26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 46:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.LummaStealer Sample d5144d2d7e20… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d5144d2d7e20…. Malware family: Trojan.LummaStealer. Threat score 100/100. 14/27 AV engines flagged this file. 3 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","keywords":["Malicious","Trojan.LummaStealer","malware analysis","sandbox report","threat intelligence","d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24"],"about":{"@type":"SoftwareApplication","name":"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe","applicationCategory":["peexe","executable"],"identifier":"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.LummaStealer","antivirusDetections":{"malicious":14,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Te03,"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\742C3192E607E424EB4549542BE1BBC53E6174E2") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\75E0ABB6138512271C04F85FDDDE38E4B7242EFE") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\75E0ABB6138512271C04F85FDDDE38E4B7242EFE") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\7E04DE896A3E666D00E687D33FFAD93BE83D349E") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\7E04DE896A3E666D00E687D33FFAD93BE83D349E") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\8782C6C304353BCFD29692D2593E7D44D934FF11") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\8782C6C304353BCFD29692D2593E7D44D934FF11") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\8CF427FD790C3AD166068DE81E57EFBB932272D4") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\8CF427FD790C3AD166068DE81E57EFBB932272D4") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\91C6D6EE3E8AC86384E548C299295C756C817B81") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\91C6D6EE3E8AC86384E548C299295C756C817B81") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\AD7E1C28B064EF8F6003402014C3D0E3370EB58A") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\AD7E1C28B064EF8F6003402014C3D0E3370EB58A") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4")28:T9ce,"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" queried SystemProcessInformation at 00000000-00004848-00000C15-301661868 [PID: 4848] "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" queried SystemProcessInformation at 00000000-00004848-00000C15-301671157 [PID: 4848] "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" queried SystemProcessInformation at 00000000-00004848-00000C15-301966897 [PID: 4848] "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" queried SystemProcessInformation at 00000000-00004848-00000C15-301976363 [PID: 4848] "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" queried SystemProcessInformation at 00000000-00004848-00000C15-302100755 [PID: 4848] "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" queried SystemProcessInformation at 00000000-00004848-00000C15-302112859 [PID: 4848] "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" queried SystemProcessInformation at 00000000-00004848-00000C15-302294355 [PID: 4848] "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" queried SystemProcessInformation at 00000000-00004848-00000C15-302302992 [PID: 4848] "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" queried SystemProcessInformation at 00000000-00004848-00000C15-302669640 [PID: 4848] "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" queried SystemProcessInformation at 00000000-00004848-00000C15-302679056 [PID: 4848] "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" queried SystemProcessInformation at 00000000-00004848-00000C15-302953382 [PID: 4848] "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" queried SystemProcessInformation at 00000000-00004848-00000C15-302962468 [PID: 4848] "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" queried SystemProcessInformation at 00000000-00004848-00000C15-303681920 [PID: 4848] "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" queried SystemProcessInformation at 00000000-00004848-00000C15-303690726 [PID: 4848] "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" queried SystemProcessInformation at 00000000-00004848-00000C15-312244182 [PID: 4848] "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" queried SystemProcessInformation at 00000000-00004848-00000C15-312252577 [PID: 4848]29:T1dbe,Contains base64 string in header "http" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "POST" in header "POST /api/report?cat=msn HTTP/1.1Host: deff.nelreports.netConnection: keep-aliveContent-Length: 472Content-Type: application/reports+jsonOrigin: https://assets.msn.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "deff" in header "POST /api/report?cat=msn HTTP/1.1Host: deff.nelreports.netConnection: keep-aliveContent-Length: 472Content-Type: application/reports+jsonOrigin: https://assets.msn.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "keep" in header "POST /api/report?cat=msn HTTP/1.1Host: deff.nelreports.netConnection: keep-aliveContent-Length: 472Content-Type: application/reports+jsonOrigin: https://assets.msn.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "aliveContent" in header "POST /api/report?cat=msn HTTP/1.1Host: deff.nelreports.netConnection: keep-aliveContent-Length: 472Content-Type: application/reports+jsonOrigin: https://assets.msn.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Type" in header "POST /api/report?cat=msn HTTP/1.1Host: deff.nelreports.netConnection: keep-aliveContent-Length: 472Content-Type: application/reports+jsonOrigin: https://assets.msn.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "//assets" in header "POST /api/report?cat=msn HTTP/1.1Host: deff.nelreports.netConnection: keep-aliveContent-Length: 472Content-Type: application/reports+jsonOrigin: https://assets.msn.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "like" in header "POST /api/report?cat=msn HTTP/1.1Host: deff.nelreports.netConnection: keep-aliveContent-Length: 472Content-Type: application/reports+jsonOrigin: https://assets.msn.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Encoding" in header "POST /api/report?cat=msn HTTP/1.1Host: deff.nelreports.netConnection: keep-aliveContent-Length: 472Content-Type: application/reports+jsonOrigin: https://assets.msn.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "gzip" in header "POST /api/report?cat=msn HTTP/1.1Host: deff.nelreports.netConnection: keep-aliveContent-Length: 472Content-Type: application/reports+jsonOrigin: https://assets.msn.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Language" in header "POST /api/report?cat=msn HTTP/1.1Host: deff.nelreports.netConnection: keep-aliveContent-Length: 472Content-Type: application/reports+jsonOrigin: https://assets.msn.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "POST" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "orbs" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "http" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "client/2" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "0Content" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "Type" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip"2a:Te32,Found string "dep github.com/StackExchange/wmi v1.2.1 h1:VIkavFPXSjcnS+O8yTq7NI32k0R5Aj+v39y29VYDOSA=" (Indicator: "github.com"; Source: "00000000-00004848.00000000.84100.01869000.00000004.mdmp") Found string "dep github.com/andygrunwald/vdf v1.1.0 h1:gmstp0R7DOepIZvWoSJY97ix7QOrsxpGPU6KusKXqvw=" (Indicator: "github.com"; Source: "00000000-00004848.00000000.84100.01869000.00000004.mdmp") Found string "dep github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=" (Indicator: "github.com"; Source: "00000000-00004848.00000000.84100.01869000.00000004.mdmp") Found string "dep github.com/capnspacehook/taskmaster v0.0.0-20210519235353-1629df7c85e9 h1:5jmtWADt5DzD8NnPxcqd1FzbFNZNfbJGNeDb+WKjoJ0=" (Indicator: "github.com"; Source: "00000000-00004848.00000000.84100.01869000.00000004.mdmp") Found string "dep github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=" (Indicator: "github.com"; Source: "00000000-00004848.00000000.84100.01869000.00000004.mdmp") Found string "dep github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=" (Indicator: "github.com"; Source: "00000000-00004848.00000000.84100.01869000.00000004.mdmp") Found string "dep github.com/lxn/win v0.0.0-20210218163916-a377121e959e h1:H+t6A/QJMbhCSEH5rAuRxh+CtW96g0Or0Fxa9IKr4uc=" (Indicator: "github.com"; Source: "00000000-00004848.00000000.84100.01869000.00000004.mdmp") Found string "dep github.com/ncruces/go-sqlite3 v0.23.0 h1:90j/ar8Ywu2AtsfDl5WhO9sgP/rNk76BcKGIzAHO8AQ=" (Indicator: "github.com"; Source: "00000000-00004848.00000000.84100.01869000.00000004.mdmp") Found string "dep github.com/ncruces/julianday v1.0.0 h1:fH0OKwa7NWvniGQtxdJRxAgkBMolni2BjDHaWTxqt7M=" (Indicator: "github.com"; Source: "00000000-00004848.00000000.84100.01869000.00000004.mdmp") Found string "dep github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 h1:zYyBkD/k9seD2A7fsi6Oo2LfFZAehjjQMERAvZLEDnQ=" (Indicator: "github.com"; Source: "00000000-00004848.00000000.84100.01869000.00000004.mdmp") Found string "dep github.com/quic-go/qpack v0.4.0 h1:Cr9BXA1sQS2SmDUWjSofMPNKmvF6IiIfDRmgU0w1ZCo=" (Indicator: "github.com"; Source: "00000000-00004848.00000000.84100.01869000.00000004.mdmp") Found string "dep github.com/quic-go/quic-go v0.38.1 h1:M36YWA5dEhEeT+slOu/SwMEucbYd0YFidxG3KlGPZaE=" (Indicator: "github.com"; Source: "00000000-00004848.00000000.84100.01869000.00000004.mdmp") Found string "dep github.com/rickb777/date v1.21.1 h1:tUcQS8riIRoYK5kUAv5aevllFEYUEk2x8OYDyoldOn4=" (Indicator: "github.com"; Source: "00000000-00004848.00000000.84100.01869000.00000004.mdmp") Found string "dep github.com/rickb777/plural v1.4.2 h1:Kl/syFGLFZ5EbuV8c9SVud8s5HI2HpCCtOMw2U1kS+A=" (Indicator: "github.com"; Source: "00000000-00004848.00000000.84100.01869000.00000004.mdmp") Found string "dep github.com/rodolfoag/gow32 v0.0.0-20230512144032-1e896a3c51aa h1:cd9mmDEXO4YxGYTbrhbfEt7btgUlcXFedTMoZ9fA4Ns=" (Indicator: "github.com"; Source: "00000000-00004848.00000000.84100.01869000.00000004.mdmp") Found string "dep github.com/tetratelabs/wazero v1.8.2 h1:yIgLR/b2bN31bjxwXHD8a3d+BogigR952csSDdLYEv4=" (Indicator: "github.com"; Source: "00000000-00004848.00000000.84100.01869000.00000004.mdmp") Found string "dep github.com/xssnick/tonutils-go v1.16.0 h1:MLYVZiiMB0Q+XudLo7WyjOli4gMuenNmJpBqETqa5DE=" (Indicator: "github.com"; Source: "00000000-00004848.00000000.84100.01869000.00000004.mdmp") Found string "dep github.com/yusufpapurcu/wmi v1.2.3 h1:E1ctvB7uKFMOJw3fdOW32DwGE9I7t++CRUEMKvFoFiw=" (Indicator: "github.com"; Source: "00000000-00004848.00000000.84100.01869000.00000004.mdmp")2b:T80e,"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070000009e29a97700cdb1030000000028000000240000000000b00328f0b5000000000000000000000000000000000000000000d007c5003000000000000000050000000000c500000000006b000000000000000000000088cbb10348b2b0030700000000000000200000000000c500d001c500d40bc50000000000d00bc5000000000020f0b50050f5a87700cdb10388f0b500d4f0b500 (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004848)2c:Tfd7,"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")2d:T6fb,"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\02FAF3E291435468607857694DF5E45B68851868"; Key: "BLOB") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\039EEDB80BE7A03C6953893B20D2D9323A4C2AFD"; Key: "BLOB") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\06F1AA330B927B753A40E68CDF22E34BCBEF3352"; Key: "BLOB") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\07E032E020B72C3F192F0628A2593A19A70F069E"; Key: "BLOB") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\2796BAE63F1801E277261BA0D77770028F20EEE4"; Key: "BLOB") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E"; Key: "BLOB") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\323C118E1BF7B8B65254E2E2100DD6029037F096"; Key: "BLOB")2e:T5c3,"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004848)2f:T2e34,"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter NtAssociateWaitCompletionPacket (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter NtCancelWaitCompletionPacket (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter getsockname (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter getsockopt (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter WSARecvFrom (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter WSASendTo (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter CancelIoEx (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter socket (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter getpeername (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter CertCreateCertificateContext (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter CertAddCertificateContextToStore (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00004848)30:T1a03,Found reference to API (Indicator: "CloseHandle"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "SetEvent"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "SuspendThread"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "WriteFile"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "GetThreadContext"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "SetProcessPriorityBoost"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "GetStdHandle"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "SetThreadContext"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "GetProcAddress"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "WerSetFlags"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "ExitProcess"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "VirtualFree"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "SwitchToThread"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "RaiseFailFastException"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "SetErrorMode"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "CreateThread"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "SetWaitableTimer"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "WerGetFlags"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "ResumeThread"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "CreateEventA"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "GetErrorMode"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "TlsAlloc"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "VirtualQuery"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "OpenFile"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "SetTimer"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "WSAIoctl"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "GetLength"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "ShowWindow"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe") Found reference to API (Indicator: "GetVersion"; File: "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe")31:T8fd,Process d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe created mutex with name "\BaseNamedObjects\WEBR_ILDJMWOQXYXY" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8092:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8092:120:WilError_01" Process msedge.exe created mutex with name "Local\SM0:8092:304:WilStaging_02" Process msedge.exe created mutex with name "ChromeProcessSingletonStartup!" Process msedge.exe created mutex with name "SM0:8092:304:WilStaging_02" Process msedge.exe created mutex with name "Local\SessionImmersiveColorMutex" Process msedge.exe created mutex with name "SM0:8092:120:WilError_01" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8092:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\ChromeProcessSingletonStartup!" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SessionImmersiveColorMutex" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8040:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\mfx_d3d_mutex" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8040:304:WilStaging_02" Process msedge.exe created mutex with name "Local\SM0:8040:304:WilStaging_02" Process msedge.exe created mutex with name "mfx_d3d_mutex" Process msedge.exe created mutex with name "SM0:8040:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4644:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4644:304:WilStaging_02" Process msedge.exe created mutex with name "SM0:4644:304:WilStaging_02" Process msedge.exe created mutex with name "Local\SM0:4644:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8028:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8028:304:WilStaging_02" Process msedge.exe created mutex with name "SM0:8028:304:WilStaging_02" Process msedge.exe created mutex with name "Local\SM0:8028:304:WilStaging_02"32:T892,"dep github.com/StackExchange/wmi v1.2.1 h1:VIkavFPXSjcnS+O8yTq7NI32k0R5Aj+v39y29VYDOSA=" (Indicator: "github.com") "dep github.com/andygrunwald/vdf v1.1.0 h1:gmstp0R7DOepIZvWoSJY97ix7QOrsxpGPU6KusKXqvw=" (Indicator: "github.com") "dep github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=" (Indicator: "github.com") "dep github.com/capnspacehook/taskmaster v0.0.0-20210519235353-1629df7c85e9 h1:5jmtWADt5DzD8NnPxcqd1FzbFNZNfbJGNeDb+WKjoJ0=" (Indicator: "github.com") "dep github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=" (Indicator: "github.com") "dep github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=" (Indicator: "github.com") "dep github.com/lxn/win v0.0.0-20210218163916-a377121e959e h1:H+t6A/QJMbhCSEH5rAuRxh+CtW96g0Or0Fxa9IKr4uc=" (Indicator: "github.com") "dep github.com/ncruces/go-sqlite3 v0.23.0 h1:90j/ar8Ywu2AtsfDl5WhO9sgP/rNk76BcKGIzAHO8AQ=" (Indicator: "github.com") "dep github.com/ncruces/julianday v1.0.0 h1:fH0OKwa7NWvniGQtxdJRxAgkBMolni2BjDHaWTxqt7M=" (Indicator: "github.com") "dep github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 h1:zYyBkD/k9seD2A7fsi6Oo2LfFZAehjjQMERAvZLEDnQ=" (Indicator: "github.com") "dep github.com/quic-go/qpack v0.4.0 h1:Cr9BXA1sQS2SmDUWjSofMPNKmvF6IiIfDRmgU0w1ZCo=" (Indicator: "github.com") "dep github.com/quic-go/quic-go v0.38.1 h1:M36YWA5dEhEeT+slOu/SwMEucbYd0YFidxG3KlGPZaE=" (Indicator: "github.com") "dep github.com/rickb777/date v1.21.1 h1:tUcQS8riIRoYK5kUAv5aevllFEYUEk2x8OYDyoldOn4=" (Indicator: "github.com") "dep github.com/rickb777/plural v1.4.2 h1:Kl/syFGLFZ5EbuV8c9SVud8s5HI2HpCCtOMw2U1kS+A=" (Indicator: "github.com") "dep github.com/rodolfoag/gow32 v0.0.0-20230512144032-1e896a3c51aa h1:cd9mmDEXO4YxGYTbrhbfEt7btgUlcXFedTMoZ9fA4Ns=" (Indicator: "github.com") "dep github.com/tetratelabs/wazero v1.8.2 h1:yIgLR/b2bN31bjxwXHD8a3d+BogigR952csSDdLYEv4=" (Indicator: "github.com") "dep github.com/xssnick/tonutils-go v1.16.0 h1:MLYVZiiMB0Q+XudLo7WyjOli4gMuenNmJpBqETqa5DE=" (Indicator: "github.com") "dep github.com/yusufpapurcu/wmi v1.2.3 h1:E1ctvB7uKFMOJw3fdOW32DwGE9I7t++CRUEMKvFoFiw=" (Indicator: "github.com")33:T385e,"GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Tue 13 Oct 2026 14:20:37 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a49efc703c6c6c48-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Tue 13 Oct 2026 14:20:38 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a49efc71bcabe418-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Tue 13 Oct 2026 14:21:02 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a49efd0869f27543-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Tue 13 Oct 2026 14:21:26 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a49efd9a1dbc2a56-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Tue 13 Oct 2026 14:21:49 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a49efe2e1b632350-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Tue 13 Oct 2026 14:22:12 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a49efebfbc702083-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Tue 13 Oct 2026 14:22:35 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a49eff517efe5527-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Tue 13 Oct 2026 14:22:59 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a49effe37dcd7587-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Tue 13 Oct 2026 14:23:23 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a49f0077c84a15ff-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Tue 13 Oct 2026 14:23:47 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a49f010bbbf3ceb5-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Tue 13 Oct 2026 14:24:10 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a49f019fdf02b5f2-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Tue 13 Oct 2026 14:24:34 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a49f0234c8305bc0-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Tue 13 Oct 2026 14:24:57 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a49f02c6dd30fa1e-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Tue 13 Oct 2026 14:25:20 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a49f03590ab9ed39-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Tue 13 Oct 2026 14:25:44 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a49f03eb5a37cf0e-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Tue 13 Oct 2026 14:26:07 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a49f047db870ed39-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D.......34:T45e,Launches browser "msedge.exe" (UID: 00000000-00008092) Launches browser "msedge.exe" (UID: 00000000-00004572) Launches browser "msedge.exe" (UID: 00000000-00007452) Launches browser "msedge.exe" (UID: 00000000-00008040) Launches browser "msedge.exe" (UID: 00000000-00000188) Launches browser "msedge.exe" (UID: 00000000-00005340) Launches browser "msedge.exe" (UID: 00000000-00007816) Launches browser "msedge.exe" (UID: 00000000-00000796) Launches browser "msedge.exe" (UID: 00000000-00006296) Launches browser "msedge.exe" (UID: 00000000-00004644) Launches browser "msedge.exe" (UID: 00000000-00008028) Launches browser "msedge.exe" (UID: 00000000-00004936) Launches browser "msedge.exe" (UID: 00000000-00002376) Launches browser "msedge.exe" (UID: 00000000-00006844) Launches browser "msedge.exe" (UID: 00000000-00000096) Launches browser "msedge.exe" (UID: 00000000-00005180) Launches browser "msedge.exe" (UID: 00000000-00008088) Launches browser "msedge.exe" (UID: 00000000-00008008) Launches browser "msedge.exe" (UID: 00000000-00003492) Launches browser "msedge.exe" (UID: 00000000-00003996)35:T83b,"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74250000 "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 749c0000 "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" loaded module "NTDLL.DLL" at base 77a50000 "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" loaded module "WINMM.DLL" at base 74200000 "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" loaded module "POWRPROF.DLL" at base 76b90000 "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" loaded module "KERNEL32.DLL" at base 74cc0000 "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" loaded module "WS2_32.DLL" at base 76d70000 "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" loaded module "USER32.DLL" at base 76f40000 "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" loaded module "ADVAPI32.DLL" at base 76a10000 "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74170000 "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" loaded module "IPHLPAPI.DLL" at base 74140000 "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" loaded module "RPCRT4.DLL" at base 76e80000 "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 74050000 "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 74000000 "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" loaded module "CRYPT32.DLL" at base 74830000 "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73fb0000 "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 749c000036:T1f93,Process "msedge.exe" (UID: 00000000-00008092) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A"" Process "msedge.exe" (UID: 00000000-00008092) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00004572) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_8092_UOLVWDEQYFWUMJVV", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="8092"" Process "msedge.exe" (UID: 00000000-00008040) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="7", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00000188) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00004936) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="FgzsyIJzqEBQqtJ", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="7", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="EkYJigK", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="FgzsyIJzqEBQqtJ", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\EkYJigK", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\EkYJigK", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00006844) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00008088) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="FgzsyIJzqEBQqtJ", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="7", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="EkYJigK", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="FgzsyIJzqEBQqtJ", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\EkYJigK", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\EkYJigK", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00008008) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00003492) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="FgzsyIJzqEBQqtJ", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="7", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="EkYJigK", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="FgzsyIJzqEBQqtJ", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\EkYJigK", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\EkYJigK", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00003996) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH"37:Tb01,Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00008092) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00004572), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00007452), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00008040), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00000188), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00005340), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00007816), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --disable ..." (UID: 00000000-00000796), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --disable-gpu-compositing - ..." (UID: 00000000-00006296), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00004644), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00008028), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00004936), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00002376), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00006844), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00000096), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00005180), Spawned process "msedge.exe" with commandline "--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu ..." (UID: 00000000-00008088), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00008008), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=on_device_model.mojom.OnDevice ..." (UID: 00000000-00003492), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00003996)38:Tb01,Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00008092) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00004572), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00007452), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00008040), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00000188), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00005340), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00007816), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --disable ..." (UID: 00000000-00000796), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --disable-gpu-compositing - ..." (UID: 00000000-00006296), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00004644), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00008028), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00004936), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00002376), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00006844), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00000096), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00005180), Spawned process "msedge.exe" with commandline "--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu ..." (UID: 00000000-00008088), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00008008), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=on_device_model.mojom.OnDevice ..." (UID: 00000000-00003492), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00003996)39:Ta80,The input sample is signed with a certificate issued by "CN=SSL.com SSL Intermediate CA ECC R2, O=SSL Corp, L=Houston, ST=Texas, C=US" (SHA1: F8:86:35:01:72:60:D4:0B:9E:B4:17:BE:E7:37:37:91:1B:63:0E:59; see report for more information) The input sample is signed with a certificate issued by "CN=SSL.com Root Certification Authority ECC, O=SSL Corporation, L=Houston, ST=Texas, C=US" (SHA1: 92:19:61:2E:90:1C:49:04:F9:83:5E:E8:C2:AD:D5:4F:F0:B7:97:FD; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 ECC CA OCSP 06, O=Microsoft Corporation, C=US" (SHA1: 75:B0:C6:B2:69:41:8F:B6:18:CA:07:61:42:9C:7A:D4:A5:87:4C:D8; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS ECC Root G2, O=Microsoft Corporation, C=US" (SHA1: 9B:C5:75:46:AC:BD:B2:9E:38:8C:D1:79:1B:43:DE:4F:65:9B:84:4B; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7F:A0:5A:CF:9B:4A:AB:B0:DE:0C:FA:FA:29:7D:DF:92:FD:C5:F3:F5; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 ECC CA OCSP 06, O=Microsoft Corporation, C=US" (SHA1: E9:33:E3:4F:8D:2C:70:09:42:6D:46:7B:74:69:57:80:D4:15:1F:65; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7E:04:DE:89:6A:3E:66:6D:00:E6:87:D3:3F:FA:D9:3B:E8:3D:34:9E; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Atlas R3 DV TLS CA 2026 Q2, O=GlobalSign nv-sa, C=BE" (SHA1: 43:73:33:AB:BC:05:B7:FC:F3:56:7F:D7:00:31:93:88:47:3D:DE:5B; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3" (SHA1: 37:08:77:93:79:80:7F:7C:FD:3C:9C:5E:62:83:55:15:F3:CC:62:0C; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: DD:F1:7F:7F:7F:4B:23:84:79:68:8B:E8:E9:F2:1F:C1:30:9B:C3:37; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)3a:Ta11,"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: ""; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: ""; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}"; Key: ""; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: ""; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}"; Key: ""; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: ""; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: ""; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY"; Key: ""; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: ""; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: ""; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: ""; Value: "")3b:T101c,"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}"; Key: "SEARCHLIST"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPRACOEXISTENCEENABLED"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPV6DOMAIN"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "")3c:T4a1,"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" trying to touch file "C:\WINDOWS\SysWOW64\apphelp.dll" "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" trying to touch file "C:\d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb"3d:T503,"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" trying to access non-existent file "C:\FLTLIB.DLL" "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" trying to access non-existent file "C:\MSVCP140.DLL" "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" trying to access non-existent file "C:\MSVCP140.dll" "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" trying to access non-existent file "C:\BCRYPT.DLL" "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" trying to access non-existent file "C:\bcrypt.dll"3e:T169e,Heuristic match: "*big.int" Heuristic match: "**big.int" Heuristic match: "*abi.name" Heuristic match: "tonapi.io" Pattern match: "remoteadministratortool.ton/resolve" Heuristic match: "deff.nelreports.net" Pattern match: "https://assets.msn.comaccess-control-request-method" Pattern match: "https://assets.msn.comuser-agent" Heuristic match: "cloudflare-dns.com" Heuristic match: "edge-consumer-static.azureedge.net" Heuristic match: "sa1atik.cn" Pattern match: "github.com/stackexchange/wmi" Pattern match: "github.com/andygrunwald/vdf" Pattern match: "github.com/buger/jsonparser" Pattern match: "github.com/capnspacehook/taskmaster" Pattern match: "github.com/go-ole/go-ole" Pattern match: "github.com/gorilla/websocket" Pattern match: "github.com/lxn/win" Pattern match: "github.com/ncruces/go-sqlite3" Pattern match: "github.com/ncruces/julianday" Pattern match: "github.com/nfnt/resize" Pattern match: "github.com/quic-go/qpack" Pattern match: "github.com/quic-go/quic-go" Pattern match: "github.com/rickb777/date" Pattern match: "github.com/rickb777/plural" Pattern match: "github.com/rodolfoag/gow32" Pattern match: "github.com/tetratelabs/wazero" Pattern match: "github.com/xssnick/tonutils-go" Pattern match: "github.com/yusufpapurcu/wmi" Pattern match: "golang.org/x/crypto" Pattern match: "golang.org/x/exp" Pattern match: "golang.org/x/net" Pattern match: "golang.org/x/sys" Pattern match: "golang.org/x/text" Heuristic match: "loudflare-dns.com" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "j.sni.global.fastly.net" Heuristic match: "ntrust.net" Heuristic match: ".sni.global.fastly.net" Heuristic match: "onapi.io" Heuristic match: "tly.net" Pattern match: "crl.globalsign.