21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 39:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4cb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.Zard.Generic Sample bb77ef06de83… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample bb77ef06de83…. Malware family: Mint.Zard.Generic. Threat score 100/100. 14/26 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/bb77ef06de83dc5e450572c04f69224c44786bda5eadc9e7a698dc4ef1445edf","keywords":["Malicious","Mint.Zard.Generic","malware analysis","sandbox report","threat intelligence","bb77ef06de83dc5e450572c04f69224c44786bda5eadc9e7a698dc4ef1445edf"],"about":{"@type":"SoftwareApplication","name":"bb77ef06de83dc5e450572c04f69224c44786bda5eadc9e7a698dc4ef1445edf.bin","applicationCategory":["peexe","executable"],"identifier":"bb77ef06de83dc5e450572c04f69224c44786bda5eadc9e7a698dc4ef1445edf","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mint.Zard.Generic","antivirusDetections":{"malicious":14,"total":26},"behavioralIndicators":{"malicious":4,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T775," HTTP/1.1 200 OK Date: Fri 22 May 2026 13:16:09 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=hfHL8j2snrvos6oqsCVlAPFzhtR0C.qWowbhVodmb7Y-1779455769.4864926-1.0.1.1-tHzH7EZObHv4n8M55Z4q5AqXixJkdiIvkDy.iPJahJbra..v.sVHzoXlImnIo7bbSdORGOqXKDpyZ8EZ_Lr_619zySWNtWonqTOlNNo1ccZtdxoU4wYjgonAmgzK79z7; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Fri 22 May 2026 13:46:09 GMT Server: cloudflare CF-RAY: 9ffc17ff4b489100-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /14/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 22 May 2026 13:16:09 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Fri 22 May 2026 13:13:56 GMT Connection: keep-alive ETag: "6a105694-6" Accept-Ranges: bytes with response body ==>32313634310A....... "GET /14/10107.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 22 May 2026 13:16:10 GMT Content-Type: text/plain Content-Length: 258708 Last-Modified: Wed 20 May 2026 05:07:15 GMT Connection: keep-alive ETag: "6a0d4183-3f294" Accept-Ranges: bytes with response body ==>686F6F2E636F6D3A6377346C69666532350A616E6A6275636B407961686F6F2E636F6D3A636F776769726C310A616E6A62757A6C647A6E67406D61696C2E636F....... "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2 Host: trc.taboola.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Date: Fri 22 May 2026 13:18:37 GMT Server: nginx X-Service-Version: v1 X-Served-By: cache-lax-kwhp1940146-LAX P3p: policyref="http://trc.taboola.com/p3p.xml" CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" Pragma: no-cache X-Cache-Hits: 0 Via: 1.1 varnish Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true X-Fastly-To-Nlb-Rtt: 66944 X-Timer: S1779455918.909950 VS0 VE69 X-Cache: MISS X-Vcl-Time-Ms: 69 Cache-Control: no-cache no-store Accept-Ranges: bytes with response body ==>BINARY_CONTENT....... "GET /mouse-gesture/config.json HTTP/2 Host: edge-consumer-static.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json Date: Fri 22 May 2026 13:18:39 GMT X-Azure-Ref: 20260522T131839Z-r1756c5b4887knfnhC1SJCcw7w0000000x1g00000000206c X-Ms-Version: 2009-09-19 X-Ms-Lease-Status: unlocked X-Ms-Blob-Type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id Server x-ms-version Content-Type ETag Last-Modified x-ms-lease-status x-ms-blob-type Content-Length Date Transfer-Encoding Access-Control-Allow-Origin: * Last-Modified: Tue 24 Oct 2023 08:27:00 GMT X-Fd-Int-Roxy-Purgeid: 83583309 Etag: 0x8DBD46AFE482320 X-Cache: TCP_HIT Cache-Control: public max-age=432000 Accept-Ranges: bytes X-Ms-Request-Id: 4dbd7ae9-d01e-0021-49dc-e4960c000000 with no response body "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2 Host: px.ads.linkedin.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Fri 22 May 2026 13:18:39 GMT Set-Cookie: lidc="b=OGST08:s=O:r=O:a=O:p=O:g=3433:u=1:x=1:i=1779455919:t=1779542319:v=2:sig=AQEJRbhSyN_MX0WC4e_CBEHMVjLEFOtN"; Expires=Sat 23 May 2026 13:18:39 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure X-Li-Uuid: AAZSZ93+pJfeMENSRRCRwA== X-Li-Fabric: prod-lor1 X-Msedge-Ref: Ref A: EB408C5B194C46D4A7654B66F9F8E41C Ref B: BY1AA1072317062 Ref C: 2026-05-22T13:18:39Z Vary: Accept-Encoding X-Li-Proto: http/2 Content-Encoding: gzip X-Li-Pop: afd-prod-lor1-x X-Cache: CONFIG_NOCACHE Alt-Svc: h3=":443"; ma=86400 Linkedin-Action: 1 with response body ==>BINARY_CONTENT....... "GET /mapuid?member=280&user=32DFF8A43A9F6A9B15B5EE573B1A6B37;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D32DFF8A43A9F6A9B15B5EE573B1A6B37%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 307 Temporary Redirect Content-Type: text/html; charset=utf-8 Date: Fri 22 May 2026 13:18:40 GMT Server: nginx/1.25.5 Set-Cookie: uuid2=6691397968764937997; SameSite=None; Path=/; Max-Age=7776000; Expires=Thu 20-Aug-2026 13:18:40 GMT; Domain=.adnxs.com; Secure; HttpOnly Expires: Sat 15 Nov 2008 16:00:00 GMT X-Xss-Protection: 0 An-X-Request-Uuid: 79e4bfc6-2004-4e9c-b257-519add0745f5 X-Proxy-Origin: 64.124.12.162; 64.124.12.162; 906.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; *.adnxs.com Location: https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D32DFF8A43A9F6A9B15B5EE573B1A6B37%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D32DFF8A43A9F6A9B15B5EE573B1A6B37%252526gdpr%25253D0%252526gdpr_consent%25253D Cache-Control: no-store no-cache private P3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml" CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Pragma: no-cache Accept-Ch: Sec-CH-UA-Full-Version-List Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Bitness with no response body18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":["suspicious"],"file_activity":{"dropped_files":[],"extracted_files":[{"name":"97753130914204.jpg","sha256":"2729685aa53bba74ccd9864fb1d244ad22bc54dedcea27272b580b8fd911bbe8","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"verdict":"undetected"},{"name":"J5CT9QT2.txt","sha256":"77017dda5e099abf5c1dce1672f7d4b9b0a0ca3f9e324258d73525041c948d7c","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"verdict":"undetected"},{"name":"10107_1_.txt","sha256":"2729685aa53bba74ccd9864fb1d244ad22bc54dedcea27272b580b8fd911bbe8","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"verdict":"undetected"},{"name":"n_1_.txt","sha256":"d98649681ba0f5618dceb7679358bb520fd2c072cf9e916a4c5d0879f84585c2","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\J5CT9QT2.txt","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\n[1].txt","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\10107[1].txt","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"path":"%TEMP%\\97753130914204.jpg","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6972:168:WilStaging_02","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6972:168:WilStaging_02","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"name":"efaefaef","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"name":"SM0:6972:64:WilError_01","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"name":"Local\\SM0:6972:168:WilStaging_02","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\efaefaef","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6972:64:WilError_01","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"name":"SM0:6972:168:WilStaging_02","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[{"address":"98.136.96.77","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"212.27.48.7","country":"France","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"213.205.33.61","country":"Italy","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"47.43.18.9","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"116.133.8.85","country":"China","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"135.125.7.163","country":"France","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"104.254.150.241","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"65.20.50.207","country":"United