24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 75:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample a7a9205e561a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a7a9205e561a…. Malware family: Trojan.Generic. Threat score 100/100. 8/27 AV engines flagged this file. 5 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504"],"about":{"@type":"SoftwareApplication","name":"JUFPRUJS.exe","applicationCategory":["peexe","executable","compressed","sfx","7zip"],"identifier":"a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":8,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T156a,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "@System@FreeMemory$qpv" (Indicator: "FreeMemory"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "@Maddisasm@CWriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00001248.00000000.280149.5780E000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp, 00000000-00001248.00000002.282180.500A7000.00000004.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "VirtualAllocdBlocks" (Indicator: "VirtualAlloc"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "CreateThread"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtWow64AllocateVirtualMemory64" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "WriteVirtualMemory"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "NtWow64WriteVirtualMemory64"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "RtlFreeMemoryBlockLookaside" (Indicator: "FreeMemory"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "ZwCreateThread" (Indicator: "CreateThread"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "ZwCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "ZwWow64AllocateVirtualMemory64" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "ZwWow64WriteVirtualMemory64" (Indicator: "WriteVirtualMemory"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp")26:Tb77,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "@Madexcept@OpenThread$qqruiui" (Indicator: "OpenThread"; Source: "00000000-00001248.00000000.280149.5985F000.00000002.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "ZwAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "ZwOpenThread" (Indicator: "OpenThread"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "ZwResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "ZwSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp")27:T455,Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "NtCreateThread"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "NtCreateThread"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "RtlCreateUserThread" (Indicator: "RtlCreateUserThread"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp")28:T16eb,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "NtDelayExecution" (Indicator: "NtDelayExecution"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtSetTimer2" (Indicator: "SetTimer"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtSetTimer" (Indicator: "SetTimer"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtSetTimerEx" (Indicator: "SetTimer"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtSetTimerResolution" (Indicator: "SetTimer"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtSignalAndWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects32" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects32" (Indicator: "NtWaitForMultipleObjects"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects" (Indicator: "NtWaitForMultipleObjects"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "RtlQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "RtlQueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "RtlSetTimer" (Indicator: "SetTimer"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "TpSetTimer" (Indicator: "SetTimer"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp")29:T7be,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "NtImpersonateThread" (Indicator: "NtImpersonateThread"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "ZwOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "ZwOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp")2a:T53b,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "@Sysutils@SafeLoadLibrary$qqrx20System@UnicodeStringui" (Indicator: "LoadLibrary"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to API "After a callback to 0x%p(0x%p), an completion call to FreeLibrary(%p) failed with status 0x%08x." (Indicator: "FreeLibrary"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp")2b:Ta07,file/memory contains long string with (Indicator: "SHA384"; File: "pcre.dll") file/memory contains long string with (Indicator: "SHA384"; File: "Transponder-Sonic.exe") file/memory contains long string with (Indicator: "SHA384"; File: "zlib1.dll") file/memory contains long string with (Indicator: "Aes"; File: "intl.dll") file/memory contains long string with (Indicator: "SHA384"; File: "intl.dll") file/memory contains long string with (Indicator: "SHA384"; File: "sigc-2.0.dll") file/memory contains long string with (Indicator: "SHA384"; File: "gmodule-2.0.dll") Found reference to "truncated HMAC" (Indicator: "HMAC"; File: "00000000-00007432.00000001.279832.00401000.00000020.mdmp") Found reference to "uncated HMAC" (Indicator: "HMAC"; File: "00000000-00007432.00000001.279832.00401000.00000020.mdmp") Found reference to "Rijndael" (Indicator: "Rijndael"; File: "00000000-00007432.00000001.279832.00401000.00000020.mdmp") Found reference to "HMAC_CTX_new" (Indicator: "HMAC"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to "HMAC_Final" (Indicator: "HMAC"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to "SHA512_Transform" (Indicator: "SHA512"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to "SHA384_Init" (Indicator: "SHA384"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to "HMAC_Update" (Indicator: "HMAC"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to "SHA512_Init" (Indicator: "SHA512"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to "HMAC_size" (Indicator: "HMAC"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to "HMAC_CTX_free" (Indicator: "HMAC"; File: "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504.bin") Found reference to "The cryptographic provider does not support HMAC." (Indicator: "HMAC"; Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp, 00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found reference to "qa_o e_ka. o jiyiypi. Aesi ga-viro-qeq_esxa" (Indicator: "Aes"; Source: "00000000-00001248.00000001.282070.0D060000.00000004.mdmp, 00000000-00001248.00000001.282070.0D12B000.00000004.mdmp")2c:T506,Found PE header "MZ" - Source: "00000000-00001248.00000001.282070.04B40000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001248.00000001.282070.0C62C000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001248.00000001.282070.0CCCF000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001248.00000001.282070.0D060000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001248.00000001.282070.0D12B000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001248.00000002.282180.02C10000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001248.00000002.282180.04B40000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004468.00000001.282024.04816000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004468.00000001.282024.061E0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007432.00000001.279832.054E0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007432.00000001.279832.0CEBD000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007432.00000001.279832.0D1E0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00008084.00000001.282255.00C90000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00008084.00000001.282255.04AFB000.00000004.mdmp")2d:T872,"9iqmgvw,czcd3q" - Source: "00000000-00004468.00000001.282024.02720000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%yicert.cofuu1" - Source: "00000000-00004468.00000001.282024.02720000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004468.00000001.282024.02720000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004468.00000001.282024.02720000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004468.00000001.282024.02720000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004468.00000001.282024.02720000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004468.00000001.282024.02720000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004468.00000001.282024.02720000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004468.00000001.282024.02720000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004468.00000001.282024.02720000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0ttp:l.miprod*/mict2011_20vs\d" - Source: "00000000-00004468.00000001.282024.02720000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004468.00000001.282024.02720000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004468.00000001.282024.02720000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004468.00000001.282024.02720000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004468.00000001.282024.02720000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00004468.00000001.282024.02720000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysgeotrust" - Source: "00000000-00004468.00000001.282024.02720000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn "------6f7a98e877bde065c71bContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-4AD645E------6f7a98e877bde065c71bContent-Disposition: form-data; name="build_id"f5d2a26b982064e532640259c883fccf------6f7a98e877bde065c71b--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Tue 26 May 2026 00:35:28 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>307C307C307C307C307C307C307C307C307C307C307C307C307C307C307C3020626C6F636B....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----da3a1f2cdef66b3a5080 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100102 Firefox/140.0 Content-Length: 300 Host: 176.9.142.218" with payload::==> "------da3a1f2cdef66b3a5080Content-Disposition: form-data; name="token"0------da3a1f2cdef66b3a5080Content-Disposition: form-data; name="build_id"f5d2a26b982064e532640259c883fccf------da3a1f2cdef66b3a5080Content-Disposition: form-data; name="mode"1------da3a1f2cdef66b3a5080--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Tue 26 May 2026 00:35:29 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B.......70:T19aa,"libcrypto-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%APPDATA%\prorunner_32\LQOZWVOGURIVFUPDPI\libcrypto-3.dll]- [targetUID: 00000000-00001248] "driverproc90.dll" has type "data"- Location: [%APPDATA%\prorunner_32\LQOZWVOGURIVFUPDPI\driverproc90.dll]- [targetUID: 00000000-00001248] "libxml2.