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "0www.entrust.net/cps" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0"3f:T8db,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004848.00000000.84100.03B00000.00000004.mdmp, 00000000-00004848.00000001.86018.03B00000.00000004.mdmp, 00000000-00004848.00000002.87939.03B00000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004848.00000000.84100.03B00000.00000004.mdmp, 00000000-00004848.00000001.86018.03B00000.00000004.mdmp, 00000000-00004848.00000002.87939.03B00000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004848.00000000.84100.03B00000.00000004.mdmp, 00000000-00004848.00000001.86018.03B00000.00000004.mdmp, 00000000-00004848.00000002.87939.03B00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004848.00000000.84100.03B00000.00000004.mdmp, 00000000-00004848.00000001.86018.03B00000.00000004.mdmp, 00000000-00004848.00000002.87939.03B00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004848.00000000.84100.03B00000.00000004.mdmp, 00000000-00004848.00000001.86018.03B00000.00000004.mdmp, 00000000-00004848.00000002.87939.03B00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004848.00000000.84100.03B00000.00000004.mdmp, 00000000-00004848.00000001.86018.03B00000.00000004.mdmp, 00000000-00004848.00000002.87939.03B00000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004848.00000000.84100.03B00000.00000004.mdmp, 00000000-00004848.00000001.86018.03B00000.00000004.mdmp, 00000000-00004848.00000002.87939.03B00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004848.00000000.84100.03B00000.00000004.mdmp, 00000000-00004848.00000001.86018.03B00000.00000004.mdmp, 00000000-00004848.00000002.87939.03B00000.00000004.mdmp")40:T101c,"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}"; Key: "SEARCHLIST"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPRACOEXISTENCEENABLED"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPV6DOMAIN"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "")41:T8a6,Found string "abort" (Source: d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe, API is part of module: MSVCRT.DLL) Found string "trunc" (Source: d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe, API is part of module: UCRTBASE.DLL) Found string "clock" (Source: d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe, API is part of module: MSVCRT.DLL) Found string "accept" (Source: d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe, API is part of module: WS2_32.DLL) Found string "remove" (Source: d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe, API is part of module: MSVCRT.DLL) Found string "signal" (Source: d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe, API is part of module: MSVCRT.DLL) Found string "listen" (Source: d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe, API is part of module: WS2_32.DLL) Found string "connect" (Source: d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe, API is part of module: WS2_32.DLL) Found string "tmpfile" (Source: d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe, API is part of module: MSVCRT.DLL) Found string "realloc" (Source: d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe, API is part of module: MSVCRT.DLL) Found string "shutdown" (Source: d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe, API is part of module: WS2_32.DLL) Found string "OpenFile" (Source: d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe, API is part of module: KERNEL32.DLL) Found string "SetTimer" (Source: d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe, API is part of module: USER32.DLL) Found string "WSAIoctl" (Source: d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe, API is part of module: WS2_32.DLL) Found string "ShowWindow" (Source: d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe, API is part of module: USER32.DLL) Found string "GetVersion" (Source: d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe, API is part of module: KERNELBASE.DLL)42:Tbdd,"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "3b39140" "pszBlobType": "RSAPUBLICBLOB" "phKey": "805cb6031081b503" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "3b39350" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e05fb603c6895b8f" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "3b39350" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e05fb60356885b8f" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "3b39140" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e05fb603a873b503" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "3b39350" "pszBlobType": "RSAPUBLICBLOB" "phKey": "0060b603a68ec4ac" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "3b39140" "pszBlobType": "RSAPUBLICBLOB" "phKey": "a" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "3b39350" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e062b603a68ec4ac" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "3b39140" "pszBlobType": "RSAPUBLICBLOB" "phKey": "0060b603a873b503" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "3b39350" "pszBlobType": "RSAPUBLICBLOB" "phKey": "a" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "3b39350" "pszBlobType": "RSAPUBLICBLOB" "phKey": "0065b603a68ec4ac" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "3b39350" "pszBlobType": "RSAPUBLICBLOB" "phKey": "0060b603368e068a" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "3b39350" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"}43:T5d63,"POST /api/report?cat=msn HTTP/1.1 Host: deff.nelreports.net Connection: keep-alive Content-Length: 472 Content-Type: application/reports+json Origin: https://assets.msn.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" with payload::==> "[{"age":0,"body":{"elapsed_time":84,"method":"GET","phase":"application","protocol":"h2","referrer":"https://ntp.msn.com/","sampling_fraction":0.001,"server_ip":"23.62.230.183","status_code":200,"type":"ok"},"type":"network-error","url":"https://assets.msn.com/bundles/v1/edgeChromium/latest/common-money-lib.441b3941432aace0.js","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0"}]" HTTP/1.1 200 OK Content-Length: 0 Server: Kestrel Date: Tue 13 Oct 2026 14:23:02 GMT Connection: keep-alive PMUSER_FORMAT_QS: X-CDN-TraceId: 0.302c2017.1791901382.14875a22 Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET OPTIONS POST Access-Control-Allow-Origin: * with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 13 Oct 2026 14:20:39 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791901239.199885 VS0 VE0 X-Served-By: cache-lax-kwhp1940110-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 13 Oct 2026 14:20:40 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791901240.283664 VS0 VE0 X-Served-By: cache-lax-kwhp1940110-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 13 Oct 2026 14:20:41 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791901241.359439 VS0 VE0 X-Served-By: cache-lax-kwhp1940110-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 13 Oct 2026 14:20:43 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791901244.545523 VS0 VE0 X-Served-By: cache-lax-kwhp1940049-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 13 Oct 2026 14:20:44 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791901245.602143 VS0 VE0 X-Served-By: cache-lax-kwhp1940049-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 13 Oct 2026 14:20:45 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791901246.672369 VS0 VE0 X-Served-By: cache-lax-kwhp1940049-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 13 Oct 2026 14:20:47 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791901248.830750 VS0 VE0 X-Served-By: cache-lax-kwhp1940057-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 13 Oct 2026 14:20:48 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791901249.883448 VS0 VE0 X-Served-By: cache-lax-kwhp1940057-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 13 Oct 2026 14:20:49 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791901250.955056 VS0 VE0 X-Served-By: cache-lax-kwhp1940057-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 13 Oct 2026 14:21:02 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791901262.458302 VS0 VE0 X-Served-By: cache-lax-kwhp1940035-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 13 Oct 2026 14:21:03 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791901264.514689 VS0 VE0 X-Served-By: cache-lax-kwhp1940035-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 13 Oct 2026 14:21:04 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791901265.594211 VS0 VE0 X-Served-By: cache-lax-kwhp1940035-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 13 Oct 2026 14:21:06 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791901267.754048 VS0 VE0 X-Served-By: cache-lax-kwhp1940127-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 13 Oct 2026 14:21:07 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791901268.824845 VS0 VE0 X-Served-By: cache-lax-kwhp1940127-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 13 Oct 2026 14:21:08 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791901269.905134 VS0 VE0 X-Served-By: cache-lax-kwhp1940127-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 13 Oct 2026 14:21:11 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791901271.090250 VS0 VE0 X-Served-By: cache-lax-kwhp1940033-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 13 Oct 2026 14:21:12 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791901272.147163 VS0 VE0 X-Served-By: cache-lax-kwhp1940033-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 13 Oct 2026 14:21:13 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791901273.219389 VS0 VE0 X-Served-By: cache-lax-kwhp1940033-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 13 Oct 2026 14:21:26 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791901286.207208 VS0 VE0 X-Served-By: cache-lax-kwhp1940122-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 13 Oct 2026 14:21:27 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791901287.262881 VS0 VE0 X-Served-By: cache-lax-kwhp1940122-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 13 Oct 2026 14:21:28 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791901288.331509 VS0 VE0 X-Served-By: cache-lax-kwhp1940122-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 13 Oct 2026 14:21:30 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791901291.509201 VS0 VE20 X-Served-By: cache-lax-kwhp1940040-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 13 Oct 2026 14:21:31 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791901292.564842 VS0 VE0 X-Served-By: cache-lax-kwhp1940040-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Tue 13 Oct 2026 14:21:32 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791901293.634296 VS0 VE0 X-Served-By: cache-lax-kwhp1940040-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body44:T656,"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "Process32NextW with parameter System" (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "Process32NextW with parameter smss.exe" (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "Process32NextW with parameter csrss.exe" (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "Process32NextW with parameter wininit.exe" (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "Process32NextW with parameter winlogon.exe" (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "Process32NextW with parameter services.exe" (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "Process32NextW with parameter lsass.exe" (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "Process32NextW with parameter svchost.exe" (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "Process32NextW with parameter fontdrvhost.exe" (UID: 00000000-00004848) "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" called "Process32NextW with parameter dwm.exe" (UID: 