26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 6f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4bd,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample b3810ca5f17d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b3810ca5f17d…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 5/27 AV engines flagged this file. 9 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3"],"about":{"@type":"SoftwareApplication","name":"crepectl.exe","applicationCategory":["peexe","executable"],"identifier":"b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":5,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T989,Found string ".?AUcompression_properties_interface@@" (Source: "00000000-00002500.00000000.167800.00D1A000.00000004.mdmp, 00000000-00002500.00000002.170933.00D1A000.00000004.mdmp") Found string ".?AUcompression_encoder_properties_interface@@" (Source: "00000000-00002500.00000000.167800.00D1A000.00000004.mdmp, 00000000-00002500.00000002.170933.00D1A000.00000004.mdmp") Found string ".?AUcompression_decoder_properties_interface@@" (Source: "00000000-00002500.00000000.167800.00D1A000.00000004.mdmp, 00000000-00002500.00000002.170933.00D1A000.00000004.mdmp") Found string ".?AV?$compression_interface_basic@DU?$char_traits@D@std@@@@" (Source: "00000000-00002500.00000000.167800.00D1A000.00000004.mdmp, 00000000-00002500.00000002.170933.00D1A000.00000004.mdmp") Found string ".?AV?$compression_encoder_interface_basic@DU?$char_traits@D@std@@@@" (Source: "00000000-00002500.00000000.167800.00D1A000.00000004.mdmp, 00000000-00002500.00000002.170933.00D1A000.00000004.mdmp") Found string ".?AV?$compression_decoder_interface_basic@DU?$char_traits@D@std@@@@" (Source: "00000000-00002500.00000000.167800.00D1A000.00000004.mdmp, 00000000-00002500.00000002.170933.00D1A000.00000004.mdmp") Found string ".?AV?$basic_compression_decoder_stream@DU?$char_traits@D@std@@@@" (Source: "00000000-00002500.00000000.167800.00D1A000.00000004.mdmp, 00000000-00002500.00000002.170933.00D1A000.00000004.mdmp") Found string ".?AV?$compression_decoder_streambuf@DU?$char_traits@D@std@@@@" (Source: "00000000-00002500.00000000.167800.00D1A000.00000004.mdmp, 00000000-00002500.00000002.170933.00D1A000.00000004.mdmp") Found string ".?AV?$_Ref_count_obj2@V?$basic_compression_decoder_stream@DU?$char_traits@D@std@@@@@std@@" (Source: "00000000-00002500.00000000.167800.00D1A000.00000004.mdmp, 00000000-00002500.00000002.170933.00D1A000.00000004.mdmp") Found string ".?AV?$_Ref_count@VZipArchiveEntry@@@std@@" (Source: "00000000-00002500.00000000.167800.00D1A000.00000004.mdmp, 00000000-00002500.00000002.170933.00D1A000.00000004.mdmp") Found string ".?AV?$_Ref_count@VZipArchive@@@std@@" (Source: "00000000-00002500.00000000.167800.00D1A000.00000004.mdmp, 00000000-00002500.00000002.170933.00D1A000.00000004.mdmp") Found string "Operation not permitted or decompression failed" (Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "unknown compression method" (Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp")28:Tc05,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp, 00000000-00002500.00000001.169721.05880000.00000004.mdmp, 00000000-00002500.00000002.170933.05880000.00000004.mdmp, 00000000-00002500.00000002.170933.059CC000.00000002.mdmp, 00000000-00002500.00000002.170933.7F080000.00000020.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found reference to API "Failed ThreadWaitForSingleObject in termination" (Indicator: "WaitForSingleObject"; Source: "00000000-00002500.00000001.169721.05880000.00000004.mdmp, 00000000-00002500.00000001.169721.05981000.00000020.mdmp, 00000000-00002500.00000002.170933.05880000.00000004.mdmp, 00000000-00002500.00000002.170933.7F080000.00000020.mdmp")29:T74a,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp")2a:T71a,Found reference to "CALG_RC2" (Indicator: "RC2"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to "CALG_HMAC" (Indicator: "HMAC"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to "%.*s4-HMAC-SHA256%s%s%s" (Indicator: "HMAC"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to "Authorization: %.*s4-HMAC-SHA256 Credential=%s/%s, SignedHeaders=%s, Signature=%s%s%s" (Indicator: "HMAC"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to "ecdsa-with-SHA384" (Indicator: "SHA384"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to "ecdsa-with-SHA512" (Indicator: "SHA512"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00008020-00000BC0-1668049730") Found reference to "CALG_RC2" (Indicator: "RC2"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found reference to "CALG_HMAC" (Indicator: "HMAC"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found reference to "%.*s4-HMAC-SHA256" (Indicator: "HMAC"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found reference to "Authorization: %.*s4-HMAC-SHA256 Credential=%s/%s, SignedHeaders=%s, Signature=%s" (Indicator: "HMAC"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found reference to "ecdsa-with-SHA384" (Indicator: "SHA384"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found reference to "ecdsa-with-SHA512" (Indicator: "SHA512"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp")2b:T879,"" (Indicator: "enumchildwindows"; Source: "00000000-00002500.00000000.167800.03490000.00000004.mdmp, 00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp")38:T13d1," HTTP/1.1 200 OK Date: Fri 24 Apr 2026 22:00:21 GMT Content-Type: application/octet-stream Content-Length: 140065 Connection: close Accept-Ranges: bytes ETag: "49683a7beec2af89a5348716617aa2e5" Last-Modified: Tue 21 Apr 2026 08:09:31 GMT Server: cloudflare Speculation-Rules: "/cdn-cgi/speculation" cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=gS6puyF6d7NKCx1Xgxv2jtot9Nau9cpQ%2BTVlLuvQpYC5Ucwgol549SOIDJrV6orLVQj6u3dSgM7Vgs0lObU3zIKWCNSbMtH2FsPtkq95imoh5noxc4PdrNri5fmxXFS4ykDqNFC8nSRGAVo1ANx%2FOw%3D%3D"}]} CF-RAY: 9f18615ccf3a58dc-SJC with response body ==>555356C28D6424C3BCC2893C24C3BC31C38029C39BC2B90000000029C3BFC3AB44C28B1424C28D64240404C3BEC289C38604C290C28D7FC3BFC381C3AF0831C3....... "GET /1f86ed90-6b0e-41e4-b4b8-dee23cfba442 HTTP/1.1 Host: cdn-1415.brightcanvas.digital Connection: close" Response ==> HTTP/1.1 200 OK Date: Fri 24 Apr 2026 22:00:21 GMT Content-Type: application/octet-stream Content-Length: 140055 Connection: close Accept-Ranges: bytes ETag: "ae7ae9747008e98e1e0bb3b39f0aec33" Last-Modified: Tue 21 Apr 2026 08:10:40 GMT Server: cloudflare Speculation-Rules: "/cdn-cgi/speculation" cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=5gGlCr0Njtj3HOtVfFE%2Fn6yk%2B2eAxk9M%2BlQB8sqe%2BY7LAJ88%2BZqh8g6hbNzo0gV5%2FweLk%2Fq53WivPyax8hg3cQRo8xKuHvYabTZtN2HNJZ5qK4Dy0PBMpRj6K%2FEx%2BRmDMVKyg6RrOyxjxgbLH5bQTw%3D%3D"}]} CF-RAY: 9f18615e9cae501e-SJC with response body ==>555356C28D6424C3BCC2893C24C3BC31C380C2BB00000000C2B90000000029C3BFC3AB42C28B1424C28D64240404C3BEC289C38604C2904FC381C3AF0831C3BA.......48:T2136," %d" (Indicator: "smtp"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "smtp_perform(), start" (Indicator: "smtp"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "smtp_perform() -> %d, connected=%d, done=%d" (Indicator: "smtp"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "smtp_regular_transfer() -> %d, done=%d" (Indicator: "smtp"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "smtp_do() -> %d, done=%d" (Indicator: "smtp"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "smtp_disconnect(), finished" (Indicator: "smtp"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "smtp_doing() -> %d, done=%d" (Indicator: "smtp"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "smtp_setup_connection() -> %d" (Indicator: "smtp"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin")55:T10fe,Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "gethostname" (Indicator: "gethostname"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "multi_done, conn #%lld to %s:%d was shutdown by server, not reusing" (Indicator: " shutdown "; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "Shutdown send direction error: %d. Broken server? Proceeding as if everything is ok." (Indicator: " send "; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "Connection died, retrying a fresh connect (retry count: %d)" (Indicator: " connect "; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "SSL shutdown timeout" (Indicator: " shutdown "; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "No valid port number in connect to host string (%s)" (Indicator: " connect "; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "Unix socket path too long: '%s'" (Indicator: " socket "; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "Could not bind to interface '%s' with errno %d: %s" (Indicator: " bind "; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "Could not bind to '%s' with errno %d: %s" (Indicator: " bind "; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "Immediate connect fail for %s: %s" (Indicator: " connect "; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "%s socket %u connected: [%s:%d] -> [%s:%d]" (Indicator: " socket "; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "Ready to accept data connection from server" (Indicator: " accept "; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "set socket NONBLOCK: %s" (Indicator: " socket "; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "set filter for listen socket fd=%u ip=%s:%d" (Indicator: " socket "; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "set filter for listen socket fd=%u ip=%s:%d" (Indicator: " listen "; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "[SHUTDOWN] shutdown all" (Indicator: " shutdown "; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "[SHUTDOWN] shutdown finished cleanly" (Indicator: " shutdown "; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "[SHUTDOWN] shutdown finished, %s" (Indicator: " shutdown "; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "[SHUTDOWN] shutdown finished, aborted" (Indicator: " shutdown "; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "[SHUTDOWN] discarding oldest shutdown connection due to connection limit of %zu" (Indicator: " shutdown "; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "Could not connect to server" (Indicator: " connect "; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "FTP: The server failed to connect to data port" (Indicator: " connect "; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin")56:Tcf5,Pattern match: "https://clients2.google.com/cr/report" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "https://curl.se/docs/http-cookies.html#" Heuristic match: ".onion" Heuristic match: "ftp@example.com" Pattern match: "https://curl.se/docs/alt-svc.html#" Pattern match: "https://curl.se/docs/hsts.html#" Heuristic match: "s0.gt" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "http://www.msftncsi.com/ncsi.txt" Pattern match: "https://notepad-plus-plus.org/downloads/" Pattern match: "https://npp-user-manual.org/docs/upgrading/#new-version-available-but-auto-updater-find-nothing" Heuristic match: "trustsing.com" Pattern match: "csi.com/ncsi.txt" Pattern match: "notepad-plus-plus.org/downloads/" Pattern match: "anual.org/docs/upgrading/#new-version-available-but-auto-updater-find-nothing" Pattern match: "https://grantt.qumarox.icu/sdfkkiso87" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "us@.us" Pattern match: "https://curl.se/docs/http-cookies.html" Pattern match: "https://curl.se/docs/alt-svc.html" Pattern match: "https://curl.se/docs/hsts.html" Heuristic match: "bx.uy" Heuristic match: "mmf.id" Heuristic match: "@.pro" Heuristic match: "??\c:\users\.ne" Pattern match: "https://cdn-1415.brightcanvas.digital/1f86ed90-6b0e-41e4-b4b8-dee23cfba442" Pattern match: "https://cdn-1415.brightcanvas.digital/1f86ed90-6b0e-41e4-b4b8-dee23cfba443" Heuristic match: "browserextension@rainbow.me" Heuristic match: "ronin-wallet@axieinfinity.com" Heuristic match: "webextension@metamask.io" Pattern match: "https://a.nel.cloudflare.com/report/v4" Heuristic match: "*cache.pm" Pattern match: "https://grow.moorway.icu/dfsmixxiso87233" Heuristic match: "\??\c:\users\.ne" Pattern match: "https://edge-mobile-static.azureedge.net/eccp/get?settenant=edge-config&setplatform=win&setmkt=en-us&setchannel=stable" Pattern match: "https://edge-cloud-resource-static.azureedge.net/consumer/ai-assistant/alpha/v1/static/js/realnameauth.9b5fc58a.js" Heuristic match: "sers\classic .ne" Pattern match: "www.youtube.com" Heuristic match: "wiyh.ge" Heuristic match: "'g.th" Heuristic match: "c*.eg" Heuristic match: "9b798172.sni.cloudflaressl.com" Pattern match: "www.msn.com-en-ca.lnk" Heuristic match: ":\users\hapubws\desktop\test.py" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=5gglcr0" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "test.py" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is"57:T42a6,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002500.00000000.167800.03490000.00000004.mdmp") Found URL "http://www.msftncsi.com/ncsi.txt:" - Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found URL "https://notepad-plus-plus.org/downloads/id_moreinfohttps://npp-user-manual.org/docs/upgrading/" - Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found URL "https://grantt.qumarox.icu/sdfkkiso87f1575b64-8492-4e8b-b102-4d26e8c70371fmhjnpmdlhokfidldlglfhkkfhjdmhgl" - Source: "00000000-00002500.00000002.170933.034E6000.00000004.mdmp") Found URL "https://*walx*.txp*btccrdownloadgdi32.dllmanifestcombase.dll(a)v\appdataminguserprofile=connection\dllhost.exesechost.dll4.0.2" - Source: "00000000-00002500.00000002.170933.03528000.00000004.mdmp") Found URL "https://grow.moorway.icu/dfsmixxiso87233*7c[lmem" - Source: "00000000-00002500.00000002.170933.03528000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4" - Source: "00000000-00002500.00000002.170933.03528000.00000004.mdmp") Found URL "http://host.exe.cmdappxwindirvmdktempclasspsm1msixvhdxweblocwoffwoff2partialevtxprofilemdmpcache-raytiffscssflaclesswebm.txtrootfault.lnk\??