Kingdom","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"74.208.5.22","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"106.10.248.73","country":"Singapore","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"96.103.145.162","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"195.121.65.158","country":"Netherlands","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"67.195.228.94","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"104.16.185.241","port":80,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"130.12.180.190","country":"United States","port":80,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"96.103.145.163","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"67.195.228.106","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"67.195.204.72","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"184.25.113.156","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"213.209.1.130","country":"Italy","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"66.179.105.18","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"34.90.152.141","country":"Netherlands","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"212.227.15.41","country":"Germany","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"168.0.133.10","country":"Brazil","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"129.159.105.98","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"213.209.1.129","country":"Italy","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"91.136.24.11","country":"Canada","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"188.125.72.73","country":"Ireland","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"203.69.82.103","country":"Taiwan","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"91.136.8.163","country":"Canada","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"193.201.172.119","country":"Bulgaria","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"99.84.160.24","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"194.97.208.35","country":"Germany","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"201.7.188.133","country":"Brazil","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"194.25.134.72","country":"Germany","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"98.136.96.75","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"52.101.68.5","country":"Ireland","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"2.207.151.53","country":"Germany","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"17.57.155.25","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"67.195.204.74","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"80.12.24.83","country":"France","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"160.92.124.66","country":"France","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"84.116.6.18","country":"Netherlands","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"34.149.254.5","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"159.69.47.32","country":"Germany","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"52.101.68.28","country":"Ireland","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"212.227.15.10","country":"Germany","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"98.136.96.93","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"67.195.228.110","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"67.195.204.73","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"172.253.116.27","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"67.195.204.80","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"98.136.96.76","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"67.195.228.84","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"20.157.67.142","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"47.43.26.7","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"52.101.73.5","country":"Netherlands","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"17.57.156.30","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"80.249.132.52","country":"Netherlands","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"157.245.75.88","country":"Netherlands","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"200.147.41.201","country":"Brazil","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"93.17.128.165","country":"France","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"80.12.26.32","country":"France","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"52.101.68.20","country":"Ireland","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"17.57.152.5","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"185.205.70.129","country":"France","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"212.27.42.59","country":"France","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"74.208.5.20","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"2.207.217.30","country":"Germany","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"34.226.24.72","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"52.101.73.152","country":"Netherlands","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"188.125.72.74","country":"Ireland","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"205.220.177.26","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"67.195.204.77","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"98.136.96.74","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"13.107.226.51","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"34.141.161.132","country":"Netherlands","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"194.158.98.50","country":"France","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"195.130.132.8","country":"Belgium","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"67.195.228.109","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"62.48.65.24","country":"Germany","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"216.163.190.10","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"213.180.147.146","country":"Poland","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"98.136.96.91","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"151.101.65.44","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"108.177.123.27","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"17.42.251.62","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"98.138.3.192","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"200.147.41.231","country":"Brazil","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"194.19.134.70","country":"Denmark","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"149.13.75.27","country":"Germany","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"67.195.228.111","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"150.171.22.12","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"212.227.17.8","country":"Germany","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"135.125.7.164","country":"France","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"67.195.204.75","country":"United