00000000-00004848)45:Te9c,"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793310919665,"unified_at":"2026-10-29T21:55:19.665Z","metadata":{"hashes":{"sha256":"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","sha1":"0dc0c9cf918629f1a4e241357ea00d3abcfbc5be","md5":"acc458314dbcbf60b2d0a56fad0f6248","sha512":"ec2f09deb705c25a04777e93f48dcd224412c34ea5b54f22fc02c212ba251dca3fe983a63ca02a037da3f61319682a92986c6d9d229f00ed72f5875c247dc910","ssdeep":"98304:R0IJywHlUKrRldYY2DzrM4opOEfPZEzDU:Hywdlyo5/6zQ","ssdeep_chunks":["98304:R0IJywH","98304:0IJywHl","98304:IJywHlU","98304:JywHlUK","98304:ywHlUKr","98304:wHlUKrR","98304:HlUKrRl","98304:lUKrRld","98304:UKrRldY","98304:KrRldYY","98304:rRldYY2","98304:RldYY2D","98304:ldYY2Dz","98304:dYY2Dzr","98304:YY2DzrM","98304:Y2DzrM4","98304:2DzrM4o","98304:DzrM4op","98304:zrM4opO","98304:rM4opOE","98304:M4opOEf","98304:4opOEfP","98304:opOEfPZ","98304:pOEfPZE","98304:OEfPZEz","98304:EfPZEzD","98304:fPZEzDU","196608:R0IJywH","196608:0IJywHl","196608:IJywHlU","196608:JywHlUK","196608:ywHlUKr","196608:wHlUKrR","196608:HlUKrRl","196608:lUKrRld","196608:UKrRldY","196608:KrRldYY","196608:rRldYY2","196608:RldYY2D","196608:ldYY2Dz","196608:dYY2Dzr","196608:YY2DzrM","196608:Y2DzrM4","196608:2DzrM4o","196608:DzrM4op","196608:zrM4opO","196608:rM4opOE","196608:M4opOEf","196608:4opOEfP","196608:opOEfPZ","196608:pOEfPZE","196608:OEfPZEz","196608:EfPZEzD","196608:fPZEzDU","98304:Hywdlyo","98304:ywdlyo5","98304:wdlyo5/","98304:dlyo5/6","98304:lyo5/6z","98304:yo5/6zQ"],"imphash":"1aae8bf580c846f39c71c05898e57e88","pehash":"686373e3e7163b27bfa4c6b6535ccc505f2100ad"},"file_info":{"file_name":"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":12579328,"entropy":6.4,"compile_timestamp":"1970-01-01T00:00:00","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791887133000,"last_seen":1791901192000,"last_multi_scan":1791901192000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":6,"import_count":0,"export_count":0,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":5250117,"raw_size":5250560},{"name":".rdata","virtual_address":"0x503000","virtual_size":6639920,"raw_size":6640128},{"name":".data","virtual_address":"0xb59000","virtual_size":635308,"raw_size":433152},{"name":".idata","virtual_address":"0xbf5000","virtual_size":1100,"raw_size":1536},{"name":".reloc","virtual_address":"0xbf6000","virtual_size":252280,"raw_size":252416},{"name":".symtab","virtual_address":"0xc34000","virtual_size":4,"raw_size":512}],"section_names":[".text",".rdata",".data",".idata",".reloc",".symtab"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["salatstealer","criminal","informationstealer","rat","suspicious"]},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":59},"sandbox_signatures":{"informative_count":116,"suspicious_count":14,"malicious_count":3,"total":133},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.SalatStealer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.LummaStealer.103","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.LummaStealer.103 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of WinGo/Agent.VO trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Agent.e!crit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Spyware ( 006d58511 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.tt6y","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"YARA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Salat-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Salat.A.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.LummaStealer","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Recently renewed or created SSL certificate"},{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Attempts to retrieve the system language code"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"suspicious","value":"Calls an API typically used to import asymmetric cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Tries to GET non-existent files from a web server"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains possible references to Golang crypto modules"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Stealth","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","identifiers":[{"type":"suspicious","value":"PE file has no resource directory"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")\n Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")\n Found reference to API \"SetWaitableTimer\" (Indicator: \"SetWaitableTimer\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004848.00000000.84100.03B00000.00000004.mdmp, 00000000-00004848.00000001.86018.03B00000.00000004.mdmp, 00000000-00004848.00000002.87939.03B00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"forHKDF\" (Indicator: \"HKDF\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")\n Found reference to \"newHMAC\" (Indicator: \"HMAC\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00004848.00000001.86018.03B00000.00000004.mdmp, 00000000-00004848.00000002.87939.03B00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - 8\\\\.\\u; Source: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"msedge.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$27","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$28","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains possible references to Golang crypto modules","description":"Observed string: \"crypto/tls\" (Indicator: \"crypto/tls\") in Source: d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\n Observed string: \"crypto/aes\" (Indicator: \"crypto/aes\") in Source: d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\n Observed string: \"crypto/md5\" (Indicator: \"crypto/md5\") in Source: d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004848.00000000.84100.03B00000.00000004.mdmp, 00000000-00004848.00000001.86018.03B00000.00000004.mdmp, 00000000-00004848.00000002.87939.03B00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00004848.00000001.86018.03B00000.00000004.mdmp, 00000000-00004848.00000002.87939.03B00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$29","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains possible references to Golang crypto modules\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - ChaCha20 encryption algorithm\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match – cryptographic algorithms","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameExA\" (Source: \"00000000-00004848.00000000.84100.03B00000.00000004.mdmp\")\n Found string \"etUserNameW\" (Source: \"00000000-00004848.00000000.84100.03B00000.00000004.mdmp\")\n Found string \"etUserNameExW\" (Source: \"00000000-00004848.00000000.84100.03B00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004848-00000C2C-302446264\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004848-00000C2C-302574948\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004848-00000C2C-302574977\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004848-00000C2C-302575075\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00004848-00000C2C-302835203\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in file \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00004848.00000000.84100.03B00000.00000004.mdmp, 00000000-00004848.00000001.86018.03B00000.00000004.mdmp, 00000000-00004848.00000002.87939.03B00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004848)\n \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" called \"GetComputerNameExW\" with parameters (UID: 00000000-00004848)\n \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" called \"GetAdaptersAddresses\" with parameters (UID: 00000000-00004848)\n \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" called \"Process32FirstW\" with parameters (UID: 00000000-00004848)\n \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" called \"Process32NextW\" with parameters (UID: 00000000-00004848)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004848)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004848)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" queried token user identity (UID: 00000000-00004848)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed TonAPI Domain in TLS SNI (tonapi .io)\" (SID: 2071845, Rev: 1, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\" (SID: 2027695, Rev: 5, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"tonapi.io\"\n \"deff.nelreports.net\"\n \"ton.access.orbs.network\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"1.1.1.1:443\"\n \"104.16.248.249:443\"\n \"104.20.29.41:443\"\n \"151.101.2.132:443\"\n \"151.101.130.132:443\"\n \"23.32.45.48:443\"\n \"150.171.109.69:443\"\n \"151.101.66.132:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$30","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\" in Source: 00000000-00004848.00000001.86018.03B00000.00000004.mdmp\n 00000000-00004848.00000002.87939.03B00000.00000004.mdmp\n \"Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7\" in Source: 00000000-00004848.00000001.86018.03B00000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$31","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\" in Source: 00000000-00004848.00000001.86018.03B00000.00000004.mdmp\n \"Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7\" in Source: 00000000-00004848.00000001.86018.03B00000.00000004.mdmp\n \"Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.64.1.1!7\" in Source: 00000000-00004848.00000002.87939.03B00000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"$32","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$33","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"$34","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 749C0000\n \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73FE0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76E80000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" was detected as \"Go\" and name: \"Compiler\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" has an writable section named \".data\"\n \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" has an writable section named \".idata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" file has an entrypoint instructions - \"jmp\t0x477010,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,sub\tesp, 0x28,mov\tdword ptr [esp + 0x1c], ebx,mov\tdword ptr [esp + 0x10], ebp,mov\tdword ptr [esp + 0x14], esi,mov\tdword ptr [esp + 0x18], edi,mov\tdword ptr [esp], eax,mov\tdword ptr [esp + 4], ecx,call\t0x4543c0,mov\teax, dword ptr [esp + 8],mov\tedi, dword ptr [esp + 0x18],mov\tesi, dword ptr [esp + 0x14],mov\tebp, dword ptr [esp + 0x10],mov\tebx, dword ptr [esp + 0x1c],add\tesp, 0x28,ret\t4,ret\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,sub\tesp, 8,mov\tecx, dword ptr [esp + 0xc],mov\tedx, dword ptr [ecx],mov\teax, esp,mov\tdword ptr [edx + 4], eax,sub\teax, 0x10000,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x501e00\" greater than 0x100000\n Raw size of \".rdata\" is \"0x655200\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x501c45\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x655130\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Possibly references Golang binary related string","description":"\"Go build ID: \"cmPY0Upnk1Vd5qCq_kJN/IuTP6C2iXdrvOOuZwLzi/fB4_n8k1fm2APKf2dMsB/3R2FXj_15VYtx7ylTkEy\"\" (Indicator: \"Go build ID: \"cmPY0Upnk1Vd5qCq_kJN/IuTP6C2iXdrvOOuZwLzi/fB4_n8k1fm2APKf2dMsB/3R2FXj_15VYtx7ylTkEy\")\" in Source: d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-74","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$36","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"cloudflare-dns.com\"\n \"deff.nelreports.net\"\n \"edge-consumer-static.azureedge.net\"\n \"sa1atik.cn\"\n \"ton.access.orbs.network\"\n \"tonapi.io\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$37","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$38","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$39","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a