\\??\\??\\??\xynt\key1\??\\??\b\g3\keyb\g1defaultb\c13default.txtb\g1\0alt-svcb\g1\0dynamicdynamic-rayb\g1\0serverb\g1\.txtb\g1\b\g1\b\g1\browserb\g1\dynamicalt-svcb\g1\0cf-rayrvercf-rayb\c9\b\c9sion100.0namemetricsa_idversion1.30abledversionlegacyprofilelocalfault868222namephoenixdefaultpolicytricsersiongaia_idrsionprofile3868222350.0350.0350.050.0ia_id350.0defaultoutput350.0350.0350.0350.0350.0350.0350.0default350.0350.0350.0350.0350.0350.0metricsedgedefault350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0350.0\??\c:\users\.nejsers\classic" - Source: "00000000-00002500.00000002.170933.03528000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=5gglcr04hot\??\c:\users\hapubws\appdata\roaming\microsoft\windows\recent\cnpp5ha8kvlj.lnk\??\c:\users\hapubws\appdata\roaming\microsoft\windows\recent\system" - Source: "00000000-00002500.00000002.170933.03528000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00008020.00000001.172853.65838000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00008020.00000001.172853.65838000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00008020.00000001.172853.65838000.00000002.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcwashington1redmond1microsoft" - Source: "00000000-00008020.00000001.172853.691D0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00008020.00000001.172853.691D0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ex" - Source: "00000000-00008020.00000001.172853.691D0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00008020.00000001.172853.691D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00008020.00000001.172853.691D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00008020.00000001.172853.691D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00008020.00000001.172853.691D0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00008020.00000001.172853.691D0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;1uta9)i@7)i@negotiatenegoextendermicrosoft" - Source: "00000000-00008020.00000001.172853.691D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00008020.00000001.172853.691D0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00008020.00000001.172853.691D0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00008020.00000001.172853.691D0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00008020.00000001.172853.691D0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008020.00000001.172853.691D0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eeteris)2.5.4.3" - Source: "00000000-00008020.00000001.172853.691D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008020.00000001.172853.691D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3" - Source: "00000000-00008020.00000001.172853.691D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00008020.00000001.172853.691D0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00008020.00000001.172853.691D0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00008020.00000001.172853.691D0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00008020.00000001.172853.691D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008020.00000001.172853.691D0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00008020.00000001.172853.691D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008020.00000001.172853.691D0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportocalsettingoverridedisableearlylaunchantimalware:\programdata\microsoft\windows" - Source: "00000000-00008020.00000001.172853.69720000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008020.00000001.172853.69720000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsmti@mti@1.3.6.1.4.1.311.3.3.1mti@a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00008020.00000001.172853.69720000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008020.00000001.172853.69720000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008020.00000001.172853.69720000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008020.00000001.172853.69820000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microf-c5de1+0)" - Source: "00000000-00008020.00000001.172853.69820000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0pm" - Source: "00000000-00008020.00000001.172853.69820000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00008020.00000001.172853.69820000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt007z01(0&0p" - Source: "00000000-00008020.00000001.172853.69820000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00008020.00000001.172853.69820000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00008020.00000001.172853.69820000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00008020.00000001.172853.69820000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00008020.00000001.172853.69820000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008020.00000001.172853.69820000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00008020.00000001.172853.69820000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00008020.00000001.172853.85602000.00000002.mdmp")58:Tb5f,Found string "Forcing HTTP/1.1 for NTLM" (Indicator: "HTTP/1.1"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "HTTP/1.0 connection set to keep alive" (Indicator: "HTTP/1.0"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "HTTP/1.0 proxy connection set to keep alive" (Indicator: "HTTP/1.0"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "HTTP/1.1 proxy connection set close" (Indicator: "HTTP/1.1"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "server sent 101 response while not talking HTTP/1.1" (Indicator: "HTTP/1.1"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "installing subfilter for HTTP/1.0" (Indicator: "HTTP/1.0"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "installing subfilter for HTTP/1.1" (Indicator: "HTTP/1.1"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "Forcing HTTP/1.1 for NTLM" (Indicator: "HTTP/1.1"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "HTTP/1.0 connection set to keep alive" (Indicator: "HTTP/1.0"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "HTTP/1.0 proxy connection set to keep alive" (Indicator: "HTTP/1.0"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "HTTP/1.1 proxy connection set close" (Indicator: "HTTP/1.1"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "server sent 101 response while not talking HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "installing subfilter for HTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "installing subfilter for HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "BEoF-~_gW HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp") Found string "The redirected request keeps the same HTTP verb. HTTP/1.1 behavior." (Indicator: "HTTP/1.1"; Source: "00000000-00002500.00000001.169721.05880000.00000004.mdmp, 00000000-00002500.00000001.169721.05981000.00000020.mdmp, 00000000-00002500.00000002.170933.05880000.00000004.mdmp, 00000000-00002500.00000002.170933.7F080000.00000020.mdmp") Found string "6ed90-6b0e-41e4-b4b8-dee23cfba442 HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002500.00000002.170933.034E6000.00000004.mdmp")59:Tc61,Found string "# Netscape HTTP Cookie File# https://curl.