24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T485,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Deshacop Sample ae9a4e244a9b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ae9a4e244a9b…. Malware family: Trojan.Deshacop. Threat score 100/100. 23/28 AV engines flagged this file. 15 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ae9a4e244a9b3c77d489dee8aeaf35a7c3ba31b210e76d81ef2e91790f052c85","keywords":["Malicious","Trojan.Deshacop","malware analysis","sandbox report","threat intelligence","ae9a4e244a9b3c77d489dee8aeaf35a7c3ba31b210e76d81ef2e91790f052c85"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"ae9a4e244a9b3c77d489dee8aeaf35a7c3ba31b210e76d81ef2e91790f052c85","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Deshacop","antivirusDetections":{"malicious":23,"total":28},"behavioralIndicators":{"malicious":15,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4cf,Spawned process "cmd.exe" with commandline "/c %WINDIR%\system32\vssadmin.exe delete shadows /all /quiet" (UID: 00015236-00003896) Spawned process "vssadmin.exe" with commandline "delete shadows /all /quiet" (UID: 00015242-00003772) Spawned process "cmd.exe" with commandline "/c wbadmin.exe delete catalog -quiet" (UID: 00015249-00003900) Spawned process "wbadmin.exe" with commandline "delete catalog -quiet" (UID: 00015253-00001996) Spawned process "cmd.exe" with commandline "/c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no" (UID: 00015297-00003932) Spawned process "bcdedit.exe" with commandline "/set {default} bootstatuspolicy ignoreallfailures" (UID: 00015303-00004004) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled no" (UID: 00015312-00003988) Spawned process "cmd.exe" with commandline "/c wevtutil.exe cl System" (UID: 00015317-00004016) Spawned process "wevtutil.exe" with commandline "cl System" (UID: 00015322-00000496) Spawned process "cmd.exe" with commandline "/c wevtutil.exe cl Security" (UID: 00015342-00002096) Spawned process "wevtutil.exe" with commandline "cl Security" (UID: 00015348-00001700)26:T50a,Spawned process "" (UID: 00015041-00003748) Spawned process "cmd.exe" with commandline "/c %WINDIR%\system32\vssadmin.exe delete shadows /all /quiet" (UID: 00015236-00003896) Spawned process "vssadmin.exe" with commandline "delete shadows /all /quiet" (UID: 00015242-00003772) Spawned process "cmd.exe" with commandline "/c wbadmin.exe delete catalog -quiet" (UID: 00015249-00003900) Spawned process "wbadmin.exe" with commandline "delete catalog -quiet" (UID: 00015253-00001996) Spawned process "cmd.exe" with commandline "/c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no" (UID: 00015297-00003932) Spawned process "bcdedit.exe" with commandline "/set {default} bootstatuspolicy ignoreallfailures" (UID: 00015303-00004004) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled no" (UID: 00015312-00003988) Spawned process "cmd.exe" with commandline "/c wevtutil.exe cl System" (UID: 00015317-00004016) Spawned process "wevtutil.exe" with commandline "cl System" (UID: 00015322-00000496) Spawned process "cmd.exe" with commandline "/c wevtutil.exe cl Security" (UID: 00015342-00002096) Spawned process "wevtutil.exe" with commandline "cl Security" (UID: 00015348-00001700)27:Te92,Process "cmd.exe" (UID: 00000000-00001540) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "cmd.exe" (UID: 00000000-00001540) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "vssadmin.exe" (UID: 00000000-00000780) was launched with new environment variables: "PROMPT="$P$G"" Process "vssadmin.exe" (UID: 00000000-00000780) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "vssadmin.exe" (UID: 00000000-00000780) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "cmd.exe" (UID: 00000000-00002520) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "cmd.exe" (UID: 00000000-00002520) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "cmd.exe" (UID: 00000000-00002520) was launched with missing environment variables: "PROMPT" Process "wbadmin.exe" (UID: 00000000-00006344) was launched with new environment variables: "PROMPT="$P$G"" Process "wbadmin.exe" (UID: 00000000-00006344) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "wbadmin.exe" (UID: 00000000-00006344) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "cmd.exe" (UID: 00000000-00002224) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "cmd.exe" (UID: 00000000-00002224) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "cmd.exe" (UID: 00000000-00002224) was launched with missing environment variables: "PROMPT" Process "bcdedit.exe" (UID: 00000000-00003904) was launched with new environment variables: "PROMPT="$P$G"" Process "bcdedit.exe" (UID: 00000000-00003904) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "bcdedit.exe" (UID: 00000000-00003904) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "cmd.exe" (UID: 00000000-00002188) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "cmd.exe" (UID: 00000000-00002188) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "cmd.exe" (UID: 00000000-00002188) was launched with missing environment variables: "PROMPT" Process "wevtutil.exe" (UID: 00000000-00002804) was launched with new environment variables: "PROMPT="$P$G"" Process "wevtutil.exe" (UID: 00000000-00002804) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "wevtutil.exe" (UID: 00000000-00002804) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "cmd.exe" (UID: 00000000-00003412) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "cmd.exe" (UID: 00000000-00003412) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "cmd.exe" (UID: 00000000-00003412) was launched with missing environment variables: "PROMPT" Process "wevtutil.exe" (UID: 00000000-00006796) was launched with new environment variables: "PROMPT="$P$G"" Process "wevtutil.exe" (UID: 00000000-00006796) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "wevtutil.exe" (UID: 00000000-00006796) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432"28:T4a7,Spawned process "cmd.exe" with commandline "/c %WINDIR%\system32\vssadmin.exe delete shadows /all /quiet" (UID: 00000000-00001540) Spawned process "vssadmin.exe" with commandline "delete shadows /all /quiet" (UID: 00000000-00000780) Spawned process "cmd.exe" with commandline "/c wbadmin.exe delete catalog -quiet" (UID: 00000000-00002520) Spawned process "wbadmin.exe" with commandline "delete catalog -quiet" (UID: 00000000-00006344) Spawned process "cmd.exe" with commandline "/c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures ..." (UID: 00000000-00002224) Spawned process "bcdedit.exe" with commandline "/set {default} bootstatuspolicy ignoreallfailures" (UID: 00000000-00003904) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled no" (UID: 00000000-00001700) Spawned process "cmd.exe" with commandline "/c wevtutil.exe cl System" (UID: 00000000-00002188) Spawned process "wevtutil.exe" with commandline "cl System" (UID: 00000000-00002804) Spawned process "cmd.exe" with commandline "/c wevtutil.exe cl Security" (UID: 00000000-00003412) Spawned process "wevtutil.exe" with commandline "cl Security" (UID: 00000000-00006796)29:T50d,"\" touched file \"%WINDIR%\\System32\\en-US\\mpr.dll.mui\"\n \"cmd.exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"cmd.exe\" touched file \"%WINDIR%\\System32\\vssadmin.exe\"\n \"cmd.exe\" touched file \"%WINDIR%\\System32\\wbadmin.exe\"\n \"wbadmin.exe\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \"wbadmin.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"cmd.exe\" touched file \"%WINDIR%\\System32\\bcdedit.exe\"\n \"cmd.exe\" touched file \"%WINDIR%\\System32\\wevtutil.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a7f6e887ca3e13b33165395"},{"report_type":"sandbox","report_id":"6399e49434e7306d621006be"},{"report_type":"sandbox","report_id":"6399e490e349580fb37a7496"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"vssadmin.exe\" opened \"\\Device\\KsecDD\"\n \"wbadmin.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a7f6e887ca3e13b33165395"},{"report_type":"sandbox","report_id":"6399e490e349580fb37a7496"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"ae9a4e244a9b3c77d489dee8aeaf35a7c3ba31b210e76d81ef2e91790f052c85.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a7f6e887ca3e13b33165395"},{"report_type":"sandbox","report_id":"6399e49434e7306d621006be"},{"report_type":"sandbox","report_id":"6399e490e349580fb37a7496"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open/control a service","description":"OpenServiceW@ADVAPI32.DLL at 00015041-00003748-49754-47-00ED12E8","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"5a7f6e887ca3e13b33165395"},{"report_type":"sandbox","report_id":"6399e490e349580fb37a7496"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"wbadmin.exe\" at 00015253-00001996-00000105-42252289","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5a7f6e887ca3e13b33165395"},{"report_type":"sandbox","report_id":"6399e490e349580fb37a7496"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"wevtutil.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a7f6e887ca3e13b33165395"},{"report_type":"sandbox","report_id":"6399e49434e7306d621006be"},{"report_type":"sandbox","report_id":"6399e490e349580fb37a7496"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"wbadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a7f6e887ca3e13b33165395"},{"report_type":"sandbox","report_id":"6399e490e349580fb37a7496"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"\" sleeping for \"03600000\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5a7f6e887ca3e13b33165395"},{"report_type":"sandbox","report_id":"6399e490e349580fb37a7496"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ENUMERATE_SERVICE\" (0x4)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5a7f6e887ca3e13b33165395"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 160)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5a7f6e887ca3e13b33165395"}]},{"level":"suspicious","category":"System Security","name":"Makes use of the windows event log utility","description":"Process \"wevtutil.exe\" with commandline \"cl System\" (UID: 00015322-00000496)\n Process \"wevtutil.exe\" with commandline \"cl Security\" (UID: 00015348-00001700)","origin":"Monitored