States","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"193.203.239.38","country":"France","port":25,"protocol":"TCP","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]}],"dns_resolutions":[{"country":"-","domain":"comcast.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":12},{"address":"213.205.33.61","country":"Italy","domain":"etb-1.mail.tiscali.it","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":401},{"address":"67.195.228.94","country":"United States","domain":"mta6.am0.yahoodns.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":1},{"address":"106.10.248.73","country":"Singapore","domain":"mx-apac.mail.gm0.yahoodns.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":47},{"address":"84.116.6.18","country":"Netherlands","domain":"mxin5.virginmedia.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":7052},{"address":"150.171.27.10","country":"United States","domain":"r.msftstatic.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":3571},{"address":"213.209.1.129","country":"Italy","domain":"smtp-in.libero.it","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":21057},{"country":"-","domain":"tim.it","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":1640},{"country":"-","domain":"libertysurf.fr","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":300},{"country":"-","domain":"lycos.de","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"47.43.18.9","country":"United States","domain":"mx0.charter.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":14022},{"address":"74.208.5.22","country":"United States","domain":"mx01.mail.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":604},{"address":"194.25.134.72","country":"Germany","domain":"mx01.t-online.de","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":11636},{"country":"-","domain":"btinternet.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":288},{"country":"-","domain":"hotmil.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":959},{"address":"62.48.65.24","country":"Germany","domain":"mgw01.net.de","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":600},{"address":"98.136.96.77","country":"United States","domain":"mta5.am0.yahoodns.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":25},{"address":"168.0.133.10","country":"Brazil","domain":"mx-ha.skymail.net.br","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":2721},{"address":"194.158.98.50","country":"France","domain":"mx.bbox.fr","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":840},{"address":"2.207.217.30","country":"Germany","domain":"mx5.vodafonemail.de","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":255},{"country":"-","domain":"yahoo.com.au","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":1503},{"country":"-","domain":"club-internet.fr","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":1749},{"country":"-","domain":"excite.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":21410},{"address":"65.20.50.207","country":"United Kingdom","domain":"mx.bt.prod.cloud.openwave.ai","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":1288},{"country":"-","domain":"indeedemail.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":6269},{"country":"-","domain":"mail.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":304},{"address":"91.136.8.163","country":"Canada","domain":"mx2c51.megamailservers.eu","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":28},{"address":"2.207.151.53","country":"Germany","domain":"mx3.vodafonemail.de","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":419},{"country":"-","domain":"sbcglobal.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":2915},{"country":"-","domain":"aliceadsl.fr","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":4833},{"country":"-","domain":"counsellor.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":20444},{"country":"-","domain":"free.fr","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":21325},{"country":"-","domain":"ive.de","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":3153},{"address":"185.205.70.129","country":"France","domain":"mailsec.protonmail.ch","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":1007},{"address":"200.147.41.231","country":"Brazil","domain":"mx.uol.com.br","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":520},{"country":"-","domain":"realschule-verden.de","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":3600},{"country":"-","domain":"san.rr.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":14004},{"country":"-","domain":"mail.bg","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":8850},{"country":"-","domain":"neuf.fr","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":21588},{"country":"-","domain":"online.no","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":174},{"address":"150.171.22.12","country":"United States","domain":"px.ads.linkedin.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":3478},{"country":"-","domain":"tele.nl","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":3600},{"country":"-","domain":"ymail.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":382},{"address":"135.125.7.164","country":"France","domain":"mx004.tt.xion.oxcs.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":51},{"country":"-","domain":"telenet.be","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":12966},{"address":"151.101.65.44","country":"United States","domain":"trc.taboola.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":467},{"country":"-","domain":"windstream.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":290},{"address":"172.253.116.27","country":"United States","domain":"alt2.aspmx.l.google.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":293},{"country":"-","domain":"att.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":1775},{"address":"98.138.3.192","country":"United States","domain":"mx-att.mail.am0.yahoodns.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":149},{"address":"203.69.82.103","country":"Taiwan","domain":"mx.seed.net.tw","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":60},{"address":"20.157.67.142","country":"United States","domain":"mx.terra.com.br","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":11},{"address":"212.227.15.10","country":"Germany","domain":"mx00.gmx.