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk." (Indicator: "libcurl"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support." (Indicator: "libcurl"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "# Your alt-svc cache. https://curl.se/docs/alt-svc.html# This file was generated by libcurl! Edit at your own risk." (Indicator: "libcurl"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "# Your HSTS cache. https://curl.se/docs/hsts.html# This file was generated by libcurl! Edit at your own risk." (Indicator: "libcurl"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision." (Indicator: "libcurl"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "A libcurl function was given a bad argument" (Indicator: "libcurl"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "An unknown option was passed in to libcurl" (Indicator: "libcurl"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "libcurl lacks IDN support" (Indicator: "libcurl"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "CLIENT libcurl 8.19.0MATCH %s %s %sQUIT" (Indicator: "libcurl"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "CLIENT libcurl 8.19.0DEFINE %s %sQUIT" (Indicator: "libcurl"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "CLIENT libcurl 8.19.0%sQUIT" (Indicator: "libcurl"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "# This file was generated by libcurl! Edit at your own risk." (Indicator: "libcurl"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support." (Indicator: "libcurl"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision." (Indicator: "libcurl"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "A libcurl function was given a bad argument" (Indicator: "libcurl"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "An unknown option was passed in to libcurl" (Indicator: "libcurl"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "libcurl lacks IDN support" (Indicator: "libcurl"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "CLIENT libcurl 8.19.0" (Indicator: "libcurl"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp")5a:Tc14,Found reference to API "GetDC" (Indicator: "GetDC"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002500.00000000.167800.03490000.00000004.mdmp, 00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002500.00000000.167800.03490000.00000004.mdmp, 00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002500.00000000.167800.03490000.00000004.mdmp, 00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002500.00000000.167800.03490000.00000004.mdmp, 00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002500.00000000.167800.03490000.00000004.mdmp, 00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002500.00000000.167800.03490000.00000004.mdmp, 00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002500.00000000.167800.03490000.00000004.mdmp, 00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002500.00000000.167800.03490000.00000004.mdmp, 00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp, 00000000-00002500.00000001.169721.05880000.00000004.mdmp, 00000000-00002500.00000002.170933.05880000.00000004.mdmp, 00000000-00002500.00000002.170933.059CC000.00000002.mdmp, 00000000-00002500.00000002.170933.7F080000.00000020.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002500.00000001.169721.05880000.00000004.mdmp, 00000000-00002500.00000002.170933.05880000.00000004.mdmp, 00000000-00002500.00000002.170933.059CC000.00000002.mdmp, 00000000-00002500.00000002.170933.7F080000.00000020.mdmp")5b:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00008020) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00008020) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00008020) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00008020) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00008020) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00008020) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00008020) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00008020) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00008020) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00008020) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00008020) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00008020) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00008020) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00008020) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00008020) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00008020) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00008020) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00008020) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00008020) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00008020)5c:Td4d,Found string "base64" (Indicator: "base64"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "CALG_3DES_112" (Indicator: "3des"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "CALG_3DES" (Indicator: "3des"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "CALG_AES_128" (Indicator: "aes"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "CALG_AES_192" (Indicator: "aes"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "CALG_AES_256" (Indicator: "aes"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "CALG_AES" (Indicator: "aes"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "CALG_ECDSA" (Indicator: "ecdsa"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "ecdsa-with-SHA1" (Indicator: "ecdsa"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "ecdsa-with-SHA224" (Indicator: "ecdsa"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "ecdsa-with-SHA256" (Indicator: "ecdsa"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "ecdsa-with-SHA384" (Indicator: "ecdsa"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "ecdsa-with-SHA512" (Indicator: "ecdsa"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string ".?AV?$basic_zip_cryptostream@DU?$char_traits@D@std@@@@" (Indicator: "cryptostream"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string ".?AV?$_Ref_count_obj2@V?