24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 5c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T493,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample d6d876c73274… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d6d876c73274…. Malware family: Trojan.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 11 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9"],"about":{"@type":"SoftwareApplication","name":"HMC 2.0.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":19,"total":27},"behavioralIndicators":{"malicious":11,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T959,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt32" in "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReleaseComObject" in "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt16" in "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringAnsi" in "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt32" in "HMC.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "HMC.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "HMC.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReleaseComObject" in "HMC.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt16" in "HMC.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringAnsi" in "HMC.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "HMC.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "HMC.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "HMC.exe"26:T14a5,Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin") Found reference to "Aes256" (Indicator: "Aes"; File: "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; File: "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; File: "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin") Found reference to "AsymmetricAlgorithm" (Indicator: "AsymmetricAlgorithm"; File: "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin") Found reference to "CryptographicException" (Indicator: "CryptographicException"; File: "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; File: "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; File: "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin") file/memory contains long string with (Indicator: "Aes"; File: "HMC.exe") file/memory contains long string with (Indicator: "AesCryptoServiceProvider"; File: "HMC.exe") file/memory contains long string with (Indicator: "AsymmetricAlgorithm"; File: "HMC.exe") file/memory contains long string with (Indicator: "CryptoConfig"; File: "HMC.exe") file/memory contains long string with (Indicator: "CryptographicException"; File: "HMC.exe") file/memory contains long string with (Indicator: "CryptoStream"; File: "HMC.exe") file/memory contains long string with (Indicator: "DeriveBytes"; File: "HMC.exe") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "HMC.exe") file/memory contains long string with (Indicator: "HMAC"; File: "HMC.exe") file/memory contains long string with (Indicator: "HMACSHA256"; File: "HMC.exe") file/memory contains long string with (Indicator: "MD5CryptoServiceProvider"; File: "HMC.exe") file/memory contains long string with (Indicator: "Rfc2898DeriveBytes"; File: "HMC.exe") file/memory contains long string with (Indicator: "RSACryptoServiceProvider"; File: "HMC.exe") file/memory contains long string with (Indicator: "SHA256Managed"; File: "HMC.exe") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "HMC.exe") Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "00000000-00001080.00000001.247375.15A20000.00000004.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "00000000-00001080.00000001.247375.15A20000.00000004.mdmp") Found reference to "Aes256" (Indicator: "Aes"; Source: "00000000-00001080.00000001.247375.15A20000.00000004.mdmp") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; Source: "00000000-00001080.00000001.247375.15A20000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00001080.00000001.247375.15A20000.00000004.mdmp") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; Source: "00000000-00001080.00000001.247375.15A20000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00001080.00000001.247375.15A20000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00001080.00000001.247375.15A20000.00000004.mdmp") Found reference to "AsymmetricAlgorithm" (Indicator: "AsymmetricAlgorithm"; Source: "00000000-00001080.00000001.247375.15A20000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001080.00000001.247375.15A20000.00000004.mdmp") Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "00000000-00001080.00000001.247375.15A20000.00000004.mdmp")27:T46c,"9iqmgvw,czcthawte," - Source: "00000000-00002756.00000001.249900.1E2B0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00002756.00000001.249900.1E2B0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002756.00000001.249900.1E2B0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002756.00000001.249900.1E2B0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%ydigicert" - Source: "00000000-00002756.00000001.249900.1E2B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002756.00000001.249900.1E2B0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002756.00000001.249900.1E2B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002756.00000001.249900.1E2B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002756.00000001.249900.1E2B0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002756.00000001.249900.1E2B0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002756.00000001.249900.1E2B0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002756.00000001.249900.1E2B0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002756.00000001.249900.1E2B0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0fzeris'1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00002756.00000001.249900.1E2B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002756.00000001.249900.1E2B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysomeqyxcpx" - Source: "00000000-00002756.00000001.249900.1E2B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002756.00000001.249900.1E2B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002756.00000001.249900.1E2B0000.00000004.mdmp") Found URL "http://www.microsoft.com0e66fgnan3e:aitt'qc" - Source: "00000000-00002756.00000001.249900.1E2B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0$d.2c=mkrbf" - Source: "00000000-00002756.00000001.249900.1E5DB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002756.00000001.249900.1E5DB000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00002756.00000001.249900.1E5DB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002756.00000001.249900.1E60A000.00000004.mdmp") Found URL "http://www.microsoft.com0e66fgnan3e:aitt'qc45819573305,73688asycqqqqqqqqqqqqqqqqasyc>dggmkughk^gwk[grkdgykagdkjgckwgnkpg" - Source: "00000000-00002756.00000001.249900.1E60A000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00002756.00000001.249900.1E60A000.00000004.mdmp")4a:T4cc,Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001080.00000001.247375.035B6000.00000004.mdmp") Found string "+ncalrpc:[OLE1778881F003878C880B49527F07B]" (Indicator: "ncalrpc"; Source: "00000000-00001080.00000001.247375.035B6000.00000004.mdmp") Found string "+ncalrpc:[OLEA55B4A92291C10DF57390E31529C]" (Indicator: "ncalrpc"; Source: "00000000-00001080.00000001.247375.035B6000.00000004.mdmp") Found string "B+ncalrpc:[OLE1778881F003878C880B49527F07B]" (Indicator: "ncalrpc"; Source: "00000000-00001080.00000001.247375.1E350000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00002756.00000001.249900.1E2B0000.00000004.mdmp") Found string "+ncalrpc:[OLE9B7065D819F3A66E74CF5AD80078]" (Indicator: "ncalrpc"; Source: "00000000-00002756.00000001.249900.1E2B0000.00000004.mdmp") Found string "B+ncalrpc:[OLE9B7065D819F3A66E74CF5AD80078]" (Indicator: "ncalrpc"; Source: "00000000-00002756.00000001.249900.1E5E7000.00000004.mdmp") Found string "+ncalrpc:[OLEE99D89D8AFDA123BED55956F4312]" (Indicator: "ncalrpc"; Source: "00000000-00002756.00000001.249900.1E60A000.00000004.mdmp")4b:T4f3,Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin") Found reference to API "MapVirtualKey" (Indicator: "MapVirtualKey"; File: "d6d876c7327482a6293fb5014393ace99e14aa7e0638bbda9fc602d35b8a72c9.bin") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00001080.00000001.247375.15A20000.00000004.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00001080.00000001.247375.15A20000.00000004.mdmp") Found reference to API "MapVirtualKey" (Indicator: "MapVirtualKey"; Source: "00000000-00001080.00000001.247375.15A20000.00000004.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00002756.00000000.247980.00D82000.00000002.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00002756.00000000.247980.00D82000.00000002.mdmp") Found reference to API "MapVirtualKey" (Indicator: "MapVirtualKey"; Source: "00000000-00002756.00000000.247980.00D82000.00000002.mdmp")4c:T89b,"\", \"192.168.0.2\", \"2.5.29.19\", \"2.5.29.14\", Potential IP \"4.0.0.0\" found in string \"rsion=4.0.0.0\n Culture=neutral\n PublicKeyToken=b03f5f7f11d50a3a\", \"2.5.29.32\", Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\", \"2.5.29.15\", \"2.5.29.31\", Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\", \"2.5.29.17\", \"2.5.29.1\", \"2.5.29.10\", \"2.5.4.3\", \"2.5.4.7\", \"2.5.4.6\", \"2.5.4.10\", \"2.5.4.11\", \"2.5.29.16\", \"9.17.5.1\", Potential IP \"4.0.0.0\" found in string \"ion=4.0.0.0\n Culture=neutral\n\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69b6abcd592c326df5078fec"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$48","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69b6abcd592c326df5078fec"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$49","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69b6abcd592c326df5078fec"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002756.00000001.249900.1E60A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"69b6abcd592c326df5078fec"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: fc54e0d16d9764783542f0146a98b300","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"69b6abcd592c326df5078fec"}]},{"level":"informative","category":"Remote Access Related","name":"Able to modify Remote Configuration","description":"Found string \":\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\v4.0_4.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll\" (Source: \"00000000-00002756.00000001.249900.1E60A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"69b6abcd592c326df5078fec"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69b6abcd592c326df5078fec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001080.00000001.247375.034E0000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00002756.00000001.249900.03395000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002756.00000001.249900.03395000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00002756.00000001.249900.03395000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00002756.00000001.249900.1E2B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69b6abcd592c326df5078fec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69b6abcd592c326df5078fec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"file/memory contains long string(File: \"HMC.exe\")\n Found string \"GetProcessById\" (Source: \"00000000-00001080.00000001.247375.15A20000.00000004.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00001080.00000001.247375.15A20000.00000004.mdmp\")\n Found string \"GetProcessById\" (Source: \"00000000-00002756.00000000.247980.00D82000.00000002.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00002756.00000000.247980.00D82000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"69b6abcd592c326df5078fec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"