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":421},{"address":"91.136.24.11","country":"Canada","domain":"mx1c60.megamailservers.eu","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":206},{"address":"47.43.26.7","country":"United States","domain":"pkvw-mx.msg.pkvw.co.charter.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":14234},{"address":"149.13.75.27","country":"Germany","domain":"mx10.se.isp-net.nl","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":233},{"address":"17.42.251.62","country":"United States","domain":"mx3.mail.icloud.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":2539},{"country":"-","domain":"net.de","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":600},{"country":"-","domain":"t-online.de","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":3721},{"country":"-","domain":"tin.it","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":2649},{"country":"-","domain":"virgilio.it","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":17141},{"country":"-","domain":"web.de","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":5246},{"country":"-","domain":"yahoo.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":1493},{"country":"-","domain":"blueyonder.co.uk","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":862},{"country":"-","domain":"centurylink.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":119},{"address":"34.141.161.132","country":"Netherlands","domain":"mx.tim.it","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":143},{"address":"74.208.5.20","country":"United States","domain":"mx00.mail.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":822},{"address":"205.220.177.26","country":"United States","domain":"mxb-00069f01.gslb.pphosted.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":2},{"country":"-","domain":"op.pl","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":15004},{"country":"-","domain":"orange.fr","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":255},{"country":"-","domain":"tele2.nl","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":8},{"country":"-","domain":"arcor.de","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":39},{"country":"-","domain":"dika-menuiseries.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":3600},{"address":"212.227.17.8","country":"Germany","domain":"mx-ha02.web.de","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":4449},{"address":"106.10.248.73","country":"Singapore","domain":"mx-tw.mail.gm0.yahoodns.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":14},{"address":"66.179.105.18","country":"United States","domain":"mx.altice.prod.cloud.openwave.ai","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":30},{"address":"212.27.42.59","country":"France","domain":"mx2.free.fr","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":909},{"country":"-","domain":"voila.fr","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":2481},{"country":"-","domain":"yahoo.de","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":1686},{"country":"-","domain":"live.nl","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":1288},{"country":"-","domain":"maarse.demon.nl","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":3600},{"address":"67.195.204.80","country":"United States","domain":"mx-aol.mail.gm0.yahoodns.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":25},{"address":"34.226.24.72","country":"United States","domain":"mx1.buckeyecom.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":10030},{"address":"159.69.47.32","country":"Germany","domain":"offline.iserv.eu","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":649},{"country":"-","domain":"uol.com.br","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":14300},{"country":"-","domain":"yahoo.fr","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":1402},{"country":"-","domain":"yahoo.it","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":1577},{"address":"108.177.123.27","country":"United States","domain":"alt1.aspmx.l.google.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":293},{"country":"-","domain":"bol.com.br","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":315},{"country":"-","domain":"freenet.de","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":206},{"address":"34.90.152.141","country":"Netherlands","domain":"mx.tin.it","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":21298},{"country":"-","domain":"sina.com.cn","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":600},{"country":"-","domain":"twc.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":7339},{"country":"-","domain":"yahoomail.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":6118},{"country":"-","domain":"email.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":17360},{"address":"116.133.8.85","country":"China","domain":"freemx2.sinamail.sina.com.cn","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":60},{"country":"-","domain":"mahn-de.de","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":3600},{"country":"-","domain":"me.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":2206},{"address":"84.116.6.18","country":"Netherlands","domain":"mxin10.virginmedia.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":17384},{"country":"-","domain":"icloud.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":3434},{"address":"135.125.7.163","country":"France","domain":"mx003.tt.xion.oxcs.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":140},{"country":"-","domain":"pdx.edu","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":21600},{"country":"-","domain":"sfr.fr","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":686},{"address":"213.209.1.130","country":"Italy","domain":"smtp-in.virgilio.it","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":20957},{"country":"-","domain":"tiscali.co.uk","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":130},{"address":"52.101.68.5","country":"Ireland","domain":"villenice-fr01c.mail.protection.outlook.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":10},{"country":"-","domain":"caramail.fr","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":20218},{"country":"-","domain":"frontier.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":3171},{"address":"104.16.185.241","country":"-","domain":"icanhazip.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":34},{"country":"-","domain":"libero.it","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":7074},{"address":"213.180.147.146","country":"Poland","domain":"mx.poczta.onet.pl","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":38},{"country":"-","domain":"aol.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":1324},{"country":"-","domain":"cox.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":2887},{"country":"-","domain":"embarqmail.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":155},{"address":"17.57.155.25","country":"United States","domain":"mx01.mail.icloud.