$_ -notlike "*$n*"}) -join ','; Set-ItemProperty 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' -Name Userinit -Value $ui2 -ErrorAction SilentlyContinue};Remove-Item "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\$n.exe" -Force -ErrorAction SilentlyContinue;Remove-Item -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$t" -Recurse -ErrorAction SilentlyContinue;"BURN-CLEANUP name=$n done"" (Indicator: "$n='%s';$c='%s';$t='%s';get-wmiobject -namespace root/subscription -class __filtertoconsumerbinding | where-object {$_.filter -like "*$n*" -or $_.consumer -like "*$n*"} | remove-wmiobject -erroraction silentlycontinue;get-wmiobject -namespace root/subscription -class commandlineeventconsumer -filter "name='$n'" | remove-wmiobject -erroraction silentlycontinue;get-wmiobject -namespace root/subscription -class __eventfilter -filter "name='$n'" | remove-wmiobject -erroraction silentlycontinue;remove-itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name $n -erroraction silentlycontinue;remove-itemproperty -path 'hklm:\software\microsoft\windows\currentversion\run' -name $n -erroraction silentlycontinue;unregister-scheduledtask -taskname $n -confirm:$false -erroraction silentlycontinue;stop-service -name $n -erroraction silentlycontinue;$svc=get-wmiobject win32_service -filter "name='$n'"; if($svc){$svc.delete() | out-null};remove-item -path "hkcu:\software\classes\clsid\$c" -recurse -erroraction silentlycontinue;remove-item -path "hklm:\software\classes\clsid\$c" -recurse -erroraction silentlycontinue;$ui=(get-itemproperty 'hklm:\software\microsoft\windows nt\currentversion\winlogon' -name userinit -erroraction silentlycontinue).userinit;if($ui){$ui2=(($ui -split ',') | where-object {$_ -notlike "*$n*"}) -join ','; set-itemproperty 'hklm:\software\microsoft\windows nt\currentversion\winlogon' -name userinit -value $ui2 -erroraction silentlycontinue};remove-item "$env:programdata\microsoft\windows\start menu\programs\startup\$n.exe" -force -erroraction silentlycontinue;remove-item -path "hklm:\software\microsoft\windows nt\currentversion\image file execution options\$t" -recurse -erroraction silentlycontinue;"burn-cleanup name=$n done"") in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp33:T19d0,"$h=2147483649;$k='Software\Classes\CLSID\%s\InProcServer32';$r=[WMIClass]'root\default:StdRegProv';$c1=$r.CreateKey($h,$k).ReturnValue;$c2=$r.SetStringValue($h,$k,'','%s').ReturnValue;$c3=$r.SetStringValue($h,$k,'ThreadingModel','Both').ReturnValue;"CreateKey=$c1 Default=$c2 ThreadingModel=$c3"" in Source: stage3_fix.exe "Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options' -ErrorAction SilentlyContinue | ForEach-Object { $g=(Get-ItemProperty $_.PSPath -Name GlobalFlag -ErrorAction SilentlyContinue).GlobalFlag; $v=(Get-ItemProperty $_.PSPath -Name VerifierDlls -ErrorAction SilentlyContinue).VerifierDlls; if($g -or $v){ "$($_.PSChildName) | GlobalFlag=0x$('{0:X}' -f [int]$g) | VerifierDlls=$v" } }" in Source: stage3_fix.exe "$n='%s';$c='%s';$t='%s';Get-WmiObject -Namespace root/subscription -Class __FilterToConsumerBinding | Where-Object {$_.Filter -like "*$n*" -or $_.Consumer -like "*$n*"} | Remove-WmiObject -ErrorAction SilentlyContinue;Get-WmiObject -Namespace root/subscription -Class CommandLineEventConsumer -Filter "Name='$n'" | Remove-WmiObject -ErrorAction SilentlyContinue;Get-WmiObject -Namespace root/subscription -Class __EventFilter -Filter "Name='$n'" | Remove-WmiObject -ErrorAction SilentlyContinue;Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name $n -ErrorAction SilentlyContinue;Remove-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run' -Name $n -ErrorAction SilentlyContinue;Unregister-ScheduledTask -TaskName $n -Confirm:$false -ErrorAction SilentlyContinue;Stop-Service -Name $n -ErrorAction SilentlyContinue;$svc=Get-WmiObject Win32_Service -Filter "Name='$n'"; if($svc){$svc.Delete() | Out-Null};Remove-Item -Path "HKCU:\Software\Classes\CLSID\$c" -Recurse -Erro" in Source: stage3_fix.exe "rAction SilentlyContinue;Remove-Item -Path "HKLM:\Software\Classes\CLSID\$c" -Recurse -ErrorAction SilentlyContinue;$ui=(Get-ItemProperty 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' -Name Userinit -ErrorAction SilentlyContinue).Userinit;if($ui){$ui2=(($ui -split ',') | Where-Object {$_ -notlike "*$n*"}) -join ','; Set-ItemProperty 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' -Name Userinit -Value $ui2 -ErrorAction SilentlyContinue};Remove-Item "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\$n.exe" -Force -ErrorAction SilentlyContinue;Remove-Item -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$t" -Recurse -ErrorAction SilentlyContinue;"BURN-CLEANUP name=$n done"" in Source: stage3_fix.exe "iSoftware\Microsoft\Windows\CurrentVersion\Run" in Source: stage3_fix.exe "kSYSTEM\CurrentControlSet\Services\%s\Parameters" in Source: stage3_fix.exe "Software\Classes\CLSID\%s\InProcServer32" in Source: stage3_fix.exe "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: stage3_fix.exe "pSOFTWARE\Microsoft\Active Setup\Installed Components\{%s}" in Source: stage3_fix.exe "pSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%s" in Source: stage3_fix.exe "SOFTWARE\Classes\CLSID\%s\InprocServer32" in Source: stage3_fix.exe "nSYSTEM\CurrentControlSet\Services\%s" in Source: stage3_fix.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\%s" in Source: stage3_fix.exe "SYSTEM\CurrentControlSet\Services\%s\Parameters" in Source: stage3_fix.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%s" in Source: stage3_fix.exe "SYSTEM\CurrentControlSet\Services\%s" in Source: stage3_fix.exe "$n='%s';$c='%s';$t='%s';Get-WmiObject -Namespace root/subscription -Class __FilterToConsumerBinding | Where-Object {$_.Filter -like "*$n*" -or $_.Consumer -like "*$n*"} | Remove-WmiObject -ErrorAction SilentlyContinue;Get-WmiObject -Namespace root/subscription -Class CommandLineEventConsumer -Filter "Name='$n'" | Remove-WmiObject -ErrorAction SilentlyContinue;Get-WmiObject -Namespace root/subscription -Class __EventFilter -Filter "Name='$n'" | Remove-WmiObject -ErrorAction SilentlyContinue;Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name $n -ErrorAction SilentlyContinue;Remove-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run' -Name $n -ErrorAction SilentlyContinue;Unregister-ScheduledTask -TaskName $n -Confirm:$false -ErrorAction SilentlyContinue;Stop-Service -Name $n -ErrorAction SilentlyContinue;$svc=Get-WmiObject Win32_Service -Filter "Name='$n'"; if($svc){$svc.Delete() | Out-Null};Remove-Item -Path "HKCU:\Software\Classes\CLSID\$c" -Recurse -Err" in Source: stage3_fix.exe "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\%s\Parameters" in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp "Software\Classes\CLSID\%s\InProcServer32" in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp "SOFTWARE\Microsoft\Active Setup\Installed Components\{%s}" in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%s" in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp "SOFTWARE\Classes\CLSID\%s\InprocServer32" in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\%s" in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\%s" in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp "$h=2147483649;$k='Software\Classes\CLSID\%s\InProcServer32';$r=[WMIClass]'root\default:StdRegProv';$c1=$r.CreateKey($h,$k).ReturnValue;$c2=$r.SetStringValue($h,$k,'','%s').ReturnValue;$c3=$r.SetStringValue($h,$k,'ThreadingModel','Both').ReturnValue;"CreateKey=$c1 Default=$c2 ThreadingModel=$c3"" in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp "Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options' -ErrorAction SilentlyContinue | ForEach-Object { $g=(Get-ItemProperty $_.PSPath -Name GlobalFlag -ErrorAction SilentlyContinue).GlobalFlag; $v=(Get-ItemProperty $_.PSPath -Name VerifierDlls -ErrorAction SilentlyContinue).VerifierDlls; if($g -or $v){ "$($_.PSChildName) | GlobalFlag=0x$('{0:X}' -f [int]$g) | VerifierDlls=$v" } }" in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp34:Tee7,"$h=2147483649;$k='Software\Classes\CLSID\%s\InProcServer32';$r=[WMIClass]'root\default:StdRegProv';$c1=$r.CreateKey($h,$k).ReturnValue;$c2=$r.SetStringValue($h,$k,'','%s').ReturnValue;$c3=$r.SetStringValue($h,$k,'ThreadingModel','Both').ReturnValue;"CreateKey=$c1 Default=$c2 ThreadingModel=$c3"" in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp "Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options' -ErrorAction SilentlyContinue | ForEach-Object { $g=(Get-ItemProperty $_.PSPath -Name GlobalFlag -ErrorAction SilentlyContinue).GlobalFlag; $v=(Get-ItemProperty $_.PSPath -Name VerifierDlls -ErrorAction SilentlyContinue).VerifierDlls; if($g -or $v){ "$($_.PSChildName) | GlobalFlag=0x$('{0:X}' -f [int]$g) | VerifierDlls=$v" } }" in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp "$n='%s';$c='%s';$t='%s';Get-WmiObject -Namespace root/subscription -Class __FilterToConsumerBinding | Where-Object {$_.Filter -like "*$n*" -or $_.Consumer -like "*$n*"} | Remove-WmiObject -ErrorAction SilentlyContinue;Get-WmiObject -Namespace root/subscription -Class CommandLineEventConsumer -Filter "Name='$n'" | Remove-WmiObject -ErrorAction SilentlyContinue;Get-WmiObject -Namespace root/subscription -Class __EventFilter -Filter "Name='$n'" | Remove-WmiObject -ErrorAction SilentlyContinue;Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name $n -ErrorAction SilentlyContinue;Remove-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run' -Name $n -ErrorAction SilentlyContinue;Unregister-ScheduledTask -TaskName $n -Confirm:$false -ErrorAction SilentlyContinue;Stop-Service -Name $n -ErrorAction SilentlyContinue;$svc=Get-WmiObject Win32_Service -Filter "Name='$n'"; if($svc){$svc.Delete() | Out-Null};Remove-Item -Path "HKCU:\Software\Classes\CLSID\$c" -Recurse -ErrorAction SilentlyContinue;Remove-Item -Path "HKLM:\Software\Classes\CLSID\$c" -Recurse -ErrorAction SilentlyContinue;$ui=(Get-ItemProperty 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' -Name Userinit -ErrorAction SilentlyContinue).Userinit;if($ui){$ui2=(($ui -split ',') | Where-Object {$_ -notlike "*$n*"}) -join ','; Set-ItemProperty 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' -Name Userinit -Value $ui2 -ErrorAction SilentlyContinue};Remove-Item "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\$n.exe" -Force -ErrorAction SilentlyContinue;Remove-Item -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$t" -Recurse -ErrorAction SilentlyContinue;"BURN-CLEANUP name=$n done"" in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\%s\Parameters" in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp "Software\Classes\CLSID\%s\InProcServer32" in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp "SOFTWARE\Microsoft\Active Setup\Installed Components\{%s}" in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%s" in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp "SOFTWARE\Classes\CLSID\%s\InprocServer32" in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\%s" in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\%s" in Source: 00000000-00007312.00000000.146860.46FB4000.00000002.mdmp35:T828f,"GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=A2SQHOHOKDauwI5n-dFi1gR8gpso3KjEYRYiU24b0XIJTpN9Gzh_cJtraHOFnBjVsw0ZeRY1IgPIqJUU507LfxQQZg-fPnh5KVbG8glehDJh9Te8xALHW8HMJoSGlYLRIqneeFl26hFLM4oAepCBWbs__nhN3j_G-sd3tVmwXF7_gF_Q3e8p9dJ_BLP0qbhfsxm9volqg5vd1JwPlGoN_gwQPYCCWs53RhtNolu0RU8LceSnNEu_9QOwb3GmvWog2hYhCBUVV4gJbEH5COY7s408veXlOlvam7x5LOqFKMqLdfwFAgST-mbemuNB7WeKwA== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:04 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-9DF0 X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4969 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>653879543634486931716F4A7970366D333945794C7A7561767857645366644643645572705566466B393561454D5A384C35767644673D3D....... "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=BGSQHOHOKDYXboYSlL6gxa3sBrv1hhXxqZs1PJurQrtVMXKaizqcb58HFz4-fMv03qVxUmJTPwb0AhMjvLs9TsLKtJGGGVQl9j3xmeCsm3PZm2lUIH4pnw2wWZnKFmf4R9iscMU9B_9gLvtivLQgMC3-ki0Ne_8CJU19C06P60j-xTf1jdbp4rEQnzwtgdwONhE3x0L67xcHN2Ob6C_CRVMjvEEzGBfp6_WbVdsscq2OorT-d_L839ZReyh95KDGv6EwAE9rC6woqeNFBrfZja1uiAAvQhyANJtqN4O7StfbnyjAnZ_KrwctokaGYmuF4w== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:04 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-DC77 X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4992 