web server","description":"\"GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1\nHost: tonapi.io\nUser-Agent: Go-http-client/1.1\nContent-Type: application/octet-stream\nAccept-Encoding: gzip\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" queries basic process information of the \"C:\\d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" (UID: 4848)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}\"\n \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}\"\n \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" trying to access non-existent file \"\\Device\\RasAcd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00004848-00000C2C-302551677\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00004848-00000C2C-302634173\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /v2/dns/remoteadministratortool.ton/resolve\"\n Found http requests in header \"POST /api/report?cat=msn\"\n Found http requests in header \"POST /route/1/mainnet/toncenter-api-v2/runGetMethod\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004848-00000C2C-302482083\")\n Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; Source: \"00000000-00004848-00000C2C-303083439\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; Source: \"00000000-00004848-00000C2C-303091593\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00004848-00000C2C-303371378\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00004848-00000C2C-303371982\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00004848-00000C2C-302482083\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.35\"\n \"2.5.29.17\"\n \"2.5.29.31\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.15\"\n \"2.5.29.19\"\n \"2.5.29.32\"\n \"2.5.29.14\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.10\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1\nHost: tonapi.io\nUser-Agent: Go-http-client/1.1\nContent-Type: application/octet-stream\nAccept-Encoding: gzip\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"cloudflare-dns.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec\n Observed JA3 fingerprint: 1e93d985c806ca627b3b564ad06cc0c3\n Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"deff.nelreports.net\" (8 days old)\n Newly renewed or created SSL certificate: \"edge-consumer-static.azureedge.net\" (0 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://tonapi.io/v2/dns/remoteadministratortool.ton/resolve\n Found HTTPS OPTIONS request to https://deff.nelreports.net/api/report?cat=msn\n Found HTTPS POST request to https://deff.nelreports.net/api/report?cat=msn\n Found HTTPS POST request to https://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/runGetMethod","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"tonapi.io\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"1.1.1.1\" on port \"443\"\n HTTPS traffic to \"104.16.248.249\" on port \"443\"\n HTTPS traffic to \"104.20.29.41\" on port \"443\"\n HTTPS traffic to \"151.101.2.132\" on port \"443\"\n HTTPS traffic to \"151.101.130.132\" on port \"443\"\n HTTPS traffic to \"23.32.45.48\" on port \"443\"\n HTTPS traffic to \"150.171.109.69\" on port \"443\"\n HTTPS traffic to \"151.101.66.132\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--profile-directory=Default\" (Indicator: \"--profile-directory=\"; File: \"msedge.exe\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"aesKey\" (Indicator: \"aes\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")\n Found string \"chacha8\" (Indicator: \"chacha\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")\n Found string \"*aes.CTR\" (Indicator: \"aes\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")\n Found string \"crypto/aes\" (Indicator: \"aes\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")\n Found string \"`aesSK\" (Indicator: \"aes\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")\n Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00004848.00000001.86018.03B00000.00000004.mdmp, 00000000-00004848.00000002.87939.03B00000.00000004.mdmp\")\n Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00004848.00000001.86018.03B00000.00000004.mdmp, 00000000-00004848.00000002.87939.03B00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectory\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"secret\" (Indicator: \"secret\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")\n Found string \"password\" (Indicator: \"password\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"hostname\" (Indicator: \"hostname\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")\n Found string \"Hostname\" (Indicator: \"hostname\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00004848.00000000.84100.03B00000.00000004.mdmp, 00000000-00004848.00000001.86018.03B00000.00000004.mdmp, 00000000-00004848.00000002.87939.03B00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" opened \"\\Device\\KsecDD\"\n \"msedge.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2FD\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00004848.00000001.86018.03B00000.00000004.mdmp, 00000000-00004848.00000002.87939.03B00000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \".text\" unusually large (5250117 bytes)\n possible junk padding\n Section \".rdata\" unusually large (6639920 bytes)\n possible junk padding\n Section \".symtab\" has very low entropy (0.02)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"PE file has no resource directory","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" has no resource directory","origin":"Static Parser","mitre_attack_id":"T1027.008","relevance":7,"id":"static-9002","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to import asymmetric cryptographic keys into a CSP","description":"$42","origin":"API Call","mitre_attack_id":"T1573.002","relevance":1,"id":"api-234","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve the system language code","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}","origin":"API Call","mitre_attack_id":"T1614.001","relevance":10,"id":"api-307","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"13/26 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$43","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 1.1.1.1\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"UDP traffic to 1.1.1.1 on port 443\n TCP traffic to 104.16.248.249 on port 443 is sent without HTTP header\n TCP traffic to 1.1.1.1 on port 443 is sent without HTTP header\n TCP traffic to 104.20.29.41 on port 443 is sent without HTTP header\n TCP traffic to 151.101.2.132 on port 443 is sent without HTTP header\n TCP traffic to 151.101.130.132 on port 443 is sent without HTTP header\n TCP traffic to 151.101.66.132 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$44","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$45","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"WriteFile\n GetThreadContext\n GetSystemDirectoryA\n GetSystemInfo\n GetProcAddress\n LoadLibraryW\n VirtualAlloc\n LoadLibraryExW\n CreateThread","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/26 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 6 domains and 6 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]}],"intel_graph":{"map":{"Domain:026042d01ac6e8faf294ec9b5816b47f34558c59cbe3d30937ddc18e43fe1f1e":{"type":"Domain","value":"dns.google","verdict":{"verdict":"unknown"}},"Domain:0b74fc419a513e832e21208d63bc84be7583250b62162557167f8da18e10f635":{"type":"Domain","value":"cloudflare-dns.com","verdict":{"verdict":"unknown"}},"Domain:20a83b42cd540c2fcdee61e4f14793ede774fa8258835683a7c8e885a8c270c2":{"type":"Domain","value":"gitlab.com","verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},"Domain:5f93289debb5d6dee51139b15fad9cbf01330e06ead87a680481397c29193a8f":{"type":"Domain","value":"sa1atik.cn","verdict":{"verdict":"unknown"}},"Domain:deff.nelreports.net":{"type":"Domain","value":"deff.nelreports.net"},"Domain:edge-consumer-static.azureedge.net":{"type":"Domain","value":"edge-consumer-static.azureedge.net"},"Domain:ton.access.orbs.network":{"type":"Domain","value":"ton.access.orbs.network"},"Domain:tonapi.io":{"type":"Domain","value":"tonapi.io"},"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24":{"type":"File","value":"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["Detected malicious dynamic behaviour","File reported as malware by ClamAV antivirus"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"Ip:1.1.1.1":{"type":"Ip","value":"1.1.1.1"},"Ip:104.16.248.249":{"type":"Ip","value":"104.16.248.249"},"Ip:104.20.29.41":{"type":"Ip","value":"104.20.29.41"},"Ip:150.171.109.69":{"type":"Ip","value":"150.171.109.69"},"Ip:151.101.130.132":{"type":"Ip","value":"151.101.130.132"},"Ip:151.101.2.132":{"type":"Ip","value":"151.101.2.132"},"Ip:151.101.66.132":{"type":"Ip","value":"151.101.66.132"},"Ip:23.32.45.48":{"type":"Ip","value":"23.32.45.48"},"Url:/api/report?cat=msn":{"type":"Url","value":"/api/report?cat=msn"},"Url:/route/1/mainnet/toncenter-api-v2/runGetMethod":{"type":"Url","value":"/route/1/mainnet/toncenter-api-v2/runGetMethod"},"Url:/v2/dns/remoteadministratortool.ton/resolve":{"type":"Url","value":"/v2/dns/remoteadministratortool.ton/resolve"}},"chains":[{"id":"1559571404475193145","root":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","edges":[],"verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["Detected malicious dynamic behaviour","File reported as malware by ClamAV antivirus"]}},{"id":"1559571397391381977","root":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","edges":[{"edge_kind":"contacted_domain","from_key":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","to_key":"Domain:026042d01ac6e8faf294ec9b5816b47f34558c59cbe3d30937ddc18e43fe1f1e"}],"verdict":{"verdict":"unknown"}},{"id":"1559571397403964940","root":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","edges":[{"edge_kind":"contacted_domain","from_key":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","to_key":"Domain:0b74fc419a513e832e21208d63bc84be7583250b62162557167f8da18e10f635"}],"verdict":{"verdict":"unknown"}},{"id":"1559571408959806040","root":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","edges":[{"edge_kind":"contacted_domain","from_key":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","to_key":"Domain:20a83b42cd540c2fcdee61e4f14793ede774fa8258835683a7c8e885a8c270c2"}],"verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},{"id":"1559571397391381984","root":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","edges":[{"edge_kind":"contacted_domain","from_key":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","to_key":"Domain:5f93289debb5d6dee51139b15fad9cbf01330e06ead87a680481397c29193a8f"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_network","root":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","edges":[{"edge_kind":"contacted_ip","from_key":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","to_key":"Ip:1.1.1.1"},{"edge_kind":"contacted_ip","from_key":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","to_key":"Ip:104.16.248.249"},{"edge_kind":"contacted_ip","from_key":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","to_key":"Ip:104.20.29.41"},{"edge_kind":"contacted_ip","from_key":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","to_key":"Ip:151.101.2.132"},{"edge_kind":"contacted_ip","from_key":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","to_key":"Ip:151.101.130.132"},{"edge_kind":"contacted_ip","from_key":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","to_key":"