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":277},{"address":"34.149.254.5","country":"United States","domain":"mxa.mailgun.org","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":145},{"country":"-","domain":"ntlworld.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":900},{"address":"80.12.24.83","country":"France","domain":"smtp-in2.orange.fr","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":1759},{"country":"-","domain":"email.it","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":243},{"address":"52.101.73.152","country":"Netherlands","domain":"eur.olc.protection.outlook.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":1},{"country":"-","domain":"laposte.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":6917},{"address":"193.203.239.38","country":"France","domain":"mail.dika-menuiseries.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":21600},{"address":"104.254.150.241","country":"United States","domain":"m.adnxs.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":16450},{"address":"195.130.132.8","country":"Belgium","domain":"mx1.telenet-ops.be","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":18000},{"country":"-","domain":"yahoo.com.br","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":1700},{"country":"-","domain":"bellsouth.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":5897},{"country":"-","domain":"suddenlink.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":70},{"country":"-","domain":"ownit.nu","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":16745},{"country":"-","domain":"virginmedia.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":284},{"country":"-","domain":"yahoo.com.hk","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":1342},{"country":"-","domain":"yahoo.com.tw","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":1654},{"country":"-","domain":"yahooo.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":7200},{"address":"96.103.145.162","country":"United States","domain":"mx2a1.comcast.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":3963},{"country":"-","domain":"seed.net.tw","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":600},{"address":"93.17.128.165","country":"France","domain":"smtp-in.sfr.fr","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":808},{"country":"-","domain":"telus.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":155},{"country":"-","domain":"frontiernet.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":606},{"address":"212.227.15.41","country":"Germany","domain":"mx00.ionos.de","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":6962},{"country":"-","domain":"optonline.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":16},{"address":"216.163.190.10","country":"United States","domain":"publicms2.mail2world.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":300},{"country":"-","domain":"bbox.fr","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":271},{"country":"-","domain":"emial.de","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"address":"80.249.132.52","country":"Netherlands","domain":"spamfilter1.site.eu","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":3600},{"country":"-","domain":"verizon.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":257},{"country":"-","domain":"ville-nice.fr","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":59},{"country":"-","domain":"charter.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":8976},{"country":"-","domain":"globo.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":3566},{"country":"-","domain":"live.se","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":3600},{"address":"17.57.155.25","country":"United States","domain":"mx02.mail.icloud.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":24},{"address":"200.147.41.201","country":"Brazil","domain":"mx3.bol.com.br","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":2052},{"address":"80.12.26.32","country":"France","domain":"smtp-in.orange.fr","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":284},{"country":"-","domain":"yahoo.com.vn","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":7},{"country":"-","domain":"buckeye-express.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":7365},{"country":"-","domain":"mac.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":3486},{"address":"157.245.75.88","country":"Netherlands","domain":"mail.yaxmail.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":300},{"address":"129.159.105.98","country":"United States","domain":"mx01.windstream.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":300},{"address":"96.103.145.163","country":"United States","domain":"mx1a1.comcast.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":492},{"address":"201.7.188.133","country":"Brazil","domain":"smtp.globo.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":60},{"country":"-","domain":"tiscali.it","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":4441},{"country":"-","domain":"wanadoo.fr","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":207},{"country":"-","domain":"alice.it","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":18138},{"address":"104.254.150.241","country":"United States","domain":"ib.adnxs.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":18045},{"country":"-","domain":"ig.com.br","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":298},{"address":"34.226.24.72","country":"United States","domain":"mx.centurylink.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":155},{"country":"-","domain":"yahoo.co.uk","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":1675},{"country":"-","domain":"yahoo.ie","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":526},{"country":"-","domain":"live.de","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":3217},{"address":"193.201.172.119","country":"Bulgaria","domain":"mx3.mail.bg","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":21600},{"country":"-","domain":"oracle.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":58},{"country":"-","domain":"rocketmail.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":192},{"address":"98.136.96.77","country":"United States","domain":"mta7.am0.yahoodns.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":45},{"address":"188.125.72.74","country":"Ireland","domain":"mx-eu.mail.am0.yahoodns.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":42},{"country":"-","domain":"optimum.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":60},{"address":"99.84.160.24","country":"United States","domain":"sb.scorecardresearch.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":60},{"country":"-","domain":"talktalk.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":300},{"address":"194.19.134.70","country":"Denmark","domain":"mx.dka.mailcore.