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>6F714F54726F6F417238626E4F6D4F7756736B305955376E4133704434476B317A534131506F5138427656656C337449426E753063513D3D....... "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=BWSQHOHOKDblJ8cbLEbDTxqGfR_icYlaVf1nJ8ZorzvV2ym4-Ecd6mdke2hYftT5EvC5i_IY6SmEnrHSXjfFwlS7Pu52eMBak14BOnzZJM6p9G59RZHS7UQt4DNjSP4gZm-N7pUYAbwdU58z5hqGceU5LUIK-kFq2AVgNpwprYGuGOXDQC41cxQPuOCeCzcJNAeysYlesWyuYEu9eQ0RUv2d02KkR4bQZq24Dhd2ALW_Mdjyv1E04-F_UhB63T2EJ3JQczQhjOF1ZvrYagy7vmAnrw5H88mwr518mzkn9ICEh555kfhIrs2EsB7wro6rDg== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:05 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-0923 X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4962 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>36796D6E5164774F5675492B655838496C7A68666544536E5968697064774C2F753851414572456A514167502B4A7436574F674458513D3D....... "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=BmSQHOHOKDZQncYnAannG57vx3tFa8oD372-sZlDDcFILBxYuDKLetIfQPAWHcT0rrHEDhv67ad-OW32Put6nxA4KE1lf2CEf6epzORbYX_iivQhw7i_002LpHX1b0rTKyTFN9KpUcmlL_Wsb-hAkNTwZc-5qoO8IIf7FH07vMS60AQ9IEdxCLEsPvCCYnZfIDYzGpA_T5g8OxqeZn95robmI0ptxhvAoDUv7jcfVoMlFCDLdHC-qEvU_qGomQRdP7ajzjqw7ocMfdzfhkD3ndTY1-YOjhe4RfMREQd62cFwPTTD4mYDHn11Vec6SZCEpg== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:05 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-17BE X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4957 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>66714F65393846477344707A5549684C714238585772447577655758576E452B6357713639734E5349726662724278454A5945584F773D3D....... "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=B2SQHOHOKDZ_2REiPBeNcXC1wLrb1j2lvOP-AzW3fA18euLbC5tavtS25g6DBvJcOthzmFgPqoB0A7I6GHV1NA3OqInmZmuWT-SH_sxA3nd3SKMvdquVbWyh2XjcdV0MUxAlk6WLKz-G_1kERZvH2opzlSj02iQMyxpkUddMj7zfhvv8Y6VrPjjDinteONsheXyFXI81GJwoZvDG1XKoqxLeUiwpLX1J231tMppAjdPlJQ-HoMtVoJ9WSkzFs1BzjmEZQMinYIVf7WAfck37P4Czt7L1icNze0-guCV_RqejTzWO2jorB5TSSNy1TDp5IA== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:06 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-757B X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4952 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>764E5A486A7735384652483938794D7975673855784930353838446754533247505264586B6959434A4346795752663751455A6E71673D3D....... "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=CGSQHOHOKDa-fW5IzG-41Kjrr6cYkXo0FR3rvdT5k5FdeV6lR7lty38kUD-Fope6gm-RgAyp6gRW428oWnLiwUlmYN7JBLtM5N0-ekx3nmPmXSkgmtUMaq5OkOjggzfPT_QRtsoKIs3iXf6ek8au1nBtcFew1fJ9rpDSXVmPyK2E_yf6nK7wZ0n9xKgCmRv8l59JGQOpAryJXd3GrVN34HD9CboEyFdoHGWivAEuShHR4E6fjao7aUKCK8IpGGr0IEy5f5ZwiFRipcVfl3NePEmiMLCHFE-TLL5F16RBUkn6L3zMMsHIdJkXXVs8xbim1Q== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:06 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-0A04 X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4975 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>473274524139624B5871413242497A6A5865737A563852572B4C564A7A7367674C6B4E6F4655355675617A676C77556359504D6561673D3D....... "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=CWSQHOHOKDatPPWONe6VAv-kSuemen6TNkmWbcNRuH25szs4GQtevk4DTk86RBB0wukUi0z5f8o6-gIlIAg33v5izMhRj_r-mCrlXZMEucKYoCUyFDTPSew0U8lbwq-9JY3jeucGTc8v4fTyQa3_DQskxYQVAniC_i2NujEgcHehbHfJoj4_e6M6crq8dOwStMclXKnPL2IbMt5RcjH9YZEoe5SzG8h6wwKmTQyDMjQMftpLlnzyFOlr0p4H_Cqmw97tiSonPSlhJq0AMJXHAI0ADZgHTX3ZYiGtrPC292Y3HKXXRIIiMEaZgGa-w2LYWQ== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:07 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-5E0F X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4959 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>79365242553454376A2B786E6C697A32553161506E77524B4741455A4872365933673166724146315A6A3359356B4D4A2F71776753673D3D....... "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=CmSQHOHOKDYkwVaJrns7t-fzwbNuuKyHj0b8FAvGnYgijJzYc9DDtgSwYtF8SdonPiGJNE0ofEW_rtECWNZvHThbFLsEC9KByujNWW80i7GlEZNPTKz8sg3NKwAjSNwiC7ZJIypq_7_Ptqa8Q7xGB9cQDmIAQmgCDq4UBxUH3T6Io-LKBr2rViZ47OpcMiyjdMACoDdZez2c75487gdsQQ2LNoaL_Ur5EL6mjP07y5vQjDoVwK8RC2Qns3mFhRoAFBFTcMC8n2I75wtn82Zdn97ai1Yytj4EtfgMlZeksw__jQxgINsx68XubvWvb4Vubw== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:07 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-5DA0 X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4957 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>7A726E7A7353306B396366767361534E6368454572574837432B53414F2F31677251356B6E702F6866736B4E2F446D766F59376D6E773D3D....... "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=C2SQHOHOKDaAeXbGJjbt1_8EhJ5yiRp7sz6Jgb5p163EgynDNT52AYF6ANs6UYexNtADPeh6_wQhhUJ7v6l1w_sORdOn8-X4HBx-VCSqNVljS4BZYjNi8X4ui9NvZoGtHDKuOqjnxG8bCSW6qcnURDDBkRd_etdSETBKr6_qtFJXMa8HLIvKMn_8cv3eAHM2EZmg27CMU4lBZtnmIheL2G_a2zevDD_FMqdS5YovQ1H-9XskmqM5bNag9iegFNhsl3q3i9c6_0myd_prpX0Y4bDokQq6lWqCdVi6VE_pSuGXMb4APZvzDP4LIgtCJ-zJCw== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:08 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-267E X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4962 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>5778536D556754775556344A7046506A2B536E31344A7970474542746A6E2F3039316545787375376246572F71506345636B694C37413D3D....... "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=DGSQHOHOKDbrI1a4uD6AY0hM6aSjZo_i2NQ744gjFW0ICqxfIgwVmSrp-a2Lf4Bk1MfRE-iMUVcBerL6BHKoKArf2g5CVrJ08VE4PpRNEEpJjkGa0LWGPi2v5UeMH_WWtrrERQxMvhP5kbnGNhSxHH3ccYK_G78fUd7czkOSqZxaow-46S3HjYcaegQH09nFEflEr6hoVzDEH4h53gJlD_ly-lNZolgZ8WegVEQSHG-pqMTtqyYJqlGEaRQBi0P34_yFwsIDQ1-nuoyYZFoIQUih0J2W5Oyi5gRrVrWz5OLndnoOQuCEo-augbqSyHha9w== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:08 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-4D66 X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4951 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>6E36704B6F52416D306C585931502B70656A534430396B436F68774F75584935514F4E714C6D55467A59786549516258452B6C5870413D3D....... "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=DWSQHOHOKDaCrxa7gtuvjMiF3Gr96AO00kdlYN0DD1JLOsFUMqSkSV7SYFWs68lsIiWWBhZj6msV8jOvXrSyT-Ol5tCQBQyUkNvSF7Wt88oCY3cEtgO_OSvgLfB2o4oma-O0-dKGZi_ygoTwNkSVzutZ5G400oOYkKUT5dRblu7O17yYMzibBsnHwAMbuXAozZFEmQttssft1QMsLOM93dL9wt6NDR5X_cpR11tkmrAigob5xSfBoUjdACa20hr9us9chH1_24DQdea4K3p47eedP3YW5-klzrwGSJ9Bvl3LI9rocTJjIUNIWBL6Xbvszw== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:09 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-142A X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4985 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>6A376868644B6C43435364633951424A5574635970746C31624D4C6E73685469464265764D354A6569696F7A7136414F7150534459773D3D....... "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=DmSQHOHOKDa6Re-l9r2628ziGgPpARct2S4CnRoNmUiYrjip59CwgPXK9XNkGCVEV4XJb541vspCMv_7lgtvzLpgFitO05K33IvpBETm31OKg6AgOz0kNKwkRY_FsXiFaZ9mPmAEG7BHpQ8OQqlIwCiLt50YM5jOSGlPmox0qqHOBNBgsiLUg9UuCexiSpB-P2O-IRKbKbJAuEPJCrIQc-QT5Ij1EvUVFhQ7J6roPBAUNMcwuTMHyvdzD7lXTet4b9KRy6h3U0AIkLuPdW0QVtZnlE9710nPzD_PcCAGjqL851jlEmhJpUNXVhVQZcaJjw== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:10 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-5C7B X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4996 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>744945575A685972326176663535637A344574426F47556C5362622B52356C544654774365596C74614E55514C434931346167362F673D3D....... "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=D2SQHOHOKDaJiZ7Q90tVvv2isfPNAf8wV_4NGIQB9dsnJ39_Qy3tBqWLaam-J44Ma7rcCzdyn4IqjObXtYn1RHTsHFteMmIQFaKfi0ksCIwAmCySUQQzMX0hbOYBrOdWH_Wk8nUoDVd1LKo71eVZyhfN06GoI6y93ok5HaSKa8FoQDcHAZ6uXecs_-3Rwi5X0nZpULCSV4wle8KrRV_aPADw9zwWpRcC8NoeqgrHYsTsBWUbyZ1uTvjxhZZcrq_fRFWIh3VM2z-IHD3CoY_Z7pXnnUojI5RYa8uVyAAGsLPV4DVWf6ZzyD0MPoIaaV2kxw== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:10 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-597D X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4957 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>32542F5459556B30425077676A774E3552546C656B646C3752437A304352655168434F5134625879684E48386B5674453163462F58673D3D....... "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=EGSQHOHOKDZnaZNsvSCI6lqhsuO--2YTuvx_eI06s_as4Tm48VHZWcVfFi2P8BOOYZ167gj6oHQPhbDIB8sy2nC5uFHw1mkUV2HpJvl9FM5YJ1aqY8thFqVTodqJ7TRt1SMbWK3B9sXGX8Qd7Dmo8xPo0F4uWQJCUQS8SxEgdwdFdudC7KvCCMXQubaRvA_ID9ujmyl-Y1KQkbR6vVsPNgWL8mDM4Q4hwVswR4p8U5c52ecDUycgiIbovyPDkSJ4wRU0tZRJcysQYPKZjllCC3GdaoQatnC1TqgY1aaWHbeC3omoyunQ91w-pDfoAa9Obw== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:11 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-23F9 X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4964 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>4D784131704F493348636D7337777666345966714A73796F7A3336564C7267383076755A58524870516E3376336438554469476B63513D3D....... "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=EWSQHOHOKDZ3YICw-xbJoheD8fftX0vTbL7eh_K2dK9i_EW9V3UmopJxqlNAkParI4zlggUuTbUDbO0a8mL5sVe2aO6tOoM0UNJioZ0G_rgTTsrSwpeijuaZaKzmBDuXrYI5e724_fDxFEZ_qoZuanXUwpF_6pgraGuljLP4T350Ptw9yJjHEq9M4gzO644RocjblfI7oEegRW0Q8cwkTEW3eiVNm7506AQN3rp3JQIAJlLRQbgkoy3pGXIo4G1rA4sYIz0IKwm8_l4iV1In-6PZe22xbP87xpUgjCHchfC8uyavL-hEZPBINpnpky3WLQ== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:11 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-8AB3 X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4974 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>5357767542672F553167763875546F6333434867443666346F644C304150796D356B6232316751324C724F716B4C4677666D427877773D3D....... "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=EmSQHOHOKDaU8sCa0IpymzhQdQZn6MJ4Pe6-pDt3XadYxgC7gUj76oKBlzzGIol9TjdnDFhpmrrRlKwbuB6VWGsZssz99PlHB61HNmMhXk6yRSHfkefl--rW-7Tl2IFgHR80dH5ZQWhrqLuDiSto1K5SVxzE771WqsS6zYHyu1J6ob8dvDTmMLwxPSmRqrv5LM__2WlM03vKDLOT8ZlKfQV6K2vB6dpBewviOI0qkD0f61hQhkAkIbZCIqIcH62H4oISn4zjMWjZf435raSS4bmhiMgIjoQ0vCjtzle4_mB-5ISGbDiKpN_FKeld4ZEt6w== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:12 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-63F7 X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4966 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>786831634D4C464C4C59786656704D5478534F484E4D46636E4C39714F4836304434612F327247365363545531704B3049342B7A41513D3D....... "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=E2SQHOHOKDai0q349Q9HcZJSzJAT36NWo5kh2MaQwJFA1Y_em0O4TH0OaFPU-eajBndV7G7yO8FMqssm3kxFwwjQji_aG_FOYCFzjk5GPsQhY9CcoJ1pTC-QNXc8bc9Dhmu4-iVTGbqXb815YcZuSnmfUsX3wnLmGi04xUebxC0MkRbyNOFdG2Xm-w0nbOqe1aaZBT-qKVd-v5WKIkLJeb8_PbjC2ASheUOWaBe-PWv9l03OGJqRrMPj68d_rb0761Fi_DSvPQqnGM2qXZla-NNC1kUAO6nn1tWhkpcSduMkYcWYsQ-vZsc5Dsxd_ewiFg== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:12 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-5A6A X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4995 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>63517364486F7A6F7738366B694B56555A68774D776734316930655539464A664665744F32496765716F6635584B70497972414C58673D3D....... "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=FGSQHOHOKDaQxRXOJtHlrtJQJL9JRcCqELJCZEvuYWXxUFPQRDZm1g6JfYWLFzKuFKypQN0Kmk4UEdBXfoogmeU-9uQqtVIwERVEeIgHjRz-p8RI8Mwr9b4Yn9uh2GdErnE8Ph-1Y5J05Y31OAQ0bD5q4QFasg4bBL4WJT6TWYf4zLWQ-EE2NPXbujb5TyZsJ4g1zaZnZTXmE87wSxrNw5IovWfy9wXZu2Nu9DeacFncRmEOz0rjghkz0grZGeJSN53bczKSlQb3-jQMbLTWACFyw3kdqvinR48R0SspRHO_wFnTMJ5q-cJtrC4ABJkGrg== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:13 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-E46E X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4964 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>4D712F7448625679485A5A4A62526E477A472F6C4871784D4670334E6C5038416B364B6946504457546559365A626965455A706571773D3D....... "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=FWSQHOHOKDbbFnmtO1-67COtm8roZRgqzQrxYOFxWK8DVWZVYIo4VVlFlJN67zceayU5gj87VKALkZQhYS26uo0qNOum8qgt2rFSemqdvs83_qadYp-gthmYiqv39U1sV3QSua4y0M3TOE-WNOpeWX59d3mrjq9mCb3egAXidQ_VmZbqVqRLZaxomi29goraqQqm_dfgn0jS1JqSlHv2wx0HqP9R1Raje-zV9E0WwM7ZNYj77OCBhZp1e6x8l8tGYol8fc-PtXRDrlr9Pblh5okdAo0K_z0GwBAn4P5tzLq47tHQtH3HcVX2WV_S6pliNA== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:13 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-4A86 X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4964 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>5A4B3574736F2F536E33573042397069784C2B50486868643731326D5A733043516641694C525033383637516566677A313467332F513D3D....... "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=FmSQHOHOKDaOOmAOjoA9gu7tWHyKkHw9x3bn0f96vX9eQFQXZb678PWPDmGceiIHfRy6g0-vhdiQr_IYkEKbOM2Aj1IVxvm2rjo52T28PwMfxivfuNrXJrY9dtQebwSfJ04kjYy97ogirnhLhuuC7hT8pJx8fl_f_pi3vL5MtlDi1e3wsQkg8FV2HL-IlXCYuo8SeBLzLSg7l6ELJAecqzcZAYuWHt-Q1Cherl6IKtOecCaPG8Jy1ByzLaeZZgEjJ8tt9cikElzHginabRR0xPnvXsID1ia84YYO48DCIvpveH_SlANj61sE1XtvfCbUMg== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:14 