26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 47:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4cc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample c6b3670cddf9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c6b3670cddf9…. Malware family: Trojan.Generic. Threat score 100/100. 14/27 AV engines flagged this file. 13 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c6b3670cddf920fc00ea229582ee373eaf17a5aed181b85f8df54a571ddfba64","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","c6b3670cddf920fc00ea229582ee373eaf17a5aed181b85f8df54a571ddfba64"],"about":{"@type":"SoftwareApplication","name":"c6b3670cddf920fc00ea229582ee373eaf17a5aed181b85f8df54a571ddfba64.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"c6b3670cddf920fc00ea229582ee373eaf17a5aed181b85f8df54a571ddfba64","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":14,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T31f6,Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMAC" (Indicator: "HMAC"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp")28:T5b3,"p.im" Heuristic match: "yv.cg" Heuristic match: "9b.nf" Pattern match: "http://tempuri.org/oyunveriseti.xsd" Heuristic match: "$this.name" Pattern match: "microsoft.net/framework/v4.0.30319/" Pattern match: "microsoft.net/assembly/gac_msil/system/v4.0_4.0.0.0__b77a5c561934e089/system.dll" Heuristic match: "m.web.se" Pattern match: "go.microsoft.com/fwlink/?linkid=42127" Heuristic match: "tt@.tt" Heuristic match: "c6b3670cddf920fc00ea229582ee373eaf17a5aed181b85f8df54a571ddfba64.bi" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315#withcomments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#withcomments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/tr/1999/rec-xpath-19991116" Pattern match: "http://www.w3.org/tr/1999/rec-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#xml" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://schemas.microsoft.com/.netconfiguration/v2.0" Pattern match: "system.web/anonymousidentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browsercaps" Pattern match: "system.web/clienttarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customerrors" Pattern match: "system.web/deployment" Pattern match: "system.web/devicefilters" Pattern match: "system.web/fulltrustassemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthmonitoring" Pattern match: "system.web/hostingenvironment" Pattern match: "system.web/httpcookies" Pattern match: "system.web/httphandlers" Pattern match: "system.web/httpmodules" Pattern match: "system.web/httpruntime" Pattern match: "system.web/identity" Pattern match: "system.web/machinekey" Pattern match: "system.web/membership" Pattern match: "system.web/mobilecontrols" Pattern match: "system.web/pages" Pattern match: "system.web/partialtrustvisibleassemblies" Pattern match: "system.web/processmodel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/rolemanager" Pattern match: "system.web/securitypolicy" Pattern match: "system.web/sessionpagestate" Pattern match: "system.web/sessionstate" Pattern match: "system.web/sitemap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlmappings" Pattern match: "system.web/webcontrols" Pattern match: "system.web/webparts" Pattern match: "system.web/webservices" Pattern match: "system.web/xhtmlconformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputcache" Pattern match: "system.web/caching/outputcachesettings" Pattern match: "system.web/caching/sqlcachedependency" Pattern match: "tempuri.org/oyunveriseti.xsd" Pattern match: "system.web/roleman"42:T411,Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00004036.00000000.164396.02B80000.00000004.mdmp, 00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.02B80000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.02B80000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.02B80000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp") Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp")43:T9e4,"" (Indicator: "password"; Source: "00000000-00004036.00000000.164396.04980000.00000004.mdmp, 00000000-00004036.00000001.166317.04980000.00000004.mdmp, 00000000-00004036.00000002.168237.04980000.00000004.mdmp, 00000000-00004036.00000003.173382.04980000.00000004.mdmp")46:Tab6,"\", \"192.168.0.2\", Potential IP \"4.0.0.0\" found in string \"ystem.Configuration\n4.0.0.0\n\nb03f5f7f11d50a3a\", Potential IP \"4.0.0.0\" found in string \"4.0.0.0\n\", Potential IP \"4.0.0.0\" found in string \"=4.0.0.0\", Potential IP \"4.0.0.0\" found in string \"4.0.0.0\n Cul\", \"172.94.15.100\", \"2.5.29.10\", \"2.5.29.19\", \"2.5.29.14\", \"2.5.29.15\", \"2.5.29.37\", Potential IP \"16.10.0.0\" found in string \"KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator\t16.10.0.0\", \"14.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a0b20d437614527f90f23aa"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$41","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a0b20d437614527f90f23aa"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"OST / HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004036.00000003.173382.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a0b20d437614527f90f23aa"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00004036\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6a0b20d437614527f90f23aa"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – high entropy image embedded in .NET resource","description":"YARA signature for high entropy images embedded in resource file \"sample.bin\"\n YARA signature for high entropy images embedded in resource file \"XWormClient.exe.599614488\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-214","sources":[{"report_type":"sandbox","report_id":"6a0b20d437614527f90f23aa"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEB63CF9251DD3636C23FE01E502CE]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004036.00000000.164396.02B80000.00000004.mdmp, 00000000-00004036.00000001.166317.02B80000.00000004.mdmp, 00000000-00004036.00000002.168237.02B80000.00000004.mdmp, 00000000-00004036.00000003.173382.02B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a0b20d437614527f90f23aa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00004036.00000000.164396.02B80000.00000004.mdmp, 00000000-00004036.00000001.166317.02B80000.00000004.mdmp, 00000000-00004036.00000002.168237.02B80000.00000004.mdmp, 00000000-00004036.00000003.173382.02B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a0b20d437614527f90f23aa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"capCreateCaptureWindowA\" (Indicator: \"capCreateCaptureWindow\"; Source: \"00000000-00004036.00000003.173382.00400000.00000040.mdmp\")\n Found reference to API \"CopyFromScreen\" (Indicator: \"CopyFromScreen\"; Source: \"00000000-00004036.00000003.173382.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a0b20d437614527f90f23aa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"$42","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6a0b20d437614527f90f23aa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a0b20d437614527f90f23aa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"