Target","relevance":10,"id":"target-76","sources":[{"report_type":"sandbox","report_id":"5a7f6e887ca3e13b33165395"},{"report_type":"sandbox","report_id":"6399e49434e7306d621006be"},{"report_type":"sandbox","report_id":"6399e490e349580fb37a7496"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"ae9a4e244a9b3c77d489dee8aeaf35a7c3ba31b210e76d81ef2e91790f052c85.exe.bin\" claimed CRC 82536 while the actual is CRC 84875","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5a7f6e887ca3e13b33165395"},{"report_type":"sandbox","report_id":"6399e49434e7306d621006be"},{"report_type":"sandbox","report_id":"6399e490e349580fb37a7496"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcessToken\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n UnhandledExceptionFilter\n GetStartupInfoW\n GetCommandLineA\n GetProcAddress\n GetFileSizeEx\n CreateThread\n LoadLibraryW\n FindNextFileW\n WriteFile\n FindFirstFileW\n GetModuleHandleW\n TerminateProcess\n CreateFileW\n CreateProcessW\n Sleep\n GetTickCount","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a7f6e887ca3e13b33165395"},{"report_type":"sandbox","report_id":"6399e49434e7306d621006be"},{"report_type":"sandbox","report_id":"6399e490e349580fb37a7496"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"bcdedit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"wevtutil.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a7f6e887ca3e13b33165395"},{"report_type":"sandbox","report_id":"6399e49434e7306d621006be"},{"report_type":"sandbox","report_id":"6399e490e349580fb37a7496"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to suppress failures during boot (often used to hide system changes)","description":"Tries to suppress failures during boot \"cmd.exe\" with commandline \"/c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no\" (UID: 00015297-00003932)\n Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"/set {default} bootstatuspolicy ignoreallfailures\" (UID: 00015303-00004004)","origin":"Monitored Target","relevance":8,"id":"target-6","sources":[{"report_type":"sandbox","report_id":"5a7f6e887ca3e13b33165395"},{"report_type":"sandbox","report_id":"6399e49434e7306d621006be"},{"report_type":"sandbox","report_id":"6399e490e349580fb37a7496"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"32/67 Antivirus vendors marked sample as malicious (47% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a7f6e887ca3e13b33165395"},{"report_type":"sandbox","report_id":"6399e49434e7306d621006be"},{"report_type":"sandbox","report_id":"6399e490e349580fb37a7496"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"32/67 Antivirus vendors marked sample as malicious (47% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a7f6e887ca3e13b33165395"},{"report_type":"sandbox","report_id":"6399e49434e7306d621006be"},{"report_type":"sandbox","report_id":"6399e490e349580fb37a7496"}]},{"level":"malicious","category":"Installation/Persistance","name":"Disables startup repair","description":"Disables startup repair \"cmd.exe\" with commandline \"/c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no\" (UID: 00015297-00003932)\n Disables startup repair \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled no\" (UID: 00015312-00003988)","origin":"Monitored Target","relevance":8,"id":"target-5","sources":[{"report_type":"sandbox","report_id":"5a7f6e887ca3e13b33165395"},{"report_type":"sandbox","report_id":"6399e490e349580fb37a7496"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes backup catalog","description":"Deletes backup catalog files using \"wbadmin.exe\" with commandline \"delete catalog -quiet\" (UID: 00015253-00001996)","origin":"Monitored Target","relevance":10,"id":"target-80","sources":[{"report_type":"sandbox","report_id":"5a7f6e887ca3e13b33165395"},{"report_type":"sandbox","report_id":"6399e49434e7306d621006be"},{"report_type":"sandbox","report_id":"6399e490e349580fb37a7496"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"delete shadows /all /quiet\" (UID: 00015242-00003772)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"5a7f6e887ca3e13b33165395"},{"report_type":"sandbox","report_id":"6399e49434e7306d621006be"},{"report_type":"sandbox","report_id":"6399e490e349580fb37a7496"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\"iphlpsvc\" (Indicator: \"iphlpsvc\")\n \"luafv\" (Indicator: \"luafv\")","origin":"File/Memory","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"5a7f6e887ca3e13b33165395"},{"report_type":"sandbox","report_id":"6399e49434e7306d621006be"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$26","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5a7f6e887ca3e13b33165395"},{"report_type":"sandbox","report_id":"6399e49434e7306d621006be"},{"report_type":"sandbox","report_id":"6399e490e349580fb37a7496"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"vssadmin.exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00000780)\n \"wbadmin.exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00006344)\n \"bcdedit.exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00003904)\n \"wevtutil.exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00002804)\n \"wevtutil.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00006796)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6399e49434e7306d621006be"},{"report_type":"sandbox","report_id":"6399e490e349580fb37a7496"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"