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-DE31 X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4985 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>784B694879417857655A736A4D4F636562466A2B6D75734C7672365665353652727A5A37516D417778434C674D49574874744D486E673D3D....... "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=F2SQHOHOKDY98dPK1gBjsKBgXWRkxxr7AyEfqDT7Hz0uJkN6n8IZrxUs9dx-UU_4wSfDMgf7TDbaLeppwabkeS88t5ykSibJc04y5xfJZZ6Sc-aOiD3wkwhJ0JJig2AUhgpMVA_peOEq1TXD-2LCvZELRhSbjp89bTOjTRZEAkq1D4Gx_Jbgq1GfzqpX-ucid1otPZ_CS_BqjhE7P9PuCOHKWdke5mI5cbmrRAPWkF8cvDQ512wh3501ld3Mz8LtJpdADcMwm0J626641WPWzoybg2juyp7XmTsUXI1bhxhdZntK4LtrDoqNaQSmy7kDMQ== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:15 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-0014 X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4984 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>5355536B4C50443156594536356C2F564D776344566A744E4769674D56676A3644337647746541477A32366332633443454C363034673D3D....... "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=GGSQHOHOKDaA3M8u-wz4NE83fxMzBUWUUZlo8BI0aHnsrhdL6s9dd2v2KiPFSCBY4vO6ScpTg9H5ZyitvsK65okr9eCy2qO-SMX1pA1qA9oktD4XQT8ypZ67psX-uNU3WW0djeyBfYi6pLa4HQqanTeFtMN2WJVXtgY3Njf9oLHV1beHSk4ccxu0j8LGSWFNUBBCZufta15KYpD2uPPcoiiIGnSPhiOmeaJ04Tilj0YdZAK-2nvhui-RNgeM3ZA72WgmlEH14TefMKc4OPNYWEmiLyIDrCE3VQvytLtxzpcY6TPGLVcqaX5wsNQSX0mikw== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:15 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-9F42 X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4964 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>3465316C4742756C376D6F537A41326D62357549465039783670694646792B536C39336D42384C7A4A435342676465673950757949673D3D....... "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=GWSQHOHOKDZ7aqNa2ocvVEsnj1Xt5VU4cT-ed9Mx8jpsvPC7rCiJhYf-r6vBoYPFg1_GRtphC8fvWbYN1hLzPByhrFRb58Zzf7JT2iuRBpI8BVlXD96K6op1KqC0RPWw8f75msy0n0ogbHbypZ5A8ZDyT09K9e676LpaYqX-p8TvvbKZUZ7StK5JIkg2p4DHpBictBkkRS1dJzx3mHZjKbCRSg754-OqZoRRPn3E7oa13vSv1YTOgREQL2cGqLOxzztutSWI-Ec3VF7AGOEHgSGV3dv4BxpldmiVr-1PIuVlOvq13qK-aYP-ROO63xoatQ== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:16 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-EB43 X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4979 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>73496438767467534341506D58325054784C4E434254324452476152773173706459563033667948345965626157764761486A6233773D3D....... "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=GmSQHOHOKDZKVTYc6mxrzWIif6iWdhyCYHfqdUhN4ibSd0HUdhAK8UtB4MyO7mLAxKeOfy6VGPdpJDqoF6tbAqxNuYxd7fXZM8V2W1kCx8zVPeSVF4FwOaGJIbq6zM4G_rS2_mOBdqqJ33EoLAyQjFBTaMH0P4t8QPlo-1zNHYd7IYxVjIslFrIouk9H2D0KlGC7K30_oSyFbshMLeSuzZf1A0d7AKeVyC8djRM-fnkF5suSvERbk7nsJ1UeqbYkNW9ML9ZUoaj7BXV02E01DXW2Vlv1Wi-oIgDobTBS3zvSit5M-pVdeU-9XrYebi7qUQ== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:16 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-EBAB X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4999 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>3568374C4C5453526A554937354B39706538697A577445794C794F344D393470526A42376656764B6D717061384369545755474842773D3D....... "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream, application/json;q=0.9 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Cookie: falcon_session=G2SQHOHOKDahm0ToxhW3qwN73yM0GHviA5qlAMI_7p77WIKilR_oMPXUP15rj99xR42wBcpfwgMphq-VIh72QMRSN__QVtJ2oMC2cuCdhKr7CEKh42iP8iiuydvYm4gatQHvMEkG61OCMREA_0BVPonK_u-0rTUJuzfDiWC4pfX9a0Uss907u5qRcJZ8cczm2dMAWs8FdWSJ_hXBlXGUFjN9l8ldXLqLIqmlYSKG29DS2D_jQt_jm1zvYnqfF5F4cua9NNiFYtOQEzc3JFeiBm78Su5xZQ4Gx6WIzt7DmcsJ5Q8S13o57W1WIRN7uKRHAg== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 01 Oct 2026 20:58:17 GMT Content-Type: application/octet-stream Content-Length: 56 Connection: keep-alive Cache-Control: no-store no-cache private Pragma: no-cache CF-Cache-Status: DYNAMIC CF-RAY: 8a2f3c4d5e6f7-050B X-Content-Type-Options: nosniff X-RateLimit-Limit: 5000 X-RateLimit-Remaining: 4962 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-CS-Region: us-1 with response body ==>6466597257704D75524A56745168627A79464D73374944754D776A50775256377A5676434A6F2F634C453877664B486D6752455246413D3D.......36:T413,"stage3_fix.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff97bf90000 "stage3_fix.exe" loaded module "RPCRT4.DLL" at base 7ff9ab2a0000 "stage3_fix.exe" loaded module "SSPICLI.DLL" at base 7ff9a9d40000 "stage3_fix.exe" loaded module "WINHTTP.DLL" at base 7ff9a6420000 "stage3_fix.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ff98b7a0000 "stage3_fix.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff9a96d0000 "stage3_fix.exe" loaded module "KERNEL32.DLL" at base 7ff9ab120000 "stage3_fix.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff9a26f0000 "stage3_fix.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ff9a91c0000 "stage3_fix.exe" loaded module "MSKEYPROTECT.DLL" at base 7ff9a82f0000 "stage3_fix.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ff9a8360000 "stage3_fix.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff9a9ef0000 "stage3_fix.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff9a928000037:T6a2,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "stage3_fix.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "stage3_fix.exe") Found reference to API "[!] LoadLibraryW resolve failed" (Indicator: "LoadLibrary"; File: "stage3_fix.exe") Found reference to API "LoadLibraryW queued to %d thread(s) in pid %lu; beacon checks in once a thread enters alertable wait" (Indicator: "LoadLibrary"; File: "stage3_fix.exe") Found reference to API "[!] injected but LoadLibraryW still running after 8s" (Indicator: "LoadLibrary"; File: "stage3_fix.exe") Found reference to API "[!] injected but LoadLibraryW returned NULL" (Indicator: "LoadLibrary"; File: "stage3_fix.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API "[!] LoadLibraryW resolve failed" (Indicator: "LoadLibrary"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API "LoadLibraryW queued to %d thread(s) in pid %lu; beacon checks in once a thread enters alertable wait" (Indicator: "LoadLibrary"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API "[!] injected but LoadLibraryW still running after 8s" (Indicator: "LoadLibrary"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API "[!] injected but LoadLibraryW returned NULL" (Indicator: "LoadLibrary"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp")38:T43e,Found string "Get-ScheduledTask | ForEach-Object { $t=$_; $t.Actions | Where-Object { $_.CimClass.CimClassName -eq 'MSFT_TaskComHandlerAction' } | ForEach-Object { "$($t.TaskPath)$($t.TaskName) | $($_.ClassId)" } }" (Indicator: "Get-ScheduledTask"; File: "stage3_fix.exe") file/memory contains long string with (Indicator: "Register-ScheduledTask"; File: "stage3_fix.exe") file/memory contains long string with (Indicator: "Unregister-ScheduledTask"; File: "stage3_fix.exe") Found string "Get-ScheduledTask | ForEach-Object { $t=$_; $t.Actions | Where-Object { $_.CimClass.CimClassName -eq 'MSFT_TaskComHandlerAction' } | ForEach-Object { "$($t.TaskPath)$($t.TaskName) | $($_.ClassId)" } }" (Indicator: "Get-ScheduledTask"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") file/memory contains long string with (Indicator: "Register-ScheduledTask"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") file/memory contains long string with (Indicator: "Unregister-ScheduledTask"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp")39:T424,"stage3_fix.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "stage3_fix.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "stage3_fix.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: ""; Value: "") "stage3_fix.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS"; Key: ""; Value: "") "stage3_fix.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: ""; Value: "") "stage3_fix.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\PROVIDERS\MICROSOFT SSL PROTOCOL PROVIDER"; Key: ""; Value: "") "stage3_fix.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\PROVIDERS"; Key: ""; Value: "") "stage3_fix.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")3a:T835,"stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2026"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")3b:T593,"stage3_fix.exe" trying to access non-existent file "C:\WINHTTP.DLL" "stage3_fix.exe" trying to access non-existent file "C:\WINHTTP.dll" "stage3_fix.exe" trying to access non-existent file "C:\WTSAPI32.DLL" "stage3_fix.exe" trying to access non-existent file "C:\WTSAPI32.dll" "stage3_fix.exe" trying to access non-existent file "C:\FLTLIB.DLL" "stage3_fix.exe" trying to access non-existent file "C:\MSVCP140.DLL" "stage3_fix.exe" trying to access non-existent file "C:\MSVCP140.dll" "stage3_fix.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "stage3_fix.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "stage3_fix.exe" trying to access non-existent file "C:\VCRUNTIME140_1.DLL" "stage3_fix.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "stage3_fix.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "stage3_fix.exe" trying to access non-existent file "C:\SSPICLI.DLL" "stage3_fix.exe" trying to access non-existent file "C:\WEBIO.DLL" "stage3_fix.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "stage3_fix.exe" trying to access non-existent file "C:\WINNLSRES.DLL" "stage3_fix.exe" trying to access non-existent file "C:\BCRYPT.DLL" "stage3_fix.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "stage3_fix.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "stage3_fix.exe" trying to access non-existent file "C:\DPAPI.DLL"3c:T45a,Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; File: "stage3_fix.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "stage3_fix.exe") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "stage3_fix.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "stage3_fix.exe") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "stage3_fix.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "stage3_fix.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "stage3_fix.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "stage3_fix.exe") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "stage3_fix.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "stage3_fix.exe") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; File: "stage3_fix.exe")3d:T220c,Found URL "https://http://aa963888f557676300af9cf933b963717.04.18110.0\u%04xtruefalse" - Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found URL "https://fgjdikfhngkdfngf.eastus.cloudapp.azure.com%s/api/v2/crowdstrike/entities/sensor-download/v1/%s/c" - Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found URL "https://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/fgjdikfhngkdfngf.eastus.cloudapp.azure.comhttps://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/fgjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.com@%systemroot%\system32\windowspowershell\v1.0\powershell.exe,-124namerpc-855a36bdc6e6a8fd30tlm" - Source: "00000000-00007312.00000000.146860.D9DF0000.00000004.mdmp") Found URL "https://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/api/v2/crowdstrike/entities/sensor-update-policy/v2brainpoolp320r1ecdhcryptoidinfoeccparametersbrainpoolp320t1ecdsacryptoidinfoeccparametersbrainpoolp256r1ecdsacryptoidinfoeccparametersbrainpoolp320r1ecdsacryptoidinfoeccparametersbrainpoolp160t1ecdhcryptoidinfoeccparametersbrainpoolp192r1ecdsacryptoidinfoeccparametersbrainpoolp192t1ecdsacryptoidinfoeccparametersbrainpoolp224t1ecdsacryptoidinfoeccparametersbrainpoolp224t1ecdhcryptoidinfoeccparametersbrainpoolp192r1ecdhcryptoidinfoeccparametersbrainpoolp256r1ecdhcryptoidinfoeccparametersbrainpoolp256t1ecdhcryptoidinfoeccparametersbrainpoolp160r1ecdhcryptoidinfoeccparametersbrainpoolp320t1ecdhcryptoidinfoeccparametersbrainpoolp384r1ecdsacryptoidinfoeccparametersbrainpoolp384r1ecdhcryptoidinfoeccparametersbrainpoolp384t1ecdsacryptoidinfoeccparametersbrainpoolp224r1ecdhcryptoidinfoeccparametersbrainpoolp224r1ecdsacryptoidinfoeccparametersbrainpoolp160r1ecdsacryptoidinfoeccparametersbrainpoolp192t1ecdhcryptoidinfoeccparametersbrainpoolp256t1ecdsacryptoidinfoeccparametersbrainpoolp160t1ecdsacryptoidinfoeccparametersszoid_root_program_auto_update_ca_revocationfgjdikfhngkdfngf.eastus.cloudapp.azure.com/api/v2/crowdstrike/entities/sensor-update-policy/v2safd" - Source: "00000000-00007312.00000000.146860.D9DF0000.00000004.mdmp") Found URL "https://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/api/v2/crowdstrike/entities/sensor-update-policy/v2eotrust" - Source: "00000000-00007312.00000000.146860.D9DF0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007312.00000000.146860.D9DF0000.00000004.mdmp") Found URL "https://fngf.eastus.cloudapp.azure.com/api/v2/crowdstrike/entities/sensor-update-policy/v2fgjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.comdomain" - Source: "00000000-00007312.00000001.148781.D9DF0000.00000004.mdmp") Found URL "https://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/api/v2/crowdstrike/entities/sensor-update-policy/v2https://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/api/v2/crowdstrike/entities/sensor-update-policy/v2https://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/api/v2/crowdstrike/entities/sensor-update-policy/v2https://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/api/v2/crowdstrike/entities/sensor-update-policy/v2https://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/api/v2/crowdstrike/entities/sensor-update-policy/v2https://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/api/v2/crowdstrike/entities/sensor-update-policy/v2https://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/api/v2/crowdstrike/entities/sensor-update-policy/v2ttps://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/api/v2/crowdstrike/entities/sensor-update-policy/v2gjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.comrpc-855a36bdc6e6a8fd30tlm" - Source: "00000000-00007312.00000001.148781.D9DF0000.00000004.mdmp") Found URL "https://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/api/v2/crowdstrike/entities/sensor-update-policy/v2eotrust" - Source: "00000000-00007312.00000001.148781.D9DF0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007312.00000001.148781.D9DF0000.00000004.mdmp") Found URL "https://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/fgjdikfhngkdfngf.eastus.cloudapp.azure.comikfhngkdfngf.comgjdikfhngkdfngf.eastus.cloudapp.azure.com/fgjdikfhngkdfn" - Source: "00000000-00007312.00000001.148781.DC2C0000.00000004.mdmp") Found URL "https://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/fgjdikfhngkdfngf.eastus.cloudapp.azure.com.com/fgjdikfhngkdfn" - Source: "00000000-00007312.00000001.148781.DC2C0000.00000004.mdmp") Found URL "https://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/fgjdikfhngkdfngf.eastus.cloudapp.azure.comgjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.comjspr:\windows\system32\jsproxy.dll:\windows\system32\jsproxy.dll:\windows\system32\jsproxy.dllinetzzzzinetzzzzinetzzzzinetzzzzinetzzzzinetzzzzinetzzzzinetaaaainetzzzzinetzzzzinetzzzzinetaaaaqqqqqqqqqqqqqqqqc/^m(" - Source: "00000000-00007312.00000001.148781.DC2C0000.00000004.mdmp") Found URL "http://ye1.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0yo8@sbcug3)_rv" - Source: "00000000-00007312.00000001.148781.DC2C0000.00000004.mdmp") Found URL "https://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/api/v2/crowdstrike/entities/sensor-update-policy/v2ttps://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/api/v2/crowdstrike/entities/sensor-update-policy/v2https://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/api/v2/crowdstrike/entities/sensor-update-policy/v25,7316,3xhapubwshyper-v" - Source: "00000000-00007312.00000002.150702.D9DF0000.00000004.mdmp") Found URL "https://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/api/v2/crowdstrike/entities/sensor-update-policy/v2eotrust" - Source: "00000000-00007312.00000002.150702.D9DF0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007312.00000002.150702.D9DF0000.00000004.mdmp") Found URL "https://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/fgjdikfhngkdfngf.eastus.cloudapp.azure.comikfhngkdfngfp.comikfhngkdfngfhttps://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/fgjdikfhngkdfngf.eastus.cloudapp.azure.comgjdikfhngkdfngf.eastus.cloudapp.azure.comgjdikfhngkdfngf.eastus.cloudapp.azure.comhttps://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/fgjdikfhngkdfngf.eastus.cloudapp.azure.comhttps://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/fgjdikfhngkdfngf.eastus.cloudapp.azure.comgjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.comfgjdikfhngkdfngf.eastus.cloudapp.azure.comgjdikfhngkdfngf.eastus.cloudapp.azure.comgjdikfhngkdfngf.eastus.cloudapp.azure.comgjdikfhngkdfngf.eastus.cloudapp.azure.comgjdikfhngkdfngf.eastus.cloudapp.azure.comgjdikfhngkdfngf.eastus.cloudapp.azure.comgjdikfhngkdfngf.eastus.cloudapp.azure.comgjdikfhngkdfngf.eastus.cloudapp.azure.comgjdikfhngkdfngf.eastus.cloudapp.azure.comgjdikfhngkdfngf.eastus.cloudapp.azure.comgjdikfhngkdfngf.eastus.cloudapp.azure.comgjdikfhngkdfngf.eastus.cloudapp.azure.com:\windows\system32\ondemandconnroutehelper.dll:\windows\system32\ondemandconnroutehelper.dll:\windows\system32\ondemandconnroutehelper.dllehelper.dll:\windows\system32\ondemandconnroutehelper.dll:\windows\system32\ondemandconnroutehelper.dll:\windows\system32\jsproxy.dllinetzzzzinetzzzzinetzzzzinetzzzzinetaaaainetaaaainetzzzzinetzzzzinetzzzzinetzzzzaeeexh/qqqqqqqqqqqqqqqqreamaccept-encodinaccept-encodinggzip," - Source: "00000000-00007312.00000002.150702.DC2C0000.00000004.mdmp") Found URL "http://ye1.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0yo8@sbcug3)_rv" - Source: "00000000-00007312.00000002.150702.DC2C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20tls%20ecc%20root%20g2.crljhttp://crl2.microsoft.com/pkiops/crl/microsoft%20tls%20ecc270416135821z051301*fgjdikfhngkdfngf.eastus.cloudapp.azure.com00yykcahbwv$_ntye*fgjdikfhngkdfngf.eastus.cloudapp.azure.com:t" - Source: "00000000-00007312.00000002.150702.DC2C0000.00000004.mdmp")3e:T41a,Found string "dstrike/entities/sensor-update-policy/v2 HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00007312.00000000.146860.D9DF0000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00007312.00000000.146860.D9DF0000.00000004.mdmp, 00000000-00007312.00000001.148781.D9DF0000.00000004.mdmp, 00000000-00007312.00000001.148781.DC2C0000.00000004.mdmp, 00000000-00007312.00000002.150702.D9DF0000.00000004.mdmp, 00000000-00007312.00000002.150702.DC2C0000.00000004.mdmp") Found string "GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00007312.00000001.148781.D9DF0000.00000004.mdmp, 00000000-00007312.00000002.150702.D9DF0000.00000004.mdmp") Found string "HTTP/1.1 200 OKvw" (Indicator: "HTTP/1.1"; Source: "00000000-00007312.00000001.148781.D9DF0000.00000004.mdmp, 00000000-00007312.00000002.150702.D9DF0000.00000004.mdmp") Found string "y/v2 HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00007312.00000002.150702.D9DF0000.00000004.mdmp")3f:T490a,GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=A2SQHOHOKDauwI5n-dFi1gR8gpso3KjEYRYiU24b0XIJTpN9Gzh_cJtraHOFnBjVsw0ZeRY1IgPIqJUU507LfxQQZg-fPnh5KVbG8glehDJh9Te8xALHW8HMJoSGlYLRIqneeFl26hFLM4oAepCBWbs__nhN3j_G-sd3tVmwXF7_gF_Q3e8p9dJ_BLP0qbhfsxm9volqg5vd1JwPlGoN_gwQPYCCWs53RhtNolu0RU8LceSnNEu_9QOwb3GmvWog2hYhCBUVV4gJbEH5COY7s408veXlOlvam7x5LOqFKMqLdfwFAgST-mbemuNB7WeKwA== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=BGSQHOHOKDYXboYSlL6gxa3sBrv1hhXxqZs1PJurQrtVMXKaizqcb58HFz4-fMv03qVxUmJTPwb0AhMjvLs9TsLKtJGGGVQl9j3xmeCsm3PZm2lUIH4pnw2wWZnKFmf4R9iscMU9B_9gLvtivLQgMC3-ki0Ne_8CJU19C06P60j-xTf1jdbp4rEQnzwtgdwONhE3x0L67xcHN2Ob6C_CRVMjvEEzGBfp6_WbVdsscq2OorT-d_L839ZReyh95KDGv6EwAE9rC6woqeNFBrfZja1uiAAvQhyANJtqN4O7StfbnyjAnZ_KrwctokaGYmuF4w== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=BWSQHOHOKDblJ8cbLEbDTxqGfR_icYlaVf1nJ8ZorzvV2ym4-Ecd6mdke2hYftT5EvC5i_IY6SmEnrHSXjfFwlS7Pu52eMBak14BOnzZJM6p9G59RZHS7UQt4DNjSP4gZm-N7pUYAbwdU58z5hqGceU5LUIK-kFq2AVgNpwprYGuGOXDQC41cxQPuOCeCzcJNAeysYlesWyuYEu9eQ0RUv2d02KkR4bQZq24Dhd2ALW_Mdjyv1E04-F_UhB63T2EJ3JQczQhjOF1ZvrYagy7vmAnrw5H88mwr518mzkn9ICEh555kfhIrs2EsB7wro6rDg== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=BmSQHOHOKDZQncYnAannG57vx3tFa8oD372-sZlDDcFILBxYuDKLetIfQPAWHcT0rrHEDhv67ad-OW32Put6nxA4KE1lf2CEf6epzORbYX_iivQhw7i_002LpHX1b0rTKyTFN9KpUcmlL_Wsb-hAkNTwZc-5qoO8IIf7FH07vMS60AQ9IEdxCLEsPvCCYnZfIDYzGpA_T5g8OxqeZn95robmI0ptxhvAoDUv7jcfVoMlFCDLdHC-qEvU_qGomQRdP7ajzjqw7ocMfdzfhkD3ndTY1-YOjhe4RfMREQd62cFwPTTD4mYDHn11Vec6SZCEpg== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=B2SQHOHOKDZ_2REiPBeNcXC1wLrb1j2lvOP-AzW3fA18euLbC5tavtS25g6DBvJcOthzmFgPqoB0A7I6GHV1NA3OqInmZmuWT-SH_sxA3nd3SKMvdquVbWyh2XjcdV0MUxAlk6WLKz-G_1kERZvH2opzlSj02iQMyxpkUddMj7zfhvv8Y6VrPjjDinteONsheXyFXI81GJwoZvDG1XKoqxLeUiwpLX1J231tMppAjdPlJQ-HoMtVoJ9WSkzFs1BzjmEZQMinYIVf7WAfck37P4Czt7L1icNze0-guCV_RqejTzWO2jorB5TSSNy1TDp5IA== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=CGSQHOHOKDa-fW5IzG-41Kjrr6cYkXo0FR3rvdT5k5FdeV6lR7lty38kUD-Fope6gm-RgAyp6gRW428oWnLiwUlmYN7JBLtM5N0-ekx3nmPmXSkgmtUMaq5OkOjggzfPT_QRtsoKIs3iXf6ek8au1nBtcFew1fJ9rpDSXVmPyK2E_yf6nK7wZ0n9xKgCmRv8l59JGQOpAryJXd3GrVN34HD9CboEyFdoHGWivAEuShHR4E6fjao7aUKCK8IpGGr0IEy5f5ZwiFRipcVfl3NePEmiMLCHFE-TLL5F16RBUkn6L3zMMsHIdJkXXVs8xbim1Q== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=CWSQHOHOKDatPPWONe6VAv-kSuemen6TNkmWbcNRuH25szs4GQtevk4DTk86RBB0wukUi0z5f8o6-gIlIAg33v5izMhRj_r-mCrlXZMEucKYoCUyFDTPSew0U8lbwq-9JY3jeucGTc8v4fTyQa3_DQskxYQVAniC_i2NujEgcHehbHfJoj4_e6M6crq8dOwStMclXKnPL2IbMt5RcjH9YZEoe5SzG8h6wwKmTQyDMjQMftpLlnzyFOlr0p4H_Cqmw97tiSonPSlhJq0AMJXHAI0ADZgHTX3ZYiGtrPC292Y3HKXXRIIiMEaZgGa-w2LYWQ== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=CmSQHOHOKDYkwVaJrns7t-fzwbNuuKyHj0b8FAvGnYgijJzYc9DDtgSwYtF8SdonPiGJNE0ofEW_rtECWNZvHThbFLsEC9KByujNWW80i7GlEZNPTKz8sg3NKwAjSNwiC7ZJIypq_7_Ptqa8Q7xGB9cQDmIAQmgCDq4UBxUH3T6Io-LKBr2rViZ47OpcMiyjdMACoDdZez2c75487gdsQQ2LNoaL_Ur5EL6mjP07y5vQjDoVwK8RC2Qns3mFhRoAFBFTcMC8n2I75wtn82Zdn97ai1Yytj4EtfgMlZeksw__jQxgINsx68XubvWvb4Vubw== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=C2SQHOHOKDaAeXbGJjbt1_8EhJ5yiRp7sz6Jgb5p163EgynDNT52AYF6ANs6UYexNtADPeh6_wQhhUJ7v6l1w_sORdOn8-X4HBx-VCSqNVljS4BZYjNi8X4ui9NvZoGtHDKuOqjnxG8bCSW6qcnURDDBkRd_etdSETBKr6_qtFJXMa8HLIvKMn_8cv3eAHM2EZmg27CMU4lBZtnmIheL2G_a2zevDD_FMqdS5YovQ1H-9XskmqM5bNag9iegFNhsl3q3i9c6_0myd_prpX0Y4bDokQq6lWqCdVi6VE_pSuGXMb4APZvzDP4LIgtCJ-zJCw== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=DGSQHOHOKDbrI1a4uD6AY0hM6aSjZo_i2NQ744gjFW0ICqxfIgwVmSrp-a2Lf4Bk1MfRE-iMUVcBerL6BHKoKArf2g5CVrJ08VE4PpRNEEpJjkGa0LWGPi2v5UeMH_WWtrrERQxMvhP5kbnGNhSxHH3ccYK_G78fUd7czkOSqZxaow-46S3HjYcaegQH09nFEflEr6hoVzDEH4h53gJlD_ly-lNZolgZ8WegVEQSHG-pqMTtqyYJqlGEaRQBi0P34_yFwsIDQ1-nuoyYZFoIQUih0J2W5Oyi5gRrVrWz5OLndnoOQuCEo-augbqSyHha9w== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=DWSQHOHOKDaCrxa7gtuvjMiF3Gr96AO00kdlYN0DD1JLOsFUMqSkSV7SYFWs68lsIiWWBhZj6msV8jOvXrSyT-Ol5tCQBQyUkNvSF7Wt88oCY3cEtgO_OSvgLfB2o4oma-O0-dKGZi_ygoTwNkSVzutZ5G400oOYkKUT5dRblu7O17yYMzibBsnHwAMbuXAozZFEmQttssft1QMsLOM93dL9wt6NDR5X_cpR11tkmrAigob5xSfBoUjdACa20hr9us9chH1_24DQdea4K3p47eedP3YW5-klzrwGSJ9Bvl3LI9rocTJjIUNIWBL6Xbvszw== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=DmSQHOHOKDa6Re-l9r2628ziGgPpARct2S4CnRoNmUiYrjip59CwgPXK9XNkGCVEV4XJb541vspCMv_7lgtvzLpgFitO05K33IvpBETm31OKg6AgOz0kNKwkRY_FsXiFaZ9mPmAEG7BHpQ8OQqlIwCiLt50YM5jOSGlPmox0qqHOBNBgsiLUg9UuCexiSpB-P2O-IRKbKbJAuEPJCrIQc-QT5Ij1EvUVFhQ7J6roPBAUNMcwuTMHyvdzD7lXTet4b9KRy6h3U0AIkLuPdW0QVtZnlE9710nPzD_PcCAGjqL851jlEmhJpUNXVhVQZcaJjw== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=D2SQHOHOKDaJiZ7Q90tVvv2isfPNAf8wV_4NGIQB9dsnJ39_Qy3tBqWLaam-J44Ma7rcCzdyn4IqjObXtYn1RHTsHFteMmIQFaKfi0ksCIwAmCySUQQzMX0hbOYBrOdWH_Wk8nUoDVd1LKo71eVZyhfN06GoI6y93ok5HaSKa8FoQDcHAZ6uXecs_-3Rwi5X0nZpULCSV4wle8KrRV_aPADw9zwWpRcC8NoeqgrHYsTsBWUbyZ1uTvjxhZZcrq_fRFWIh3VM2z-IHD3CoY_Z7pXnnUojI5RYa8uVyAAGsLPV4DVWf6ZzyD0MPoIaaV2kxw== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=EGSQHOHOKDZnaZNsvSCI6lqhsuO--2YTuvx_eI06s_as4Tm48VHZWcVfFi2P8BOOYZ167gj6oHQPhbDIB8sy2nC5uFHw1mkUV2HpJvl9FM5YJ1aqY8thFqVTodqJ7TRt1SMbWK3B9sXGX8Qd7Dmo8xPo0F4uWQJCUQS8SxEgdwdFdudC7KvCCMXQubaRvA_ID9ujmyl-Y1KQkbR6vVsPNgWL8mDM4Q4hwVswR4p8U5c52ecDUycgiIbovyPDkSJ4wRU0tZRJcysQYPKZjllCC3GdaoQatnC1TqgY1aaWHbeC3omoyunQ91w-pDfoAa9Obw== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=EWSQHOHOKDZ3YICw-xbJoheD8fftX0vTbL7eh_K2dK9i_EW9V3UmopJxqlNAkParI4zlggUuTbUDbO0a8mL5sVe2aO6tOoM0UNJioZ0G_rgTTsrSwpeijuaZaKzmBDuXrYI5e724_fDxFEZ_qoZuanXUwpF_6pgraGuljLP4T350Ptw9yJjHEq9M4gzO644RocjblfI7oEegRW0Q8cwkTEW3eiVNm7506AQN3rp3JQIAJlLRQbgkoy3pGXIo4G1rA4sYIz0IKwm8_l4iV1In-6PZe22xbP87xpUgjCHchfC8uyavL-hEZPBINpnpky3WLQ== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=EmSQHOHOKDaU8sCa0IpymzhQdQZn6MJ4Pe6-pDt3XadYxgC7gUj76oKBlzzGIol9TjdnDFhpmrrRlKwbuB6VWGsZssz99PlHB61HNmMhXk6yRSHfkefl--rW-7Tl2IFgHR80dH5ZQWhrqLuDiSto1K5SVxzE771WqsS6zYHyu1J6ob8dvDTmMLwxPSmRqrv5LM__2WlM03vKDLOT8ZlKfQV6K2vB6dpBewviOI0qkD0f61hQhkAkIbZCIqIcH62H4oISn4zjMWjZf435raSS4bmhiMgIjoQ0vCjtzle4_mB-5ISGbDiKpN_FKeld4ZEt6w== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=E2SQHOHOKDai0q349Q9HcZJSzJAT36NWo5kh2MaQwJFA1Y_em0O4TH0OaFPU-eajBndV7G7yO8FMqssm3kxFwwjQji_aG_FOYCFzjk5GPsQhY9CcoJ1pTC-QNXc8bc9Dhmu4-iVTGbqXb815YcZuSnmfUsX3wnLmGi04xUebxC0MkRbyNOFdG2Xm-w0nbOqe1aaZBT-qKVd-v5WKIkLJeb8_PbjC2ASheUOWaBe-PWv9l03OGJqRrMPj68d_rb0761Fi_DSvPQqnGM2qXZla-NNC1kUAO6nn1tWhkpcSduMkYcWYsQ-vZsc5Dsxd_ewiFg== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=FGSQHOHOKDaQxRXOJtHlrtJQJL9JRcCqELJCZEvuYWXxUFPQRDZm1g6JfYWLFzKuFKypQN0Kmk4UEdBXfoogmeU-9uQqtVIwERVEeIgHjRz-p8RI8Mwr9b4Yn9uh2GdErnE8Ph-1Y5J05Y31OAQ0bD5q4QFasg4bBL4WJT6TWYf4zLWQ-EE2NPXbujb5TyZsJ4g1zaZnZTXmE87wSxrNw5IovWfy9wXZu2Nu9DeacFncRmEOz0rjghkz0grZGeJSN53bczKSlQb3-jQMbLTWACFyw3kdqvinR48R0SspRHO_wFnTMJ5q-cJtrC4ABJkGrg== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=FWSQHOHOKDbbFnmtO1-67COtm8roZRgqzQrxYOFxWK8DVWZVYIo4VVlFlJN67zceayU5gj87VKALkZQhYS26uo0qNOum8qgt2rFSemqdvs83_qadYp-gthmYiqv39U1sV3QSua4y0M3TOE-WNOpeWX59d3mrjq9mCb3egAXidQ_VmZbqVqRLZaxomi29goraqQqm_dfgn0jS1JqSlHv2wx0HqP9R1Raje-zV9E0WwM7ZNYj77OCBhZp1e6x8l8tGYol8fc-PtXRDrlr9Pblh5okdAo0K_z0GwBAn4P5tzLq47tHQtH3HcVX2WV_S6pliNA== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=FmSQHOHOKDaOOmAOjoA9gu7tWHyKkHw9x3bn0f96vX9eQFQXZb678PWPDmGceiIHfRy6g0-vhdiQr_IYkEKbOM2Aj1IVxvm2rjo52T28PwMfxivfuNrXJrY9dtQebwSfJ04kjYy97ogirnhLhuuC7hT8pJx8fl_f_pi3vL5MtlDi1e3wsQkg8FV2HL-IlXCYuo8SeBLzLSg7l6ELJAecqzcZAYuWHt-Q1Cherl6IKtOecCaPG8Jy1ByzLaeZZgEjJ8tt9cikElzHginabRR0xPnvXsID1ia84YYO48DCIvpveH_SlANj61sE1XtvfCbUMg== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=F2SQHOHOKDY98dPK1gBjsKBgXWRkxxr7AyEfqDT7Hz0uJkN6n8IZrxUs9dx-UU_4wSfDMgf7TDbaLeppwabkeS88t5ykSibJc04y5xfJZZ6Sc-aOiD3wkwhJ0JJig2AUhgpMVA_peOEq1TXD-2LCvZELRhSbjp89bTOjTRZEAkq1D4Gx_Jbgq1GfzqpX-ucid1otPZ_CS_BqjhE7P9PuCOHKWdke5mI5cbmrRAPWkF8cvDQ512wh3501ld3Mz8LtJpdADcMwm0J626641WPWzoybg2juyp7XmTsUXI1bhxhdZntK4LtrDoqNaQSmy7kDMQ== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=GGSQHOHOKDaA3M8u-wz4NE83fxMzBUWUUZlo8BI0aHnsrhdL6s9dd2v2KiPFSCBY4vO6ScpTg9H5ZyitvsK65okr9eCy2qO-SMX1pA1qA9oktD4XQT8ypZ67psX-uNU3WW0djeyBfYi6pLa4HQqanTeFtMN2WJVXtgY3Njf9oLHV1beHSk4ccxu0j8LGSWFNUBBCZufta15KYpD2uPPcoiiIGnSPhiOmeaJ04Tilj0YdZAK-2nvhui-RNgeM3ZA72WgmlEH14TefMKc4OPNYWEmiLyIDrCE3VQvytLtxzpcY6TPGLVcqaX5wsNQSX0mikw== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=GWSQHOHOKDZ7aqNa2ocvVEsnj1Xt5VU4cT-ed9Mx8jpsvPC7rCiJhYf-r6vBoYPFg1_GRtphC8fvWbYN1hLzPByhrFRb58Zzf7JT2iuRBpI8BVlXD96K6op1KqC0RPWw8f75msy0n0ogbHbypZ5A8ZDyT09K9e676LpaYqX-p8TvvbKZUZ7StK5JIkg2p4DHpBictBkkRS1dJzx3mHZjKbCRSg754-OqZoRRPn3E7oa13vSv1YTOgREQL2cGqLOxzztutSWI-Ec3VF7AGOEHgSGV3dv4BxpldmiVr-1PIuVlOvq13qK-aYP-ROO63xoatQ== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=GmSQHOHOKDZKVTYc6mxrzWIif6iWdhyCYHfqdUhN4ibSd0HUdhAK8UtB4MyO7mLAxKeOfy6VGPdpJDqoF6tbAqxNuYxd7fXZM8V2W1kCx8zVPeSVF4FwOaGJIbq6zM4G_rS2_mOBdqqJ33EoLAyQjFBTaMH0P4t8QPlo-1zNHYd7IYxVjIslFrIouk9H2D0KlGC7K30_oSyFbshMLeSuzZf1A0d7AKeVyC8djRM-fnkF5suSvERbk7nsJ1UeqbYkNW9ML9ZUoaj7BXV02E01DXW2Vlv1Wi-oIgDobTBS3zvSit5M-pVdeU-9XrYebi7qUQ== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1 Connection: Keep-Alive Accept: application/octet-stream application/json;q=0.9 Accept-Encoding: gzip deflate br Accept-Language: en-US Cookie: falcon_session=G2SQHOHOKDahm0ToxhW3qwN73yM0GHviA5qlAMI_7p77WIKilR_oMPXUP15rj99xR42wBcpfwgMphq-VIh72QMRSN__QVtJ2oMC2cuCdhKr7CEKh42iP8iiuydvYm4gatQHvMEkG61OCMREA_0BVPonK_u-0rTUJuzfDiWC4pfX9a0Uss907u5qRcJZ8cczm2dMAWs8FdWSJ_hXBlXGUFjN9l8ldXLqLIqmlYSKG29DS2D_jQt_jm1zvYnqfF5F4cua9NNiFYtOQEzc3JFeiBm78Su5xZQ4Gx6WIzt7DmcsJ5Q8S13o57W1WIRN7uKRHAg== User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) X-CS-AGENTID: aa963888f557676300af9cf933b96371 X-CS-VERSION: 7.04.18110.0 Host: fgjdikfhngkdfngf.eastus.cloudapp.azure.com 40:T656,file/memory contains long string with (Indicator: "ForEach-Object"; File: "stage3_fix.exe") Found string "Get-ScheduledTask | ForEach-Object { $t=$_; $t.Actions | Where-Object { $_.CimClass.CimClassName -eq 'MSFT_TaskComHandlerAction' } | ForEach-Object { "$($t.TaskPath)$($t.TaskName) | $($_.ClassId)" } }" (Indicator: "ForEach-Object"; File: "stage3_fix.exe") Found string "Get-ScheduledTask | ForEach-Object { $t=$_; $t.Actions | Where-Object { $_.CimClass.CimClassName -eq 'MSFT_TaskComHandlerAction' } | ForEach-Object { "$($t.TaskPath)$($t.TaskName) | $($_.ClassId)" } }" (Indicator: "Where-Object"; File: "stage3_fix.exe") file/memory contains long string with (Indicator: "Where-Object"; File: "stage3_fix.exe") file/memory contains long string with (Indicator: "ForEach-Object"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found string "Get-ScheduledTask | ForEach-Object { $t=$_; $t.Actions | Where-Object { $_.CimClass.CimClassName -eq 'MSFT_TaskComHandlerAction' } | ForEach-Object { "$($t.TaskPath)$($t.TaskName) | $($_.ClassId)" } }" (Indicator: "ForEach-Object"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") Found string "Get-ScheduledTask | ForEach-Object { $t=$_; $t.Actions | Where-Object { $_.CimClass.CimClassName -eq 'MSFT_TaskComHandlerAction' } | ForEach-Object { "$($t.TaskPath)$($t.TaskName) | $($_.ClassId)" } }" (Indicator: "Where-Object"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp") file/memory contains long string with (Indicator: "Where-Object"; Source: "00000000-00007312.00000000.146860.46FB4000.00000002.mdmp")41:T78c,Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "stage3_fix.exe") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; File: "stage3_fix.exe") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "stage3_fix.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "stage3_fix.exe") Found reference to API "Thread32First" (Indicator: "Thread32First"; File: "stage3_fix.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "stage3_fix.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "stage3_fix.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "stage3_fix.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp")42:T62f,Found string -CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) Found string -%s/api/v2/crowdstrike/entities/sensor-download/v1/%s Found string -api/v2/crowdstrike/entities/sensor-download/v1/script/%s Found string -api/v2/crowdstrike/entities/sensor-installers/v1/%s Found string -api/v2/crowdstrike/entities/sensor-download/v1/%s Found string -api/v2/crowdstrike/entities/sensor-download/v1/upload/%s Found string -api/v2/crowdstrike/entities/sensor-download/v1/meta/%s Found string -%s/api/v2/crowdstrike/entities/sensor-update-policy/v2 Found string -%s/api/v2/crowdstrike/entities/detections/v2 Found string -https://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/api/v2/crowdstrike/entities/sensor-update-policy/v2 Found string -fgjdikfhngkdfngf.eastus.cloudapp.azure.com/api/v2/crowdstrike/entities/sensor-update-policy/v2 Found string -ttps://fgjdikfhngkdfngf.eastus.cloudapp.azure.com:443/api/v2/crowdstrike/entities/sensor-update-policy/v2 Found string -api/v2/crowdstrike/entities/sensor-update-policy/v2 Found string -2/crowdstrike/en Found string -User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64) Found string -/api/v2/crowdstrike/entities/sensor-update-policy/v2 Found string -W/api/v2/crowdstrike/entities/sensor-update-policy/v2 Found string -fngf.eastus.cloudapp.azure.com/api/v2/crowdstrike/entities/sensor-update-policy/v2 Found string -ttps://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/api/v2/crowdstrike/entities/sensor-update-policy/v2 Found string -GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.143:T5c8,Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "stage3_fix.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "stage3_fix.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "stage3_fix.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "stage3_fix.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "stage3_fix.exe") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "stage3_fix.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00007312.00000002.150702.46FBD000.00000004.mdmp")44:T414,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: stage3_fix.exe] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: stage3_fix.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: stage3_fix.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: stage3_fix.exe] Observed import api "ImpersonateLoggedOnUser" which can "let the calling thread impersonate the security context of a logged-on user" [Source: stage3_fix.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: stage3_fix.exe] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: stage3_fix.exe]45:Taae,"stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "stage3_fix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "")46:T52a,Found string "IsWow64Process" (Source: stage3_fix.exe, API is part of module: KERNELBASE.DLL) Found string "NtCreateSection" (Source: stage3_fix.exe, API is part of module: NTDLL.DLL) Found string "NtMapViewOfSection" (Source: stage3_fix.exe, API is part of module: NTDLL.DLL) Found string "NtUnmapViewOfSection" (Source: stage3_fix.exe, API is part of module: NTDLL.DLL) Found string "NtQueueApcThread" (Source: stage3_fix.exe, API is part of module: NTDLL.DLL) Found string "LoadLibraryW" (Source: stage3_fix.exe, API is part of module: KERNELBASE.DLL) Found string "system" (Source: stage3_fix.exe, API is part of module: UCRTBASE.DLL) Found string "vsnprintf" (Source: stage3_fix.exe, API is part of module: MSVCRT.DLL) Found string "vsprintf" (Source: stage3_fix.exe, API is part of module: MSVCRT.DLL) Found string "sprintf" (Source: stage3_fix.exe, API is part of module: MSVCRT.DLL) Found string "vfprintf" (Source: stage3_fix.exe, API is part of module: MSVCRT.DLL) Found string "fprintf" (Source: stage3_fix.exe, API is part of module: MSVCRT.DLL) Found string "sscanf" (Source: stage3_fix.exe, API is part of module: MSVCRT.DLL) Found string "vswprintf" (Source: stage3_fix.exe, API is part of module: MSVCRT.DLL) Found string "swprintf" (Source: stage3_fix.exe, API is part of module: MSVCRT.DLL)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"a570a5723bcd758ae8e4d9cab95901432c9ba0c4b321303a99389096d218bbf5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790888529150,"unified_at":"2026-10-01T21:02:09.150Z","metadata":{"hashes":{"sha256":"a570a5723bcd758ae8e4d9cab95901432c9ba0c4b321303a99389096d218bbf5","sha1":"e3d23735646f7052127e486ca53e65aa6459c380","md5":"3b758e2bebe74b178ea78ecec383ecfe","sha512":"ec8dc5acef56dd95d2f1bfa00d8213a670b49856ae190c987988dd14161649cd1d320da8ea754c032177b3c88294a201100f9d3ea30fb5afa749741347822adc","ssdeep":"1536:x3Sl3S9DHKOT9mSIp5bRbduWeyeJ4iGYqsFjzK9rXLV4EB2:ts3SdqKNInXQT/KxJ4EY","ssdeep_chunks":["1536:x3Sl3S9","1536:3Sl3S9D","1536:Sl3S9DH","1536:l3S9DHK","1536:3S9DHKO","1536:S9DHKOT","1536:9DHKOT9","1536:DHKOT9m","1536:HKOT9mS","1536:KOT9mSI","1536:OT9mSIp","1536:T9mSIp5","1536:9mSIp5b","1536:mSIp5bR","1536:SIp5bRb","1536:Ip5bRbd","1536:p5bRbdu","1536:5bRbduW","1536:bRbduWe","1536:RbduWey","1536:bduWeye","1536:duWeyeJ","1536:uWeyeJ4","1536:WeyeJ4i","1536:eyeJ4iG","1536:yeJ4iGY","1536:eJ4iGYq","1536:J4iGYqs","1536:4iGYqsF","1536:iGYqsFj","1536:GYqsFjz","1536:YqsFjzK","1536:qsFjzK9","1536:sFjzK9r","1536:FjzK9rX","1536:jzK9rXL","1536:zK9rXLV","1536:K9rXLV4","1536:9rXLV4E","1536:rXLV4EB","1536:XLV4EB2","3072:x3Sl3S9","3072:3Sl3S9D","3072:Sl3S9DH","3072:l3S9DHK","3072:3S9DHKO","3072:S9DHKOT","3072:9DHKOT9","3072:DHKOT9m","3072:HKOT9mS","3072:KOT9mSI","3072:OT9mSIp","3072:T9mSIp5","3072:9mSIp5b","3072:mSIp5bR","3072:SIp5bRb","3072:Ip5bRbd","3072:p5bRbdu","3072:5bRbduW","3072:bRbduWe","3072:RbduWey","3072:bduWeye","3072:duWeyeJ","3072:uWeyeJ4","3072:WeyeJ4i","3072:eyeJ4iG","3072:yeJ4iGY","3072:eJ4iGYq","3072:J4iGYqs","3072:4iGYqsF","3072:iGYqsFj","3072:GYqsFjz","3072:YqsFjzK","3072:qsFjzK9","3072:sFjzK9r","3072:FjzK9rX","3072:jzK9rXL","3072:zK9rXLV","3072:K9rXLV4","3072:9rXLV4E","3072:rXLV4EB","3072:XLV4EB2","1536:ts3SdqK","1536:s3SdqKN","1536:3SdqKNI","1536:SdqKNIn","1536:dqKNInX","1536:qKNInXQ","1536:KNInXQT","1536:NInXQT/","1536:InXQT/K","1536:nXQT/Kx","1536:XQT/KxJ","1536:QT/KxJ4","1536:T/KxJ4E","1536:/KxJ4EY"],"imphash":"d7f7077e6ad6207aad9ccbdf73403b07"},"file_info":{"file_name":"stage3_fix.