$basic_zip_cryptostream@DU?$char_traits@D@std@@@@@std@@" (Indicator: "cryptostream"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") file/memory contains long string with (Indicator: "3des"; File: "AMSI") file/memory contains long string with (Indicator: "aes"; File: "AMSI") Found string ".?AV?$basic_zip_cryptostream@DU?$char_traits@D@std@@@@" (Indicator: "cryptostream"; Source: "00000000-00002500.00000000.167800.00D1A000.00000004.mdmp, 00000000-00002500.00000002.170933.00D1A000.00000004.mdmp") Found string ".?AV?$_Ref_count_obj2@V?$basic_zip_cryptostream@DU?$char_traits@D@std@@@@@std@@" (Indicator: "cryptostream"; Source: "00000000-00002500.00000000.167800.00D1A000.00000004.mdmp, 00000000-00002500.00000002.170933.00D1A000.00000004.mdmp") Found string "base64" (Indicator: "base64"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "CALG_3DES_112" (Indicator: "3des"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "CALG_3DES" (Indicator: "3des"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "CALG_AES_128" (Indicator: "aes"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "CALG_AES_192" (Indicator: "aes"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp")5d:T9c6,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp, 00000000-00002500.00000001.169721.05880000.00000004.mdmp, 00000000-00002500.00000002.170933.05880000.00000004.mdmp, 00000000-00002500.00000002.170933.059CC000.00000002.mdmp, 00000000-00002500.00000002.170933.7F080000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp, 00000000-00002500.00000001.169721.05880000.00000004.mdmp, 00000000-00002500.00000002.170933.05880000.00000004.mdmp, 00000000-00002500.00000002.170933.059CC000.00000002.mdmp, 00000000-00002500.00000002.170933.7F080000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp, 00000000-00002500.00000001.169721.05880000.00000004.mdmp, 00000000-00002500.00000002.170933.05880000.00000004.mdmp, 00000000-00002500.00000002.170933.059CC000.00000002.mdmp, 00000000-00002500.00000002.170933.7F080000.00000020.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp")5e:T45c,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp, 00000000-00002500.00000001.169721.05880000.00000004.mdmp, 00000000-00002500.00000002.170933.05880000.00000004.mdmp, 00000000-00002500.00000002.170933.059CC000.00000002.mdmp, 00000000-00002500.00000002.170933.7F080000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp")5f:T854,Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00002500.00000001.169721.05880000.00000004.mdmp, 00000000-00002500.00000002.170933.05880000.00000004.mdmp, 00000000-00002500.00000002.170933.059CC000.00000002.mdmp, 00000000-00002500.00000002.170933.7F080000.00000020.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00002500.00000001.169721.05880000.00000004.mdmp, 00000000-00002500.00000002.170933.05880000.00000004.mdmp, 00000000-00002500.00000002.170933.059CC000.00000002.mdmp, 00000000-00002500.00000002.170933.7F080000.00000020.mdmp")60:T779,Found string "password" (Indicator: "password"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "No password part in the URL" (Indicator: "password"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "Bad password" (Indicator: "password"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "schannel: Failed to import cert file %s, password is bad" (Indicator: "password"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "Excessive password length for proxy auth" (Indicator: "password"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "SASL: auth EXTERNAL not chosen with password" (Indicator: "password"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "password" (Indicator: "password"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "No password part in the URL" (Indicator: "password"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "Bad password" (Indicator: "password"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "schannel: Failed to import cert file %s, password is bad" (Indicator: "password"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "Excessive password length for proxy auth" (Indicator: "password"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "SASL: auth EXTERNAL not chosen with password" (Indicator: "password"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "*secret*" (Indicator: "secret"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.0351E000.00000004.mdmp")61:T467,"??\C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\Profiles\..\Application\thunderbird.exe" in Source: 00000000-00002500.00000001.169721.03490000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\Profiles" in Source: 00000000-00002500.00000001.169721.03490000.00000004.mdmp "\Roaming\Thunderbird\Profiles" in Source: 00000000-00002500.00000001.169721.03490000.00000004.mdmp 00000000-00002500.00000002.170933.03490000.00000004.mdmp "\Roaming\Opera Mail\Opera Mail" in Source: 00000000-00002500.00000001.169721.03490000.00000004.mdmp 00000000-00002500.00000002.170933.0351E000.00000004.mdmp "\??\C:\Users\.NET v4.5\AppData\Roaming\Thunderbird\Profiles" in Source: 00000000-00002500.00000001.169721.03490000.00000004.mdmp "\??\C:\Users\Default User\AppData\Roaming\Thunderbird\Profiles" in Source: 00000000-00002500.00000001.169721.03490000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\Profiles" in Source: 00000000-00002500.00000001.169721.03490000.00000004.mdmp "\??\C:\Users\Default\AppData\Roaming\Thunderbird\Profiles" in Source: 00000000-00002500.00000001.169721.03490000.00000004.mdmp62:T7a6,"Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\tor.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00002500.00000001.169721.03490000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\thunderbird.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00002500.00000001.169721.03490000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\blackhawk.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00002500.00000001.169721.03490000.00000004.mdmp "Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00002500.00000001.169721.03490000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002500.00000001.169721.03490000.00000004.mdmp 00000000-00002500.00000002.170933.03490000.00000004.mdmp 00000000-00002500.00000002.170933.034E6000.00000004.mdmp "\Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00002500.00000001.169721.03490000.00000004.mdmp 00000000-00002500.00000002.170933.03490000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00002500.00000001.169721.03490000.00000004.mdmp 00000000-00002500.00000002.170933.034E6000.00000004.mdmp "\Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\thunderbird.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00002500.00000001.169721.03490000.00000004.mdmp63:T500,Found string "[PAUSE] flushed %zu/%zu bytes, type=%x -> %d" (Indicator: "[pause]"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "[PAUSE] flushed 0/%zu bytes, type=%x -> %d" (Indicator: "[pause]"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "[PAUSE] writing %zu/%zu bytes of type %x -> %d" (Indicator: "[pause]"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "[PAUSE] buffer %zu more bytes of type %x, total=%zu -> %d" (Indicator: "[pause]"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "[PAUSE] flushed %zu/%zu bytes, type=%x -> %d" (Indicator: "[pause]"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "[PAUSE] flushed 0/%zu bytes, type=%x -> %d" (Indicator: "[pause]"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "[PAUSE] writing %zu/%zu bytes of type %x -> %d" (Indicator: "[pause]"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "[PAUSE] buffer %zu more bytes of type %x, total=%zu -> %d" (Indicator: "[pause]"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp")64:Tfbf,Found string "Hostname in DNS cache was stale, zapped" (Indicator: "hostname"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "Hostname in DNS cache does not have needed family, zapped" (Indicator: "hostname"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "Hostname %s was found in DNS cache" (Indicator: "hostname"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "Hostname '%s' was found in DNS cache" (Indicator: "hostname"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "Too long hostname (maximum is %d)" (Indicator: "hostname"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "Could not resolve hostname" (Indicator: "hostname"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "Bad hostname" (Indicator: "hostname"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "[WS] invalid fragmented PING frame" (Indicator: "ping"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "[WS] PING frame must not be fragmented" (Indicator: "ping"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "[WS] received PING frame is too big" (Indicator: "ping"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "[WS] given PING frame is too big" (Indicator: "ping"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "mqtt_ping: sent ping request." (Indicator: "ping"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "Received ping response." (Indicator: "ping"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "SOCKS4: too long hostname" (Indicator: "hostname"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "SOCKS5: the destination hostname is too long to be resolved remotely by the proxy." (Indicator: "hostname"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "aws-sigv4: service missing in parameters and hostname" (Indicator: "hostname"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "aws-sigv4: region missing in parameters and hostname" (Indicator: "hostname"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "schannel: connection hostname (%s) matched cert's IP address!" (Indicator: "hostname"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "schannel: connection hostname (%s) validated against certificate name (%s)" (Indicator: "hostname"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "schannel: connection hostname (%s) did not match against certificate name (%s)" (Indicator: "hostname"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names" (Indicator: "hostname"; File: "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin") Found string "Hostname in DNS cache was stale, zapped" (Indicator: "hostname"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "Hostname in DNS cache does not have needed family, zapped" (Indicator: "hostname"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "Hostname %s was found in DNS cache" (Indicator: "hostname"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp") Found string "Hostname '%s' was found in DNS cache" (Indicator: "hostname"; Source: "00000000-00002500.00000001.169721.00CEC000.00000002.mdmp")65:T1aeb,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002500.00000000.167800.03490000.00000004.mdmp, 00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\device\harddiskvolume2\windows\system32\en-us\bthprops.cpl.mui" (Indicator: "\Device\"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\device\harddiskvolume2\windows\systemapps\microsoft.windows.cortana_cw5n1h2txyewy\assets\hcblack_cortana_traysearchbox_glyph_100.png" (Indicator: "\Device\"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "System32\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03528000.00000004.mdmp") Found string "System32\drivers\etc\hosts" (Indicator: "system32\drivers"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03528000.00000004.mdmp") Found string "\device\harddiskvolume2\windows\registration\r00000000001e.clb" (Indicator: "\Device\"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.05F70000.00000004.mdmp") Found string "\device\harddiskvolume2\windows\system32\en-us\datamap.0409.dat" (Indicator: "\Device\"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\device\harddiskvolume2\windows\system32\en-us\ctfmon.exe.mui" (Indicator: "\Device\"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\device\harddiskvolume2\windows\system32\en-us\esent.dll.mui" (Indicator: "\Device\"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\??\C:\Windows\System32\drivers\kneps.sys" (Indicator: "\drivers\"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\??\C:\Windows\System32\drivers\kneps.sys" (Indicator: "system32\drivers"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\??\C:\Windows\System32\drivers\klif.sys" (Indicator: "\drivers\"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\??\C:\Windows\System32\drivers\klif.sys" (Indicator: "system32\drivers"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\??\C:\Windows\System32\drivers\kldisk.sys" (Indicator: "\drivers\"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\??\C:\Windows\System32\drivers\kldisk.sys" (Indicator: "system32\drivers"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\??\C:\Windows\System32\drivers\klhk.sys" (Indicator: "\drivers\"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\??