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":95},{"address":"195.121.65.158","country":"Netherlands","domain":"mx.kpnmail.nl","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":2641},{"address":"212.27.48.7","country":"France","domain":"mx1.free.fr","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":7792},{"address":"160.92.124.66","country":"France","domain":"smtpz4.laposte.net","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":242},{"country":"-","domain":"terra.com.br","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":1},{"address":"194.97.208.35","country":"Germany","domain":"mx.freenet.de","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":600},{"country":"-","domain":"prodigy.net.mx","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":423},{"country":"-","domain":"protonmail.com","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"ttl":11}],"http_requests":[{"header":"GET /mouse-gesture/config.json HTTP/2\nHost: edge-consumer-static.azureedge.net\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nSec-Fetch-Site: none\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","host":"edge-consumer-static.azureedge.net","host_ip":"13.107.226.51:443","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"url":"/mouse-gesture/config.json"},{"header":"GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2\nHost: px.ads.linkedin.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","host":"px.ads.linkedin.com","host_ip":"150.171.22.12:443","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"url":"/setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent="},{"header":"GET /mapuid?member=280&user=32DFF8A43A9F6A9B15B5EE573B1A6B37;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D32DFF8A43A9F6A9B15B5EE573B1A6B37%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2\nHost: m.adnxs.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nX-Edge-Shopping-Flag: 1\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","host":"m.adnxs.com","host_ip":"104.254.150.241:443","method":"GET","response_code":"307","response_phrase":"Temporary Redirect","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"url":"/mapuid?member=280&user=32DFF8A43A9F6A9B15B5EE573B1A6B37;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D32DFF8A43A9F6A9B15B5EE573B1A6B37%2526gdpr%253D0%2526gdpr_consent%253D"},{"header":"GET / HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36\nHost: icanhazip.com","host":"icanhazip.com","host_ip":"104.16.185.241:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"url":"/"},{"header":"GET /14/n.txt HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36\nHost: 130.12.180.190","host":"130.12.180.190","host_ip":"130.12.180.190:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"url":"/14/n.txt"},{"header":"GET /14/10107.txt HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36\nHost: 130.12.180.190","host":"130.12.180.190","host_ip":"130.12.180.190:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"url":"/14/10107.txt"},{"header":"GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2\nHost: trc.taboola.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: none\nReferer: https://ntp.msn.com/\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nPriority: i\nAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Microsoft Edge\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: image","host":"trc.taboola.com","host_ip":"151.101.65.44:443","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"url":"/sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent="}]},"process_activity":{"all_imported_dlls":["vk_swiftshader.dll","SHCore.dll","winsta.dll","powrprof.dll","gpapi.dll","mscms.dll","userenv.dll","TextInputFramework.dll","KBDUS.DLL","combase.dll","wow64win.dll","bcrypt.dll","win32u.dll","mswsock.dll","linkinfo.dll","RTWorkQ.dll","well_known_domains.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","ntmarta.dll","advapi32.dll","deviceassociation.dll","kernel32.dll","imm32.dll","wow64cpu.dll","nlaapi.dll","domain_actions.dll","rpcrt4.dll","msvcp110_win.dll","crypt32.dll","OneCoreUAPCommonProxyStub.dll","comctl32.dll","fltLib.dll","msIso.dll","gdi32.dll","twinapi.dll","sspicli.dll","oneauth.dll","uxtheme.dll","webauthn.dll","d3d10warp.dll","mfplat.dll","Windows.UI.Immersive.dll","winmm.dll","IPHLPAPI.DLL","rsaenh.dll","cfgmgr32.dll","netutils.dll","cldapi.dll","msedge.dll","atlthunk.dll","wow64.dll","dhcpcsvc.dll","dnsapi.dll","msedge_elf.dll","shell32.dll","rasadhlp.dll","KernelBase.dll","secur32.dll","msvcrt.dll","urlmon.dll","winmmbase.dll","oleacc.dll","biwinrt.dll","apphelp.dll","wintrust.dll","ResourcePolicyClient.dll","winrnr.dll","libGLESv2.dll","sechost.dll","Windows.Security.Authentication.Web.Core.dll","clbcatq.dll","wininet.dll","pnrpnsp.dll","dbghelp.dll","version.dll","dxgi.dll","netapi32.dll","d3d11.dll","microsoft_shell_integration.dll","CoreUIComponents.dll","iertutil.dll","Windows.UI.dll","WinTypes.dll","oleaut32.dll","profapi.dll","aepic.dll","rmclient.dll","setupapi.dll","cryptsp.dll","Windows.System.Profile.RetailInfo.dll","directmanipulation.dll","wtsapi32.dll","dhcpcsvc6.dll","ole32.dll","windows.storage.dll","dcomp.dll","fwbase.dll","bcryptprimitives.dll","libEGL.dll","deviceaccess.dll","onnxruntime.dll","ffmpeg.dll","ntasn1.dll","propsys.dll","mdmregistration.dll","rometadata.dll","dsreg.dll","OnDemandConnRouteHelper.dll","devobj.dll","wldp.dll","msvcp_win.dll","winnsi.dll","mf.dll","msasn1.dll","FWPUCLNT.DLL","nsi.dll","dwmapi.dll","ncrypt.dll","ucrtbase.dll","CoreMessaging.dll","NapiNSP.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","shlwapi.dll","actxprxy.dll","twinapi.appcore.dll","Windows.Devices.Enumeration.dll","dmcmnutils.dll","d3dcompiler_47.dll","imagehlp.dll","VxSSL32.dll","wscapi.dll","user32.dll","kernel.appcore.dll","ntdll.dll","dpapi.dll","gdi32full.dll","vcruntime140.dll","DWrite.dll","winhttp.dll","FirewallAPI.dll","msctf.dll","cryptbase.dll","DataExchange.dll","ws2_32.dll","wkscli.dll","sxs.dll","msvcr90.dll"],"processes":[{"command_line":"","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","name":"bb77ef06de83dc5e450572c04f69224c44786bda5eadc9e7a698dc4ef1445edf.bin.exe","normalized_path":"C:\\bb77ef06de83dc5e450572c04f69224c44786bda5eadc9e7a698dc4ef1445edf.bin.exe","pid":6972,"ppid":0,"sha256":"bb77ef06de83dc5e450572c04f69224c44786bda5eadc9e7a698dc4ef1445edf","uid":"00000000-00006972"},{"command_line":"--profile-directory=Default","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","pid":11756,"ppid":0,"sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","uid":"00000000-00011756"},{"command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x36c,0x7ffd5de00f18,0x7ffd5de00f24,0x7ffd5de00f30","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00011756","pid":12112,"ppid":11756,"sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","uid":"00000000-00012112"},{"command_line":"--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1684,i,17481194153506918382,11342069643274079286,262144 --field-trial-handle=2056,i,2967946556264016296,3352187058044075461,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2016 /prefetch:2","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00011756","pid":3264,"ppid":11756,"sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","uid":"00000000-00003264"},{"command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=1820,i,15764401812011975428,10866175618294057764,524288 --field-trial-handle=2056,i,2967946556264016296,3352187058044075461,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2108 /prefetch:3","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00011756","pid":9272,"ppid":11756,"sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","uid":"00000000-00009272"},{"command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1892421768668559 --launch-time-ticks=2173701708 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=2944,i,14710152818912964541,2596761867632235397,2097152 --field-trial-handle=2056,i,2967946556264016296,3352187058044075461,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3000 /prefetch:1","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00011756","pid":2980,"ppid":11756,"sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","uid":"00000000-00002980"},{"command_line":"--type=renderer --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1892421768668559 --launch-time-ticks=2173702826 --skip-read-main-dll --metrics-shmem-handle=2952,i,6479082849238322670,4812352247734235580,2097152 --field-trial-handle=2056,i,2967946556264016296,3352187058044075461,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3020 /prefetch:1","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00011756","pid":8536,"ppid":11756,"sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","uid":"00000000-00008536"},{"command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2224,i,12510762671183840699,14056364157190406380,524288 --field-trial-handle=2056,i,2967946556264016296,3352187058044075461,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2696 /prefetch:8","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00011756","pid":10824,"ppid":11756,"sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","uid":"00000000-00010824"},{"command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=4768,i,7491844916290989408,11293904537921776735,524288 --field-trial-handle=2056,i,2967946556264016296,3352187058044075461,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4792 /prefetch:8","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00011756","pid":11764,"ppid":11756,"sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","uid":"00000000-00011764"},{"command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=4756,i,17457526914503299010,3703639266388523974,524288 --field-trial-handle=2056,i,2967946556264016296,3352187058044075461,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4644 /prefetch:8","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00011756","pid":4956,"ppid":11756,"sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","uid":"00000000-00004956"},{"command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=5324,i,838215400946760848,4135476962706289535,524288 --field-trial-handle=2056,i,2967946556264016296,3352187058044075461,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5340 /prefetch:8","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00011756","pid":14584,"ppid":11756,"sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","uid":"00000000-00014584"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\P3P\\HISTORY\\","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]}],"keys_deleted":[],"keys_modified":[]},"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"analysis_start_time":"2026-05-22T13:15:49+00:00","contacted_countries":["BEL","BGR","BRA","CAN","CHN","DEU","DNK","FRA","GBR","IRL","ITA","NLD","POL","SGP","TWN","USA"],"environment_description":"Windows 10 64 bit","environment_id":160,"id":"6a105704cbee740667014a76","indicators_count":{"informative":110,"malicious":7,"suspicious":27},"is_in_unified_schema":true,"malware_family":"Gen:Heur.Mint.Zard","state":"SUCCESS","submit_name":"bb77ef06de83dc5e450572c04f69224c44786bda5eadc9e7a698dc4ef1445edf.bin","tags":["Network Traffic","Extracted Files"],"threat_score":100,"verdict":"malicious"}],"stats":{"contacted_hosts_count":97,"contacted_urls_count":7,"dns_resolutions_count":183,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":4,"files_deleted_count":0,"files_written_count":10,"http_requests_count":7,"imported_dlls_count":147,"injected_processes_count":0,"mutex_created_count":12,"process_count":11,"registry_keys_created_count":3,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"script_calls_count":0,"spawned_processes_count":11}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"Mint.Zard.Generic"}]},"av_detections":{"engines":{"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan/Win.Phorpiex","verdict":"malicious"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan/Win32.Patched","verdict":"malicious"},"aurora":{"data_source":"MetaDefender","name":"Aurora","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware_-10","verdict":"malicious"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"TR/W32.MalwareX","verdict":"malicious"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Gen:Heur.Mint.Zard.39","verdict":"malicious"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"cmc":{"data_source":"MetaDefender","name":"CMC","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Gen:Heur.Mint.Zard.39 (B)","verdict":"malicious"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"a variant of Win32/Phorpiex_AGen.U worm","verdict":"malicious"},"filseclab":{"data_source":"MetaDefender","name":"Filseclab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"gridinsoft":{"data_source":"MetaDefender","name":"Gridinsoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Worm/Phorpiex.o","verdict":"malicious"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"EmailWorm ( 005df7d61 )","verdict":"malicious"},"lionic":{"data_source":"MetaDefender","name":"Lionic","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sentinelone":{"data_source":"MetaDefender","name":"SentinelOne","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malicious","verdict":"malicious"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"W32/Phorpiex-BC","verdict":"malicious"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trellix":{"data_source":"MetaDefender","name":"Trellix","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan-JBBB!62648DA10139","verdict":"malicious"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"W32/S-c70f2e64!Eldorado","verdict":"malicious"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"xcitium":{"data_source":"MetaDefender","name":"Xcitium","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"TrojWare.Win32.Injector.UOL","verdict":"malicious"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"}}},"incidents":[{"details":[{"detail":"Creates new processes"}],"details_count":1,"name":"Persistence","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"details":[{"detail":"Queries kernel debugger information"},{"detail":"Attempts to identify external IP address"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"details_count":4,"name":"Fingerprint","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping multiple times"}],"details_count":2,"name":"Evasive","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"details":[{"detail":"Detected multiple DNS queries for domains that cannot be resolved"},{"detail":"Detected multiple DNS responses with a low TTL"}],"details_count":2,"name":"Spreading","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"details":[{"detail":"Contacts 183 domains and 183 hosts"}],"details_count":1,"name":"Network Behavior","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Resource Development","technique":"Email Accounts"},{"attack_id":"T1550.