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":105984,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1790888261000,"last_seen":1790888261000,"last_multi_scan":1790888261000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":65},"sandbox_signatures":{"informative_count":162,"suspicious_count":10,"malicious_count":3,"total":175},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.MeterBof","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"HackTool[VirTool]/Win64.MeterBof","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.CoffLoader.Marte.A.9A5E5BB7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.CoffLoader.Marte.A.9A5E5BB7 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/Agent.CAQ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Backdoor/CobaltStrike.ox","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader ( 006e6f8b1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"YARA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"ACL/Trojan Generic.VNRQ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABRisk.PDGW-7314","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"CoffLoader.Marte.A.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"suspicious","value":"Contains ability to modify processes thread functionality"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to dynamically load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"informative","value":"Able to create or schedule tasks using domain/system privileges"},{"type":"informative","value":"Contains ability to perform scheduled task-related activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Able to obtain instances of WMI classes using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"YARA signature match - PowerShell file content"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to create/modify item values (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Contains reference to shellcode"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to create a remote thread (API string)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Able to delete items (Powershell command string)"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Able to unregister scheduled task using PowerShell command"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Able to delete scheduled task(s)"},{"type":"informative","value":"Contains ability to delete a property and its value from an item (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Defense Evasion","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to retrieve/open a process"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"},{"type":"informative","value":"Contains ability to retrieve remote session information"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Observed security product related strings in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Contains ability to move items (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"},{"type":"informative","value":"Contains ability to perform remote desktop activity"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"suspicious","value":"Contains ability to create directories"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Found User Agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"PCAP contains base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to stop a service (Powershell command string)"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to delete items (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Remove-Item\"; File: \"stage3_fix.exe\")\n file/memory contains long string with (Indicator: \"Remove-Item\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-333","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"stage3_fix.exe\")\n Found reference to API \"[!] VirtualAllocEx failed\" (Indicator: \"VirtualAllocEx\"; File: \"stage3_fix.exe\")\n Found reference to API \"[!] VirtualAllocEx failed\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister scheduled task using PowerShell command","description":"file/memory contains long string with (Indicator: \"unregister-scheduledtask\"; File: \"stage3_fix.exe\")\n file/memory contains long string with (Indicator: \"unregister-scheduledtask\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-982","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"stage3_fix.exe\")\n Found reference to API \"[!] CreateRemoteThread failed (WinErr %lu)\" (Indicator: \"CreateRemoteThread\"; File: \"stage3_fix.exe\")\n Found reference to API \"[+] injected via CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"stage3_fix.exe\")\n Found reference to API \"[!] CreateRemoteThread failed (WinErr %lu)\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")\n Found reference to API \"[+] injected via CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"stage3_fix.exe\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"stage3_fix.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"stage3_fix.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"stage3_fix.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$28","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"stage3_fix.exe\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"Br2rViZ47OpcMiyjdMACoDdZez2c75487gdsQQ2LNoaL_Ur5EL6mjP07y5vQjDoVwK8RC2Qns3mFhRoAFBFTcMC8n2I75wtn82Zdn97ai1Yytj4EtfgMlZeksw__jQxgINsx68XubvWvb4Vubw==\" (Indicator: \"RC2\"; Source: \"00000000-00007312.00000000.146860.D9DB0000.00000004.mdmp\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007312.00000000.146860.D9DF0000.00000004.mdmp, 00000000-00007312.00000001.148781.D9DF0000.00000004.mdmp, 00000000-00007312.00000002.150702.D9DF0000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"RC2\"; Source: \"00000000-00007312.00000000.146860.D9DF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"PCAP contains base64 strings","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-504","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"stage3_fix.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00007312.00000000.146860.D9DF0000.00000004.mdmp, 00000000-00007312.00000001.148781.D9DF0000.00000004.mdmp, 00000000-00007312.00000002.150702.D9DF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00007312.00000000.146860.D9DF0000.00000004.mdmp, 00000000-00007312.00000001.148781.D9DF0000.00000004.mdmp, 00000000-00007312.00000002.150702.D9DF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: PCAP contains base64 strings\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: PCAP contains base64 strings\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetUserNameW\" (Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")\n Found string \"7689,7316,3193,,GetUserNameW,advapi32.dll,\"00:39:14.500\",RX=0,PX=0\" (Source: \"00000000-00007312.00000002.150702.D9DF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"stage3_fix.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to obtain instances of WMI classes using PowerShell","description":"file/memory contains long string(File: \"stage3_fix.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-696","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"stage3_fix.exe\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"stage3_fix.exe\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"stage3_fix.exe\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsW\" in file \"stage3_fix.exe\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"stage3_fix.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007312)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"stage3_fix.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007312)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"stage3_fix.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007312)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"stage3_fix.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007312)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: stage3_fix.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.dll at 31269-1-0000000140006430\n GetTickCount@KERNEL32.dll at 31269-133-0000000140011140\n GetTickCount@KERNEL32.dll at 31269-134-00000001400109D0\n GetTickCount@KERNEL32.dll at 31269-241-0000000140008306\n GetTickCount@KERNEL32.dll at 31269-242-0000000140010C10\n GetTickCount@KERNEL32.dll at 31269-243-0000000140010D60","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"stage3_fix.exe\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"stage3_fix.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcess@KERNEL32.dll at 31269-138-000000014000C9F0\n OpenProcessToken@ADVAPI32.dll at 31269-150-0000000140006B40","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"stage3_fix.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"stage3_fix.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in file \"stage3_fix.exe\"\n Found registry modification API: \"[!] RegCreateKeyEx (services) failed: WinErr %ld (0x%08lX)\" in file \"stage3_fix.exe\"\n Found registry modification API: \"[!] Active Setup RegCreateKeyEx failed: WinErr %ld (0x%08lX)\" in file \"stage3_fix.exe\"\n Found registry modification API: \"[!] IFEO RegCreateKeyEx failed: WinErr %ld (0x%08lX)\" in file \"stage3_fix.exe\"\n Found registry modification API: \"[!] RegCreateKeyEx (services) failed: WinErr %ld (0x%08lX)\" in \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\"\n Found registry modification API: \"[!] Active Setup RegCreateKeyEx failed: WinErr %ld (0x%08lX)\" in \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\"\n Found registry modification API: \"[!] IFEO RegCreateKeyEx failed: WinErr %ld (0x%08lX)\" in \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"stage3_fix.exe\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"stage3_fix.exe\")\n Found reference to API \"[!] OpenProcess %lu failed (WinErr %lu)\" (Indicator: \"OpenProcess\"; File: \"stage3_fix.exe\")\n Found reference to API \"[!] OpenProcess %lu failed (WinErr %lu)\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"\"stage3_fix.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00007312)\n \"stage3_fix.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00007312)\n \"stage3_fix.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00007312)\n \"stage3_fix.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00007312)\n \"stage3_fix.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromFile (UID: 00000000-00007312)\n \"stage3_fix.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007312)\n \"stage3_fix.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00007312)","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"fgjdikfhngkdfngf.eastus.cloudapp.azure.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"20.102.89.241:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"stage3_fix.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"stage3_fix.exe\")\n Found reference to API \"[!] CreateProcess failed\" (Indicator: \"CreateProcess\"; File: \"stage3_fix.exe\")\n Found reference to API \"[!] CreateProcessW failed (WinErr %lu)\" (Indicator: \"CreateProcess\"; File: \"stage3_fix.exe\")\n Found reference to API \"[!] CreateProcess failed\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")\n Found reference to API \"[!] CreateProcessW failed (WinErr %lu)\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"stage3_fix.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"stage3_fix.exe\")\n Found reference to API \"[!] CreateFileW '%s' failed: WinErr %lu (0x%08lX)\" (Indicator: \"CreateFile\"; File: \"stage3_fix.exe\")\n Found reference to API \"[!] CreateFileW '%s' failed: WinErr %lu (0x%08lX)\" (Indicator: \"CreateFile\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObject@KERNEL32.dll at 31269-138-000000014000C9F0\n WaitForSingleObject@KERNEL32.dll at 31269-387-0000000140010674","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"stage3_fix.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: stage3_fix.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.dll at 31269-251-000000014000A320","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$30","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"pcmd.exe /c \"%s\"\" (Indicator: \"cmd.exe /c\"; File: \"stage3_fix.exe\")\n Found string \"cmd.exe /c \"%s\"\" (Indicator: \"cmd.exe /c\"; File: \"stage3_fix.exe\")\n Found string \"cmd.exe /c \"%s\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"stage3_fix.exe\")\n Found reference to API \"[!] MoveFileEx failed (WinErr %lu)\" (Indicator: \"MoveFile\"; File: \"stage3_fix.exe\")\n Found reference to API \"[!] MoveFileEx failed (WinErr %lu)\" (Indicator: \"MoveFile\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"stage3_fix.