\C:\Windows\System32\drivers\klhk.sys" (Indicator: "system32\drivers"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\device\harddiskvolume2\windows\fonts\segoeuisl.ttf" (Indicator: "\Device\"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\device\harddiskvolume2\windows\fonts\segoeuil.ttf" (Indicator: "\Device\"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\device\harddiskvolume2\program files\microsoft office" (Indicator: "\Device\"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\device\harddiskvolume2\windows\fonts\segoeui.ttf" (Indicator: "\Device\"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\device\harddiskvolume2\program files (x86)\adobe" (Indicator: "\Device\"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\device\harddiskvolume2\windows\fonts\segoeuib.ttf" (Indicator: "\Device\"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\device\harddiskvolume2\windows\fonts\staticcache.dat" (Indicator: "\Device\"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\device\harddiskvolume2\windows\fonts\seguisb.ttf" (Indicator: "\Device\"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\device\harddiskvolume2\windows\fonts\segmdl2.ttf" (Indicator: "\Device\"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\device\harddiskvolume2\windows\system32\winmetadata\windows.ui.xaml.winmd" (Indicator: "\Device\"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\device\harddiskvolume2\windows\system32\winmetadata\windows.system.winmd" (Indicator: "\Device\"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\device\harddiskvolume2\windows\system32\winmetadata\windows.storage.winmd" (Indicator: "\Device\"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp") Found string "\device\harddiskvolume2\windows\system32\winmetadata\windows.foundation.winmd" (Indicator: "\Device\"; Source: "00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp")66:T850,Observed string: "Shutdown send direction error: %d. Broken server? Proceeding as if everything is ok." (Indicator: "shutdown ") in Source: b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin Observed string: "shutdown and remove SSL, start" (Indicator: "shutdown ") in Source: b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin Observed string: "shutdown and remove SSL, done -> %d" (Indicator: "shutdown ") in Source: b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin Observed string: "shutdown timeout" (Indicator: "shutdown ") in Source: b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin Observed string: "SHUTDOWN" (Indicator: "shutdown") in Source: b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin Observed string: "shutdown start on%s connection" (Indicator: "shutdown ") in Source: b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin Observed string: "shutdown -> %d, done=%d" (Indicator: "shutdown ") in Source: b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin Observed string: "Shutdown send direction error: %d. Broken server? Proceeding as if everything is ok." (Indicator: "shutdown ") in Source: 00000000-00002500.00000001.169721.00CEC000.00000002.mdmp Observed string: "shutdown and remove SSL, start" (Indicator: "shutdown ") in Source: 00000000-00002500.00000001.169721.00CEC000.00000002.mdmp Observed string: "shutdown and remove SSL, done -> %d" (Indicator: "shutdown ") in Source: 00000000-00002500.00000001.169721.00CEC000.00000002.mdmp Observed string: "shutdown timeout" (Indicator: "shutdown ") in Source: 00000000-00002500.00000001.169721.00CEC000.00000002.mdmp Observed string: "SHUTDOWN" (Indicator: "shutdown") in Source: 00000000-00002500.00000001.169721.00CEC000.00000002.mdmp Observed string: "shutdown start on%s connection" (Indicator: "shutdown ") in Source: 00000000-00002500.00000001.169721.00CEC000.00000002.mdmp Observed string: "shutdown -> %d, done=%d" (Indicator: "shutdown ") in Source: 00000000-00002500.00000001.169721.00CEC000.00000002.mdmp67:Tbbe,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002500.00000000.167800.03490000.00000004.mdmp, 00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$29","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002500.00000001.169721.05880000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002500.00000002.170933.05880000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002500.00000002.170933.7F080000.00000020.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2c","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 44662-9458-004B27ED","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; File: \"b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00002500.00000001.169721.00CEC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; File: \"b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; File: \"b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin\")\n Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; File: \"b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin\")\n Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00002500.00000001.169721.00CEC000.00000002.mdmp\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00002500.00000001.169721.00CEC000.00000002.mdmp\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00002500.00000001.169721.00CEC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; File: \"b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin\")\n Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; File: \"b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin\")\n Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; File: \"b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin\")\n Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00002500.00000001.169721.00CEC000.00000002.mdmp\")\n Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00002500.00000001.169721.00CEC000.00000002.mdmp\")\n Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00002500.00000001.169721.00CEC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; File: \"b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin\")\n Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00002500.00000001.169721.00CEC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$31","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Cryptographic Related","name":"Detected XOR operators (encryption/decryption)","description":"file/memory contains long string with (Indicator: \"-xor \"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$32","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Detected XOR operators (encryption/decryption)\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$33","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Detected XOR operators (encryption/decryption)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$34","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"www.youtube.com\" (Indicator: \"youtube.com\"; Source: \"00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03528000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008020-00000C2C-1669660663\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008020-00000C2C-1670419436\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"ystem.Identity.QualifiedUserName\" (Source: \"00000000-00002500.00000002.170933.05B30000.00000002.mdmp\")\n Found string \"ystem.Identity.UserName\" (Source: \"00000000-00002500.00000002.170933.05B30000.00000002.mdmp\")\n Found string \"ystem.UserName\" (Source: \"00000000-00002500.00000002.170933.05B30000.00000002.mdmp\")\n Found