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1550/004","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Web Session Cookie"},{"attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Mutual Exclusion"},{"attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"suspicious","value":"Attempts to obtain browser cookies (file access)"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Steal Web Session Cookie"},{"attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Internal Proxy"},{"attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Impact","technique":"System Shutdown/Reboot"},{"attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Resource Development","technique":"Domains"},{"attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Persistence","technique":"Create or Modify System Process"},{"attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Persistence","technique":"Socket Filters"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Persistence","technique":"Modify Registry"},{"attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Data Encoding"},{"attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"suspicious","value":"Contacts Mail Related Domain Names"},{"type":"informative","value":"Contains reference to Mail transfer protocol"},{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Mail Protocols"},{"attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"Opens multiple files with write access (often indicator for full-system infection)"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Impact","technique":"Internal Defacement"},{"attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Reconnaissance","technique":"Gather Victim Network Information"},{"attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Execution","technique":"Malicious File"},{"attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Time Discovery"},{"attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Non-Application Layer Protocol"},{"attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Scheduled Transfer"},{"attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","identifiers":[{"type":"suspicious","value":"Able to evade execution by checking for blacklisted external IPs"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Reconnaissance","technique":"IP Addresses"},{"attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion"},{"attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credentials from Password Stores"},{"attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Credential Access","technique":"OS Credential Dumping"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Debugger Evasion"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Code Signing"},{"attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Non-Standard Port"},{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping multiple times"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Checks"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call"},{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops files with image extension"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerading"},{"attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal from Tools"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Protocols"},{"attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Standard Encoding"},{"attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Domain Generation Algorithms"},{"attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Initial Access","technique":"Phishing"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Attempts to identify external IP address"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Configuration Discovery"},{"attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Command and Control","technique":"DNS"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Local System"}],"rule_matches":{},"sandbox_signatures":[{"category":"General","description":"\"bb77ef06de83dc5e450572c04f69224c44786bda5eadc9e7a698dc4ef1445edf.bin\" has an executable section named \".text\"","id":"static-80","level":"informative","name":"PE file contains executable sections","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Reference to an external IP address lookup service identified\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Possibly tries to evade analysis by sleeping multiple times\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Attempts to identify external IP address","id":"summary-29","level":"informative","mitre_attack_id":"T1480","name":"Shows ability to use execution guardrails","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts","id":"summary-32","level":"informative","mitre_attack_id":"T1140","name":"Shows ability to deobfuscate/decode files or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"bb77ef06de83dc5e450572c04f69224c44786bda5eadc9e7a698dc4ef1445edf.bin\")","id":"string-315","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create/open files (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"gethostbyname\" (Indicator: \"gethostbyname\"; File: \"bb77ef06de83dc5e450572c04f69224c44786bda5eadc9e7a698dc4ef1445edf.bin\")\n Found reference to API \"inet_addr\" (Indicator: \"inet_addr\"; File: \"bb77ef06de83dc5e450572c04f69224c44786bda5eadc9e7a698dc4ef1445edf.bin\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; File: \"bb77ef06de83dc5e450572c04f69224c44786bda5eadc9e7a698dc4ef1445edf.bin\")\n Found reference to API \"Once purchased, you can send the Bitcoin (BTC) directly to my wallet address or use a wallet application such as Atomic Wallet or Exodus Wallet to manage your transactions.\" (Indicator: \" send \"; File: \"bb77ef06de83dc5e450572c04f69224c44786bda5eadc9e7a698dc4ef1445edf.bin\")","id":"string-899","level":"informative","mitre_attack_id":"T1071","name":"Contains references to network communication API (string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"bb77ef06de83dc5e450572c04f69224c44786bda5eadc9e7a698dc4ef1445edf.bin\")","id":"string-248","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine timezone (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\" Microsoft\"","id":"static-18","level":"informative","mitre_attack_id":"T1027.002","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts","id":"summary-28","level":"informative","mitre_attack_id":"T1027","name":"Shows ability to obfuscate file or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6a105704cbee740667014a76","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"