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$32","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExW in import section (Source: stage3_fix.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$33","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"stage3_fix.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"User-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64)\" (Indicator: \"user-agent: \"; Source: \"00000000-00007312.00000000.146860.D9DF0000.00000004.mdmp, 00000000-00007312.00000001.148781.D9DF0000.00000004.mdmp, 00000000-00007312.00000002.150702.D9DF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$34","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$35","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"stage3_fix.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at A9EF0000\n \"stage3_fix.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at A99A0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"stage3_fix.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at AB2A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"stage3_fix.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"stage3_fix.exe\" has an writable section named \".data\"\n \"stage3_fix.exe\" has an writable section named \".bss\"\n \"stage3_fix.exe\" has an writable section named \".idata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"stage3_fix.exe\" file has an entrypoint instructions - \"xor\teax, eax,mov\tdword ptr [rip + 0xcd98], eax,jmp\t0x140006d30,nop\t,nop\t,nop\t,push\trdi,push\trbx,sub\trsp, 0x238,xor\teax, eax,or\tr9d, 0xffffffff,mov\trbx, rcx,lea\trdi, [rsp + 0x30],mov\tecx, 0x80,mov\tr8, rdx,rep stosd\tdword ptr [rdi], eax,lea\trdi, [rsp + 0x30],xor\tedx, edx,mov\tecx, 0xfde9,mov\tdword ptr [rsp + 0x28], 0x100,mov\tqword ptr [rsp + 0x20], rdi,call\tqword ptr [rip + 0x17200],mov\tr9, rdi,mov\tedx, 0x200,mov\trcx, rbx,lea\tr8, [rip + 0xe5d2],\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"stage3_fix.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"C:\\Windows\\System32\\notepad.exe\" [Source: stage3_fix.exe]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"fgjdikfhngkdfngf.eastus.cloudapp.azure.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"stage3_fix.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"stage3_fix.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=YE1, O=Let's Encrypt, C=US\" (SHA1: BD:7E:A1:A8:8A:E4:3B:69:A5:4C:1F:CB:B2:39:01:B5:78:26:4C:DB; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Root YE, O=ISRG, C=US\" (SHA1: D0:93:70:A9:86:49:82:A5:04:7D:A4:63:73:54:02:56:D0:8A:3C:81; see report for more information)\n The input sample is signed with a certificate issued by \"CN=ISRG Root X2, O=Internet Security Research Group, C=US\" (SHA1: F3:76:20:FC:4B:1C:DD:D2:A3:D7:4B:1D:5E:8D:B4:2E:24:4C:A0:06; see report for more information)\n The input sample is signed with a certificate issued by \"CN=ISRG Root X1, O=Internet Security Research Group, C=US\" (SHA1: 3C:34:E3:56:C7:FC:17:F5:AC:F0:48:24:BC:58:7C:6C:62:39:51:A2; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to create or schedule tasks using domain/system privileges","description":"Found string \"schtasks.exe /create /tn \"_b\" /tr \"\\\"%s\\\"\" /sc once /st 00:00 /ru \"%s\" /it /f\" (File: \"stage3_fix.exe\")\n Found string \"schtasks.exe /create /tn \"_b\" /tr \"\\\"%s\\\"\" /sc once /st 00:00 /ru \"%s\" /it /f\" (Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1053.005","relevance":1,"id":"string-675","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.dll at 31269-1-0000000140006430","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to perform scheduled task-related activity (Powershell command string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1053.005","relevance":1,"id":"string-335","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"NtQueueApcThread\" (Indicator: \"QueueApcThread\"; File: \"stage3_fix.exe\")\n Found reference to API \"NtQueueApcThread\" (Indicator: \"QueueApcThread\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$39","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"stage3_fix.exe\" queries basic process information of the \"C:\\stage3_fix.exe\" (UID: 7312)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"stage3_fix.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"stage3_fix.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\apphelp.dll\"\n \"stage3_fix.exe\" trying to touch file \"C:\\stage3_fix.exe\"\n \"stage3_fix.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"stage3_fix.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"stage3_fix.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"stage3_fix.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"stage3_fix.exe\" trying to touch file \"C:\\WINHTTP.DLL\"\n \"stage3_fix.exe\" trying to touch file \"C:\\WINHTTP.dll\"\n \"stage3_fix.exe\" trying to touch file \"C:\\Windows\\System32\\winhttp.dll\"\n \"stage3_fix.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\WINHTTP.dll\"\n \"stage3_fix.exe\" trying to touch file \"C:\\WTSAPI32.DLL\"\n \"stage3_fix.exe\" trying to touch file \"C:\\WTSAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"stage3_fix.exe\" trying to access non-existent file \"\\Device\\RasAcd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"stage3_fix.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"199d9e1d080\"\n \"lpszHeaders\": \"Accept: application/octet-stream, application/json;q=0.9Accept-Encoding: gzip, deflate, brAccept-Language: en-USConnection:\"\n \"dwHeadersLength\": \"567\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}\n \"stage3_fix.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"199d9e1f7e0\"\n \"lpszHeaders\": \"Accept: application/octet-stream, application/json;q=0.9Accept-Encoding: gzip, deflate, brAccept-Language: en-USConnection:\"\n \"dwHeadersLength\": \"567\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}\n \"stage3_fix.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"199dc2c4d20\"\n \"lpszHeaders\": \"Accept: application/octet-stream, application/json;q=0.9Accept-Encoding: gzip, deflate, brAccept-Language: en-USConnection:\"\n \"dwHeadersLength\": \"567\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"stage3_fix.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"199d9e1d080\"\n \"lpReserved\": \"0\"}\n \"stage3_fix.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"199d9e1f7e0\"\n \"lpReserved\": \"0\"}\n \"stage3_fix.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"199dc2c4d20\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /api/v2/crowdstrike/entities/sensor-update-policy/v2\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; File: \"stage3_fix.exe\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; File: \"stage3_fix.exe\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"stage3_fix.exe\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpen\"; File: \"stage3_fix.exe\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpenRequest\"; File: \"stage3_fix.exe\")\n Found reference to API \"WinHttpReadData\" (Indicator: \"WinHttpReadData\"; File: \"stage3_fix.exe\")\n Found reference to API \"WinHttpSendRequest\" (Indicator: \"HttpSendRequest\"; File: \"stage3_fix.exe\")\n Found reference to API \"WinHttpSendRequest\" (Indicator: \"WinHttpSendRequest\"; File: \"stage3_fix.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"stage3_fix.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"stage3_fix.exe\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"stage3_fix.exe\")\n Found reference to API \"[!] CreatePipe failed\" (Indicator: \"CreatePipe\"; File: \"stage3_fix.exe\")\n Found reference to API \"[!] CreatePipe failed\" (Indicator: \"CreatePipe\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to move items (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Move-ItemProperty\"; File: \"stage3_fix.exe\")\n file/memory contains long string with (Indicator: \"Move-ItemProperty\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-378","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"[!] WMI connect failed\" (Indicator: \" connect \"; File: \"stage3_fix.exe\")\n Found reference to API \"[!] WMI connect failed\" (Indicator: \" connect \"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.17\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.31\"\n \"2.5.29.32\"\n \"2.5.29.14\"\n \"2.5.29.19\"\n \"2.5.29.15\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.10\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3d","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$3f","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"fgjdikfhngkdfngf.eastus.cloudapp.azure.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://fgjdikfhngkdfngf.eastus.cloudapp.azure.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://fgjdikfhngkdfngf.eastus.cloudapp.azure.com/api/v2/crowdstrike/entities/sensor-update-policy/v2","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"fgjdikfhngkdfngf.eastus.cloudapp.azure.com\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"20.102.89.241\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00007312\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity","description":"WTSFreeMemory@WTSAPI32.dll at 31269-387-0000000140010674\n WTSFreeMemory@WTSAPI32.dll at 31269-388-0000000140001008","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1021.001","relevance":5,"id":"stream-137","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"stage3_fix.exe\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information","description":"WTSQuerySessionInformationW@WTSAPI32.dll at 31269-166-0000000140001000\n WTSQuerySessionInformationW@WTSAPI32.dll at 31269-387-0000000140010674","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1018","relevance":5,"id":"stream-138","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; File: \"stage3_fix.exe\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \":\\WINDOWS\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00007312.00000000.146860.D9DF0000.00000004.mdmp, 00000000-00007312.00000001.148781.D9DF0000.00000004.mdmp, 00000000-00007312.00000002.150702.D9DF0000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00007312.00000000.146860.D9DF0000.00000004.mdmp, 00000000-00007312.00000001.148781.D9DF0000.00000004.mdmp, 00000000-00007312.00000002.150702.D9DF0000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00007312.00000000.146860.D9DF0000.00000004.mdmp, 00000000-00007312.00000001.148781.D9DF0000.00000004.mdmp, 00000000-00007312.00000002.150702.D9DF0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00007312.00000000.146860.D9DF0000.00000004.mdmp, 00000000-00007312.00000001.148781.D9DF0000.00000004.mdmp, 00000000-00007312.00000002.150702.D9DF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in file \"stage3_fix.exe\"\n Found registry query API: \"RegQueryValueExW\" in file \"stage3_fix.exe\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"stage3_fix.exe\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; File: \"stage3_fix.exe\")\n Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; File: \"stage3_fix.exe\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")\n Found reference to API \"7689,7316,3193,,GetUserNameW,advapi32.dll,\"00:39:14.500\",RX=0,PX=0\" (Indicator: \"GetUserName\"; Source: \"00000000-00007312.00000002.150702.D9DF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"stage3_fix.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"stage3_fix.exe\" called \"GetComputerNameW\" (UID: 00000000-00007312)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"stage3_fix.exe\" called \"GetUserNameW\" (UID: 00000000-00007312)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; File: \"PCAP\")\n Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00007312.00000000.146860.D9DF0000.00000004.mdmp, 00000000-00007312.00000001.148781.D9DF0000.00000004.mdmp, 00000000-00007312.00000002.150702.D9DF0000.00000004.mdmp\")\n Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00007312.00000000.146860.D9DF0000.00000004.mdmp, 00000000-00007312.00000001.148781.D9DF0000.00000004.mdmp, 00000000-00007312.00000002.150702.D9DF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"stage3_fix.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"stage3_fix.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"stage3_fix.