Ip:23.32.45.48"},{"edge_kind":"contacted_ip","from_key":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","to_key":"Ip:150.171.109.69"},{"edge_kind":"contacted_ip","from_key":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","to_key":"Ip:151.101.66.132"},{"edge_kind":"contacted_domain","from_key":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","to_key":"Domain:20a83b42cd540c2fcdee61e4f14793ede774fa8258835683a7c8e885a8c270c2"},{"edge_kind":"contacted_domain","from_key":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","to_key":"Domain:0b74fc419a513e832e21208d63bc84be7583250b62162557167f8da18e10f635"},{"edge_kind":"contacted_domain","from_key":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","to_key":"Domain:026042d01ac6e8faf294ec9b5816b47f34558c59cbe3d30937ddc18e43fe1f1e"},{"edge_kind":"contacted_domain","from_key":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","to_key":"Domain:5f93289debb5d6dee51139b15fad9cbf01330e06ead87a680481397c29193a8f"},{"edge_kind":"contacted_domain","from_key":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","to_key":"Domain:deff.nelreports.net"},{"edge_kind":"resolves_to","from_key":"Domain:deff.nelreports.net","to_key":"Ip:23.32.45.48"},{"edge_kind":"contacted_domain","from_key":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","to_key":"Domain:edge-consumer-static.azureedge.net"},{"edge_kind":"resolves_to","from_key":"Domain:edge-consumer-static.azureedge.net","to_key":"Ip:150.171.109.69"},{"edge_kind":"contacted_domain","from_key":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","to_key":"Domain:ton.access.orbs.network"},{"edge_kind":"resolves_to","from_key":"Domain:ton.access.orbs.network","to_key":"Ip:151.101.66.132"},{"edge_kind":"contacted_domain","from_key":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","to_key":"Domain:tonapi.io"},{"edge_kind":"resolves_to","from_key":"Domain:tonapi.io","to_key":"Ip:104.20.29.41"},{"edge_kind":"contacted_url","from_key":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","to_key":"Url:/v2/dns/remoteadministratortool.ton/resolve"},{"edge_kind":"contacted_url","from_key":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","to_key":"Url:/api/report?cat=msn"},{"edge_kind":"contacted_url","from_key":"File:d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","to_key":"Url:/route/1/mainnet/toncenter-api-v2/runGetMethod"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":21,"spawned_processes_count":21,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":57,"imported_dlls_count":155,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":34,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":4,"embedded_urls_count":0,"contacted_hosts_count":8,"dns_resolutions_count":8,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":["salatstealer","criminal","informationstealer","rat","suspicious"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6ace3e072312dc70b100cc4f","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.LummaStealer","contacted_countries":["USA"],"submit_name":"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe","analysis_start_time":"2026-10-13T14:19:53+00:00","indicators_count":{"informative":116,"suspicious":31,"malicious":3},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"1.1.1.1","port":443,"protocol":"UDP","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"address":"104.16.248.249","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"address":"104.20.29.41","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"address":"151.101.2.132","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"address":"151.101.130.132","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"address":"23.32.45.48","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"address":"150.171.109.69","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"address":"151.101.66.132","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]}],"dns_resolutions":[{"domain":"gitlab.com","sources":[{"report_type":"qsp","report_id":""}]},{"domain":"cloudflare-dns.com","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"domain":"dns.google","sources":[{"report_type":"qsp","report_id":""}]},{"domain":"sa1atik.cn","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"domain":"deff.nelreports.net","address":"23.32.45.48","ttl":316,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"domain":"edge-consumer-static.azureedge.net","address":"150.171.109.69","ttl":1464,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"domain":"ton.access.orbs.network","address":"151.101.66.132","ttl":176,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"domain":"tonapi.io","address":"104.20.29.41","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]}],"http_requests":[{"host":"tonapi.io","host_ip":"104.20.29.41:443","url":"/v2/dns/remoteadministratortool.ton/resolve","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1\nHost: tonapi.io\nUser-Agent: Go-http-client/1.1\nContent-Type: application/octet-stream\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"host":"deff.nelreports.net","host_ip":"23.32.45.48:443","url":"/api/report?cat=msn","method":"OPTIONS","response_code":"200","response_phrase":"OK","header":"OPTIONS /api/report?cat=msn HTTP/1.1\nHost: deff.nelreports.net\nConnection: keep-alive\nOrigin: https://assets.msn.com\nAccess-Control-Request-Method: POST\nAccess-Control-Request-Headers: content-type\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"host":"ton.access.orbs.network","host_ip":"151.101.2.132:443","url":"/route/1/mainnet/toncenter-api-v2/runGetMethod","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2\nHost: ton.access.orbs.network\nUser-Agent: Go-http-client/2.0\nContent-Type: application/json\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]}],"embedded_domains":[{"value":"gitlab.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"cloudflare-dns.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"dns.google","sources":[{"report_type":"qsp","report_id":""}]},{"value":"sa1atik.cn","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}],"processes":[{"pid":4848,"ppid":0,"name":"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe","command_line":"","sha256":"d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24","normalized_path":"C:\\d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24.exe","uid":"00000000-00004848","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":8092,"ppid":0,"name":"msedge.exe","command_line":"--profile-directory=Default","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","uid":"00000000-00008092","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":4572,"ppid":8092,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x29c,0x7ff9c63b0f18,0x7ff9c63b0f24,0x7ff9c63b0f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008092","uid":"00000000-00004572"},{"pid":7452,"ppid":8092,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=1764,i,13864962513881733031,2109754512036356930,524288 --field-trial-handle=2040,i,17238881484968823832,16276257820287968239,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2112 /prefetch:3","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008092","uid":"00000000-00007452"},{"pid":8040,"ppid":8092,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1676,i,2041867768680755819,12993976162176771418,262144 --field-trial-handle=2040,i,17238881484968823832,16276257820287968239,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2024 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008092","uid":"00000000-00008040"},{"pid":188,"ppid":8092,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2260,i,5714762313664136092,1585727931314992879,524288 --field-trial-handle=2040,i,17238881484968823832,16276257820287968239,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2640 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008092","uid":"00000000-00000188"},{"pid":5340,"ppid":8092,"name":"msedge.exe","command_line":"--type=renderer --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1791908791422389 --launch-time-ticks=1469487034 --skip-read-main-dll --metrics-shmem-handle=2924,i,6920426704803064733,15152725752333684402,2097152 --field-trial-handle=2040,i,17238881484968823832,16276257820287968239,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2956 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008092","uid":"00000000-00005340"},{"pid":7816,"ppid":8092,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1791908791422389 --launch-time-ticks=1469484947 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=2916,i,15934951847753661144,7230188022451394015,2097152 --field-trial-handle=2040,i,17238881484968823832,16276257820287968239,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2776 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008092","uid":"00000000-00007816"},{"pid":796,"ppid":8092,"name":"msedge.exe","command_line":"--type=renderer --instant-process --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1791908791422389 --launch-time-ticks=1472181688 --skip-read-main-dll --metrics-shmem-handle=4680,i,3707200479044507675,12281487129775898879,2097152 --field-trial-handle=2040,i,17238881484968823832,16276257820287968239,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3916 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008092","uid":"00000000-00000796"},{"pid":6296,"ppid":8092,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1791908791422389 --launch-time-ticks=1472164117 --skip-read-main-dll --metrics-shmem-handle=2896,i,2834666216295229477,5163009520305687494,2097152 --field-trial-handle=2040,i,17238881484968823832,16276257820287968239,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4496 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008092","uid":"00000000-00006296"},{"pid":4644,"ppid":8092,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=4984,i,10365430549389014590,15388917298083785407,524288 --field-trial-handle=2040,i,17238881484968823832,16276257820287968239,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5008 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008092","uid":"00000000-00004644"},{"pid":8028,"ppid":8092,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=4980,i,11771415273704615310,5231402308683984902,524288 --field-trial-handle=2040,i,17238881484968823832,16276257820287968239,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3288 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008092","uid":"00000000-00008028"},{"pid":4936,"ppid":8092,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=5672,i,12712571102116758685,8455403683258265435,524288 --field-trial-handle=2040,i,17238881484968823832,16276257820287968239,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5632 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008092","uid":"00000000-00004936"},{"pid":2376,"ppid":8092,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --ssd-no-pressure-read-main-dll --metrics-shmem-handle=4804,i,13074982959171725626,7835370208189262492,524288 --field-trial-handle=2040,i,17238881484968823832,16276257820287968239,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4936 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008092","uid":"00000000-00002376"},{"pid":6844,"ppid":8092,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=5824,i,2294453999635891912,10983234454663663800,524288 --field-trial-handle=2040,i,17238881484968823832,16276257820287968239,262144 --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5828 