string \"System.Identity.UserName\" (Source: \"00000000-00002500.00000002.170933.06070000.00000002.mdmp\")\n Found string \"System.Identity.QualifiedUserName\" (Source: \"00000000-00002500.00000002.170933.06070000.00000002.mdmp\")\n Found string \"System.UserName\" (Source: \"00000000-00002500.00000002.170933.06070000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008020-00000C2C-1669660663\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008020-00000C2C-1670419436\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002500.00000001.169721.00CEC000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002500.00000001.169721.00CEC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using web history","description":"Found string \"formhistory.sqlite\" (Source: \"00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03528000.00000004.mdmp\")\n Found string \"places.sqlite\" (Source: \"00000000-00002500.00000001.169721.03490000.00000004.mdmp\")\n Found string \"efox\\Profiles\\ywzu7870.default\\formhistory.sqlite\" (Source: \"00000000-00002500.00000002.170933.03528000.00000004.mdmp\")\n Found string \"b/g1/0/formhistory.sqlite\" (Source: \"00000000-00002500.00000002.170933.03528000.00000004.mdmp\")\n Found string \"\\formhistory.sqlite\" (Source: \"00000000-00002500.00000002.170933.05F70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-662","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.034E6000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"Found string \"\\device\\vmci\" (Indicator: \"\\vmci\"; Source: \"00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03528000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment devices","description":"Found string \"\\device\\vmci\" (Indicator: \"\\vmci\"; Source: \"00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03528000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-667","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00008020-00000C2C-1667793257\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00008020-00000C2C-1667793815\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00008020-00000C2C-1672583447\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00008020-00000C2C-1672583470\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"Found string \"b/c8/0/Cookies\" (Indicator: \"/cookies\"; Source: \"00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03528000.00000004.mdmp, 00000000-00002500.00000002.170933.05F70000.00000004.mdmp\")\n Found string \"cookies.sqlite\" (Indicator: \"cookies.sqlite\"; Source: \"00000000-00002500.00000001.169721.03490000.00000004.mdmp, 00000000-00002500.00000002.170933.03528000.00000004.mdmp\")\n Found string \"\\cookies.sqlite\" (Indicator: \"cookies.sqlite\"; Source: \"00000000-00002500.00000002.170933.03528000.00000004.mdmp\")\n Found string \"b/c8/0/CookiesPK\" (Indicator: \"/cookies\"; Source: \"00000000-00002500.00000002.170933.05F70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin\")\n Found reference to API \"getaddrinfo() thread failed to start\" (Indicator: \"getaddrinfo\"; File: \"b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin\")\n Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00008020-00000C2C-1676918057\")\n Found reference to API \"getaddrinfo() thread failed to start\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002500.00000001.169721.00CEC000.00000002.mdmp\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002500.00000001.169721.00CEC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in file \"b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00002500.00000001.169721.00CEC000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00002500.00000001.169721.00CEC000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00008020)\n \"powershell.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00008020)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"powershell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00008020)\n \"powershell.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00008020)\n \"powershell.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00008020)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"powershell.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00008020)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Calls APIs used for find file/directory path","description":"Observed import api PathFindFileName (Source: b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-183","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"8020\" - (UID: 00000000-00008020)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00008020)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008020)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$38","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c004d006900630072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00008020)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00008020)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00008020)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00008020)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains a Wine emulator-related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\"; File: \"b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin\")\n \"wine_get_version\" (Indicator: \"wine_get_version\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":5,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002500.00000001.169721.05880000.00000004.mdmp, 00000000-00002500.00000002.170933.05880000.00000004.mdmp, 00000000-00002500.00000002.170933.059CC000.00000002.mdmp, 00000000-00002500.00000002.170933.7F080000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExW@KERNEL32.dll at 44662-5078-004D0F57","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeW@KERNEL32.dll at 44662-4166-004C29ED\n GetDriveTypeW@KERNEL32.dll at 44662-4179-004CE517","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3.bin\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00002500.00000001.169721.00CEC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 44662-3171-004C07DC\n FileTimeToSystemTime@KERNEL32.dll at 44662-3954-004C25C6\n GetSystemTimeAsFileTime@KERNEL32.dll at 44662-4805-0041B6D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 44662-3171-004C07DC\n GetLocalTime@KERNEL32.dll at 44662-4558-0040C930\n GetSystemTimeAsFileTime@KERNEL32.dll at 44662-4805-0041B6D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 44662-5124-004D02F6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.dll at 44662-5140-004D3B27\n GetLocaleInfoW@KERNEL32.dll at 44662-5141-004D3FA4\n GetLocaleInfoW@KERNEL32.dll at 44662-5142-004D3D7B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\" Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69ebe7a7e8fdec0dba0305ab"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"