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; File: \"stage3_fix.exe\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"stage3_fix.exe\")\n Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; File: \"stage3_fix.exe\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")\n Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")\n Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-ChildItem\"; File: \"stage3_fix.exe\")\n file/memory contains long string with (Indicator: \"Get-ItemProperty\"; File: \"stage3_fix.exe\")\n file/memory contains long string with (Indicator: \"Get-WmiObject\"; File: \"stage3_fix.exe\")\n file/memory contains long string with (Indicator: \"Get-ChildItem\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"Get-ItemProperty\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"Get-WmiObject\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"stage3_fix.exe\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"stage3_fix.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"stage3_fix.exe\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"stage3_fix.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"stage3_fix.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Observed security product related strings in binary/memory","description":"$42","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":1,"id":"string-123","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"file/memory contains long string with (Indicator: \" Win32_Service\"; File: \"stage3_fix.exe\")\n file/memory contains long string with (Indicator: \" Win32_Service\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in file \"stage3_fix.exe\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: stage3_fix.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; File: \"stage3_fix.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"System Security","name":"Contains ability to create/modify item values (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-ItemProperty\"; File: \"stage3_fix.exe\")\n file/memory contains long string with (Indicator: \"Set-ItemProperty\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-367","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete a property and its value from an item (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Remove-ItemProperty\"; File: \"stage3_fix.exe\")\n file/memory contains long string with (Indicator: \"Remove-WmiObject\"; File: \"stage3_fix.exe\")\n file/memory contains long string with (Indicator: \"Remove-ItemProperty\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"Remove-WmiObject\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-369","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"stage3_fix.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"stage3_fix.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"stage3_fix.exe\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"System Security","name":"Contains ability to stop a service (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Stop-Service\"; File: \"stage3_fix.exe\")\n file/memory contains long string with (Indicator: \"Stop-Service\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-274","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"stage3_fix.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"stage3_fix.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"stage3_fix.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"stage3_fix.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$44","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"stage3_fix.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2FD\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Out-Null\"; File: \"stage3_fix.exe\")\n file/memory contains long string with (Indicator: \"Out-Null\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"stage3_fix.exe\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00007312.00000002.150702.46FBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to shellcode","description":"Found reference to API \"[!] usage: __shellcode \" (Indicator: \"shellcode\"; File: \"stage3_fix.exe\")\n Found reference to API \"__shellcode\" (Indicator: \"shellcode\"; File: \"stage3_fix.exe\")\n Found reference to API \"[!] usage: __shellcode \" (Indicator: \"shellcode\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")\n Found reference to API \"__shellcode\" (Indicator: \"shellcode\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-468","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00007312.00000000.146860.D9DF0000.00000004.mdmp, 00000000-00007312.00000001.148781.D9DF0000.00000004.mdmp, 00000000-00007312.00000002.150702.D9DF0000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"12/23 Antivirus vendors marked sample as malicious (52% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"suspicious","category":"General","name":"Contains ability to create directories","description":"CreateDirectoryW@KERNEL32.dll at 31269-363-000000014000F74D\n CreateDirectoryW@KERNEL32.dll at 31269-401-0000000140011231","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1074.001","relevance":3,"id":"stream-102","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"suspicious","category":"General","name":"Contains ability to modify processes thread functionality","description":"OpenThread@KERNEL32.dll at 31269-138-000000014000C9F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-129","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 20.102.89.241 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Able to delete scheduled task(s)","description":"Found string \"schtasks.exe /delete /tn \"_b\" /f\" (Indicator: \"schtasks.exe /delete\"; File: \"stage3_fix.exe\")\n Found string \"schtasks.exe /delete /tn \"_b\" /f\" (Indicator: \"schtasks.exe /delete\"; Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-629","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"root\\cimv2\" (Indicator: \"root\\cimv2\"; in File: \"stage3_fix.exe\")\n Found string \"root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00007312.00000000.146860.46FB4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 31269-138-000000014000C9F0\n Process32NextW@KERNEL32.dll at 31269-139-0000000140006418\n Process32FirstW@KERNEL32.dll at 31269-140-0000000140006420\n CreateToolhelp32Snapshot@KERNEL32.dll at 31269-141-0000000140006428\n Thread32Next@KERNEL32.dll at 31269-143-0000000140006408\n Thread32First@KERNEL32.dll at 31269-144-0000000140006410\n CreateToolhelp32Snapshot@KERNEL32.dll at 31269-261-0000000140008F46","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.dll at 31269-1-0000000140006430","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyW\n RegOpenKeyExW\n RegCloseKey\n GetUserNameW\n RegCreateKeyExW\n OpenProcessToken\n DeleteFileW\n GetTickCount\n GetModuleFileNameW\n Process32NextW\n GetComputerNameW\n CreateDirectoryW\n OpenProcess\n GetProcAddress\n GetTempPathW\n CreateProcessA\n GetFileAttributesW\n VirtualAllocEx\n CreateThread\n Process32FirstW\n GetModuleHandleW\n CreateRemoteThread\n Sleep\n LoadLibraryA\n TerminateProcess\n CreateFileW\n CopyFileW\n CreateToolhelp32Snapshot\n GetSystemDirectoryW\n VirtualAlloc\n WriteFile\n CreateProcessW\n WriteProcessMemory","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"12/23 Antivirus vendors marked sample as malicious (52% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]}],"intel_graph":{"map":{"Domain:fgjdikfhngkdfngf.eastus.cloudapp.azure.com":{"type":"Domain","value":"fgjdikfhngkdfngf.eastus.cloudapp.azure.com"},"File:a570a5723bcd758ae8e4d9cab95901432c9ba0c4b321303a99389096d218bbf5":{"type":"File","value":"a570a5723bcd758ae8e4d9cab95901432c9ba0c4b321303a99389096d218bbf5"},"Ip:20.102.89.241":{"type":"Ip","value":"20.102.89.241"},"Url:/api/v2/crowdstrike/entities/sensor-update-policy/v2":{"type":"Url","value":"/api/v2/crowdstrike/entities/sensor-update-policy/v2"}},"chains":[{"id":"sandbox_network","root":"File:a570a5723bcd758ae8e4d9cab95901432c9ba0c4b321303a99389096d218bbf5","edges":[{"edge_kind":"contacted_ip","from_key":"File:a570a5723bcd758ae8e4d9cab95901432c9ba0c4b321303a99389096d218bbf5","to_key":"Ip:20.102.89.241"},{"edge_kind":"contacted_domain","from_key":"File:a570a5723bcd758ae8e4d9cab95901432c9ba0c4b321303a99389096d218bbf5","to_key":"Domain:fgjdikfhngkdfngf.eastus.cloudapp.azure.com"},{"edge_kind":"resolves_to","from_key":"Domain:fgjdikfhngkdfngf.eastus.cloudapp.azure.com","to_key":"Ip:20.102.89.241"},{"edge_kind":"contacted_url","from_key":"File:a570a5723bcd758ae8e4d9cab95901432c9ba0c4b321303a99389096d218bbf5","to_key":"Url:/api/v2/crowdstrike/entities/sensor-update-policy/v2"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":51,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":14,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":14,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["evasive"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6abec9442d70eef0610fd20d","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.CoffLoader.Marte.A","contacted_countries":["USA"],"submit_name":"stage3_fix.exe","analysis_start_time":"2026-10-01T20:57:41+00:00","indicators_count":{"informative":162,"suspicious":38,"malicious":3},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"20.102.89.241","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]}],"dns_resolutions":[{"domain":"fgjdikfhngkdfngf.eastus.cloudapp.azure.com","address":"20.102.89.241","ttl":10,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]}],"http_requests":[{"host":"fgjdikfhngkdfngf.eastus.cloudapp.azure.com","host_ip":"20.102.89.241:443","url":"/api/v2/crowdstrike/entities/sensor-update-policy/v2","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/v2/crowdstrike/entities/sensor-update-policy/v2 HTTP/1.1\nConnection: Keep-Alive\nAccept: application/octet-stream, application/json;q=0.9\nAccept-Encoding: gzip, deflate, br\nAccept-Language: en-US\nCookie: falcon_session=A2SQHOHOKDauwI5n-dFi1gR8gpso3KjEYRYiU24b0XIJTpN9Gzh_cJtraHOFnBjVsw0ZeRY1IgPIqJUU507LfxQQZg-fPnh5KVbG8glehDJh9Te8xALHW8HMJoSGlYLRIqneeFl26hFLM4oAepCBWbs__nhN3j_G-sd3tVmwXF7_gF_Q3e8p9dJ_BLP0qbhfsxm9volqg5vd1JwPlGoN_gwQPYCCWs53RhtNolu0RU8LceSnNEu_9QOwb3GmvWog2hYhCBUVV4gJbEH5COY7s408veXlOlvam7x5LOqFKMqLdfwFAgST-mbemuNB7WeKwA==\nUser-Agent: CrowdStrike CsAgent/7.04.18110.0 (Windows 10.0.19045; x64)\nX-CS-AGENTID: aa963888f557676300af9cf933b96371\nX-CS-VERSION: 7.04.18110.0\nHost: fgjdikfhngkdfngf.eastus.cloudapp.azure.com","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}],"processes":[{"pid":7312,"ppid":0,"name":"stage3_fix.exe","command_line":"","sha256":"a570a5723bcd758ae8e4d9cab95901432c9ba0c4b321303a99389096d218bbf5","normalized_path":"C:\\stage3_fix.exe","uid":"00000000-00007312","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="}],"all_imported_dlls":["cryptbase.dll","kernel32.dll","gdi32full.dll","wtsapi32.dll","FWPUCLNT.DLL","msasn1.dll","OnDemandConnRouteHelper.dll","apphelp.dll","sechost.dll","imm32.dll","vcruntime140_1.dll","schannel.dll","crypt32.dll","msvcrt.dll","combase.dll","ucrtbase.dll","winhttp.dll","mskeyprotect.dll","ntasn1.dll","dpapi.dll","sspicli.dll","mswsock.dll","nsi.dll","ncrypt.dll","ole32.dll","VxSSL64.dll","fltLib.dll","shlwapi.dll","IPHLPAPI.DLL","ncryptsslp.dll","KernelBase.dll","rpcrt4.dll","user32.dll","webio.dll","winnsi.dll","rsaenh.dll","gpapi.dll","advapi32.dll","bcryptprimitives.dll","msvcp_win.dll","oleaut32.dll","ws2_32.dll","msvcp140.dll","dnsapi.dll","rasadhlp.dll","ntdll.dll","gdi32.dll","win32u.dll","vcruntime140.dll","cryptsp.dll","bcrypt.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6abec9442d70eef0610fd20d"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6abec9442d70eef0610fd20d"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious CoffLoader.Marte.A.Generic Sample a570a5723bcd… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a570a5723bcd…. Malware family: CoffLoader.Marte.A.Generic. Threat score 100/100. 13/24 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a570a5723bcd758ae8e4d9cab95901432c9ba0c4b321303a99389096d218bbf5"}],["$","meta","4",{"property":"og:title","content":"Malicious CoffLoader.Marte.A.Generic Sample a570a5723bcd… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a570a5723bcd…. Malware family: CoffLoader.Marte.A.Generic. Threat score 100/100. 13/24 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a570a5723bcd758ae8e4d9cab95901432c9ba0c4b321303a99389096d218bbf5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious CoffLoader.Marte.A.Generic Sample a570a5723bcd… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a570a5723bcd…. Malware family: CoffLoader.Marte.A.Generic. Threat score 100/100. 13/24 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L47","11",{}]]