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%APPDATA%\prorunner_32\LQOZWVOGURIVFUPDPI\libxml2.dll]- [targetUID: 00000000-00001248] "Zip.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%TEMP%\Zip.dll]- [targetUID: 00000000-00001248] "glib-2.0.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%APPDATA%\prorunner_32\LQOZWVOGURIVFUPDPI\glib-2.0.dll]- [targetUID: 00000000-00001248] "ucrtbase.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\prorunner_32\ucrtbase.dll]- [targetUID: 00000000-00001248] "DeltaGen32.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 9 sections"- Location: [%TEMP%\DeltaGen32.exe]- [targetUID: 00000000-00005080] "libssl-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%APPDATA%\prorunner_32\LQOZWVOGURIVFUPDPI\libssl-3.dll]- [targetUID: 00000000-00001248] "msvcp_win.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- Location: [%APPDATA%\prorunner_32\LQOZWVOGURIVFUPDPI\msvcp_win.dll]- [targetUID: 00000000-00001248] "msvcp140.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%APPDATA%\prorunner_32\LQOZWVOGURIVFUPDPI\msvcp140.dll]- [targetUID: 00000000-00001248] "glibmm-2.4.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%APPDATA%\prorunner_32\LQOZWVOGURIVFUPDPI\glibmm-2.4.dll]- [targetUID: 00000000-00001248] "pcre.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%APPDATA%\prorunner_32\LQOZWVOGURIVFUPDPI\pcre.dll]- [targetUID: 00000000-00001248] "Crisp.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- Location: [%APPDATA%\prorunner_32\Crisp.exe]- [targetUID: 00000000-00001248] "gobject-2.0.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%APPDATA%\prorunner_32\LQOZWVOGURIVFUPDPI\gobject-2.0.dll]- [targetUID: 00000000-00001248] "AtoShard.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%LOCALAPPDATA%\AtoShard.exe]- [targetUID: 00000000-00001248] "Transponder-Sonic.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%APPDATA%\prorunner_32\LQOZWVOGURIVFUPDPI\Transponder-Sonic.exe]- [targetUID: 00000000-00001248] "zlib1.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%APPDATA%\prorunner_32\LQOZWVOGURIVFUPDPI\zlib1.dll]- [targetUID: 00000000-00001248] "vcruntime140.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%APPDATA%\prorunner_32\LQOZWVOGURIVFUPDPI\vcruntime140.dll]- [targetUID: 00000000-00001248] "intl.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%APPDATA%\prorunner_32\LQOZWVOGURIVFUPDPI\intl.dll]- [targetUID: 00000000-00001248] "sigc-2.0.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%APPDATA%\prorunner_32\LQOZWVOGURIVFUPDPI\sigc-2.0.dll]- [targetUID: 00000000-00001248] "gmodule-2.0.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%APPDATA%\prorunner_32\LQOZWVOGURIVFUPDPI\gmodule-2.0.dll]- [targetUID: 00000000-00001248] "vcl120.bpl" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%ALLUSERSPROFILE%\prorunner_32\vcl120.bpl]- [targetUID: 00000000-00001248] "rtl120.bpl" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%ALLUSERSPROFILE%\prorunner_32\rtl120.bpl]- [targetUID: 00000000-00001248] "madExcept_.bpl" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%TEMP%\madExcept_.bpl]- [targetUID: 00000000-00001248] "madBasic_.bpl" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%TEMP%\madBasic_.bpl]- [targetUID: 00000000-00001248] "madDisAsm_.bpl" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%TEMP%\madDisAsm_.bpl]- [targetUID: 00000000-00001248] "Zip.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%ALLUSERSPROFILE%\prorunner_32\Zip.dll]- [targetUID: 00000000-00001248] "ucrtbase.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%TEMP%\ucrtbase.dll]- [targetUID: 00000000-00001248] "ucrtbase.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- Location: [%APPDATA%\prorunner_32\LQOZWVOGURIVFUPDPI\ucrtbase.dll]- [targetUID: 00000000-00001248] "DeltaGen32.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 9 sections"- Location: [%ALLUSERSPROFILE%\prorunner_32\DeltaGen32.exe]- [targetUID: 00000000-00005080] "msvcp_win.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\msvcp_win.dll]- [targetUID: 00000000-00001248] "msvcp_win.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\prorunner_32\msvcp_win.dll]- [targetUID: 00000000-00001248] "vcl120.bpl" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%TEMP%\vcl120.bpl]- [targetUID: 00000000-00001248] "rtl120.bpl" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%TEMP%\rtl120.bpl]- [targetUID: 00000000-00001248] "madExcept_.bpl" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%ALLUSERSPROFILE%\prorunner_32\madExcept_.bpl]- [targetUID: 00000000-00001248] "madBasic_.bpl" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%ALLUSERSPROFILE%\prorunner_32\madBasic_.bpl]- [targetUID: 00000000-00001248] "madDisAsm_.bpl" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%ALLUSERSPROFILE%\prorunner_32\madDisAsm_.bpl]- [targetUID: 00000000-00001248]71:T2cc6," \"------6f7a98e877bde065c71bContent-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-4AD645E------6f7a98e877bde065c71bContent-Disposition: form-data; name=\"build_id\"f5d2a26b982064e532640259c883fccf------6f7a98e877bde065c71b--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6a14ea88b50996fab7009743"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"