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008092","uid":"00000000-00006844"},{"pid":96,"ppid":8092,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5928,i,5204560447110766182,10496776866469333030,524288 --field-trial-handle=2040,i,17238881484968823832,16276257820287968239,262144 --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5984 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008092","uid":"00000000-00000096"},{"pid":5180,"ppid":8092,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=5968,i,10910583742211112995,16512818604755097851,524288 --field-trial-handle=2040,i,17238881484968823832,16276257820287968239,262144 --variations-seed-version --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5728 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008092","uid":"00000000-00005180"},{"pid":8088,"ppid":8092,"name":"msedge.exe","command_line":"--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.16299.192 --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --skip-read-main-dll --metrics-shmem-handle=4952,i,4301394115192127862,3616821332558170222,262144 --field-trial-handle=2040,i,17238881484968823832,16276257820287968239,262144 --variations-seed-version --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5876 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008092","uid":"00000000-00008088"},{"pid":8008,"ppid":8092,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=4792,i,11384984126215460106,11607860314232290839,524288 --field-trial-handle=2040,i,17238881484968823832,16276257820287968239,262144 --variations-seed-version --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=4692 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008092","uid":"00000000-00008008"},{"pid":3492,"ppid":8092,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3288,i,2413545474179804558,13208822688950039046,524288 --field-trial-handle=2040,i,17238881484968823832,16276257820287968239,262144 --variations-seed-version --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5868 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008092","uid":"00000000-00003492"},{"pid":3996,"ppid":8092,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=4944,i,7380303612743868009,3660658352539239259,524288 --field-trial-handle=2040,i,17238881484968823832,16276257820287968239,262144 --variations-seed-version --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=5152 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008092","uid":"00000000-00003996"}],"all_imported_dlls":["win32u.dll","msedge.dll","CoreMessaging.dll","WinTypes.dll","cldapi.dll","fwbase.dll","telclient.dll","wow64.dll","sechost.dll","winmm.dll","version.dll","secur32.dll","DataExchange.dll","dcomp.dll","rmclient.dll","setupapi.dll","PCPKsp.dll","sppc.dll","ntdll.dll","windows.storage.dll","oneauth.dll","wldp.dll","netapi32.dll","urlmon.dll","wow64cpu.dll","ucrtbase.dll","sxs.dll","gpapi.dll","vk_swiftshader.dll","rasadhlp.dll","msasn1.dll","dwmapi.dll","netutils.dll","Windows.Security.Authentication.Web.Core.dll","ncrypt.dll","iertutil.dll","shlwapi.dll","wwapi.dll","mfplat.dll","dnsapi.dll","wkscli.dll","Windows.UI.dll","wintrust.dll","d3d11.dll","aepic.dll","netprofm.dll","D3D12.dll","sspicli.dll","ole32.dll","clbcatq.dll","ffmpeg.dll","wevtapi.dll","dpapi.dll","rometadata.dll","atlthunk.dll","RTWorkQ.dll","ws2_32.dll","msvcp140.dll","bcrypt.dll","msvcp110_win.dll","oleacc.dll","npmproxy.dll","IPHLPAPI.DLL","uxtheme.dll","mf.dll","libGLESv2.dll","onnxruntime.dll","dxilconv.dll","dhcpcsvc.dll","FWPUCLNT.DLL","propsys.dll","fltLib.dll","userenv.dll","TextInputFramework.dll","CoreUIComponents.dll","d3d10warp.dll","combase.dll","dmcmnutils.dll","mscms.dll","dxgi.dll","Windows.Networking.Connectivity.dll","slc.dll","Windows.Security.Authentication.OnlineId.dll","msvcp_win.dll","profapi.dll","twinapi.dll","devobj.dll","ncryptprov.dll","BitsProxy.dll","KernelBase.dll","bcryptprimitives.dll","cfgmgr32.dll","comctl32.dll","dusmapi.dll","imm32.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","Windows.UI.Immersive.dll","actxprxy.dll","tbs.dll","ntmarta.dll","oleaut32.dll","dhcpcsvc6.dll","crypt32.dll","rsaenh.dll","dsreg.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","d3dcompiler_47.dll","user32.dll","SHCore.dll","mdmregistration.dll","wscapi.dll","advapi32.dll","Windows.System.Profile.RetailInfo.dll","wow64win.dll","msvcrt.dll","nsi.dll","kernel.appcore.dll","wtsapi32.dll","winsta.dll","directmanipulation.dll","OneCoreUAPCommonProxyStub.dll","gdi32full.dll","powrprof.dll","webauthn.dll","linkinfo.dll","well_known_domains.dll","dbghelp.dll","VxSSL32.dll","cryptsp.dll","kernel32.dll","nlaapi.dll","twinapi.appcore.dll","FirewallAPI.dll","libEGL.dll","apphelp.dll","gdi32.dll","shell32.dll","microsoft_shell_integration.dll","wlanapi.dll","slwga.dll","oneds.dll","ResourcePolicyClient.dll","winmmbase.dll","msedge_elf.dll","DWrite.dll","winhttp.dll","domain_actions.dll","imagehlp.dll","mswsock.dll","msctf.dll","ntasn1.dll","rpcrt4.dll","cryptbase.dll","vcruntime140.dll","KBDUS.DLL"]},"file_activity":{"dropped_files":[],"extracted_files":[],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\crashpad_8092_UOLVWDEQYFWUMJVV","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.5000.15340971554101686810","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.6128.15402329544248222728","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.6128.14114288337219030521","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.6128.11734644778547341750","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.6128.10875279470353084512","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.5000.3904591513327157650","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.5000.9984348740444024713","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.6128.935491182613840990","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.6128.5857962200971649931","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.6128.7947050652743942293","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.6128.6798274822317325312","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.6128.13763421222329132356","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.6128.1364925053509148888","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.5000.6159376913521066784","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.6128.13306386925984602836","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.6128.7859663076058995681","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.5000.2081332523552014279","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.5000.6702952929137169136","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.5000.4919550323393056270","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.5000.10495865270493308508","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.5000.3995673986490784054","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.5000.44531150625992949","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.5000.15034326360852255744","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.5000.7211404940749560276","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.8092.5000.11057997600770404504","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.7816.5728.9324987993047014229","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.796.2080.2175382372536987882","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"path":"pipe\\LOCAL\\mojo.6296.5096.15362761955979485011","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\WEBR_ILDJMWOQXYXY","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8092:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8092:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"Local\\SM0:8092:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"SM0:8092:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"SM0:8092:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8092:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8040:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8040:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"Local\\SM0:8040:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"SM0:8040:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4644:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4644:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"SM0:4644:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"Local\\SM0:4644:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8028:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8028:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"SM0:8028:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"Local\\SM0:8028:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"Local\\SM0:2376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"SM0:2376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6844:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6844:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"SM0:6844:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"Local\\SM0:6844:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:96:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:96:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"SM0:96:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"Local\\SM0:96:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5180:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5180:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"SM0:5180:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"Local\\SM0:5180:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8088:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8088:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"Local\\SM0:8088:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"SM0:8088:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8008:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8008:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"Local\\SM0:8008:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"SM0:8008:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3492:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3492:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"SM0:3492:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"Local\\SM0:3492:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3996:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3996:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"SM0:3996:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]},{"name":"Local\\SM0:3996:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ace3e072312dc70b100cc4f"}]}]}},"report_ids":{"sandbox_job_ids":["6ace3e072312dc70b100cc4f"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.LummaStealer Sample d5144d2d7e20… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d5144d2d7e20…. Malware family: Trojan.LummaStealer. Threat score 100/100. 14/27 AV engines flagged this file. 3 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.LummaStealer Sample d5144d2d7e20… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d5144d2d7e20…. Malware family: Trojan.LummaStealer. Threat score 100/100. 14/27 AV engines flagged this file. 3 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d5144d2d7e20b48885c24b42ea5f0250f1b3d89ab00dbcd84782ebde645c5d24"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.LummaStealer Sample d5144d2d7e20… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d5144d2d7e20…. Malware family: Trojan.LummaStealer. Threat score 100/100. 14/27 AV engines flagged this file. 3 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L46","11",{}]]