34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 74:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4ad,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Adware.Tedy.Generic Sample ebfa99154621… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ebfa99154621…. Malware family: Adware.Tedy.Generic. Threat score 100/100. 15/27 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8","keywords":["Malicious","Adware.Tedy.Generic","malware analysis","sandbox report","threat intelligence","ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8"],"about":{"@type":"SoftwareApplication","name":"discordnitrov.3.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Adware.Tedy.Generic","antivirusDetections":{"malicious":15,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:Tb1a,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ThrowExceptionForHR" in "ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetTypeFromCLSID" in "ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetFunctionPointerForDelegate" in "ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "naudio.core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "naudio.core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "naudio.core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "naudio.core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "naudio.core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "naudio.core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "naudio.core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringAnsi" in "naudio.core.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReleaseComObject" in "naudio.core.dll"37:T9f8,ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin has big resource with name: "youtube_LOriFzhoUTA_628x480_h264" size: "293044" and abnormal entropy:"7.92517278638491" ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin has big resource with name: "costura.aforge.video.directshow.dll.compressed" size: "31842" and abnormal entropy:"7.991515642366471" ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin has big resource with name: "costura.naudio.asio.dll.compressed" size: "14637" and abnormal entropy:"7.981740184575931" ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin has big resource with name: "costura.naudio.core.dll.compressed" size: "81405" and abnormal entropy:"7.995206685705053" ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin has big resource with name: "costura.naudio.midi.dll.compressed" size: "20853" and abnormal entropy:"7.984796934574505" ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin has big resource with name: "costura.naudio.wasapi.dll.compressed" size: "76002" and abnormal entropy:"7.991652341764986" ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin has big resource with name: "costura.naudio.winforms.dll.compressed" size: "14830" and abnormal entropy:"7.9830347080220125" ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin has big resource with name: "costura.naudio.winmm.dll.compressed" size: "25540" and abnormal entropy:"7.985683913880299" ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin has big resource with name: "costura.newtonsoft.json.dll.compressed" size: "272899" and abnormal entropy:"7.991127166764327" ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin has big resource with name: "costura.system.memory.dll.compressed" size: "59807" and abnormal entropy:"7.995401382862062" ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin has big resource with name: "costura.system.numerics.vectors.dll.compressed" size: "32868" and abnormal entropy:"7.984935838008249" ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin has big resource with name: "costura.system.resources.extensions.dll.compressed" size: "33668" and abnormal entropy:"7.990599052240979" ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin has big resource with name: "costura.system.security.accesscontrol.dll.compressed" size: "13323" and abnormal entropy:"7.980502218263154"38:T5d8," HTTP/2 200 OK Content-Type: image/png Date: Tue 05 May 2026 23:10:58 GMT X-Azure-Ref: 20260505T091033Z-1676997bc64vblbbhC1CHI1t0000000018dg000000002vv3 X-Cache-Remote: TCP_HIT from a23-56-1-153.deploy.akamaitechnologies.com (AkamaiGHost/22.5.1-f3772c509bd97e9cbf399eab359b9b92) (-) X-Bm-Fe-Elapsed: 7 Access-Control-Allow-Headers: Content-Type X-FD-Features X-FD-FLIGHT PreferAnonymous X-Ms-Bm-Ws-Info: 0 Access-Control-Allow-Methods: POST GET OPTIONS Access-Control-Allow-Origin: * X-Bm-Traceid: c45c1fe92a23124ec19b153c40185f72 X-Bm-Srv: mapsplatform-frontend-68d77dbbd8-g87rs mapsplatform-imagery-service-74647c977f-tjjth Cache-Control: public max-age=14661 Alt-Svc: h3=":443"; ma=93600 h3-29=":443"; ma=93600 Aks_4209_weight: 100 with response body ==>BINARY_CONTENT....... "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2 Host: trc.taboola.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Date: Tue 05 May 2026 23:11:01 GMT Server: nginx X-Service-Version: v1 X-Served-By: cache-lax-kwhp1940141-LAX P3p: policyref="http://trc.taboola.com/p3p.xml" CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" Pragma: no-cache X-Cache-Hits: 0 Via: 1.1 varnish Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true X-Fastly-To-Nlb-Rtt: 1297 X-Timer: S1778022662.854076 VS0 VE4 X-Cache: MISS X-Vcl-Time-Ms: 4 Cache-Control: no-cache no-store Accept-Ranges: bytes with no response body "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2 Host: px.ads.linkedin.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67" Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Tue 05 May 2026 23:11:01 GMT X-Li-Fabric: prod-ltx1 Vary: Accept-Encoding X-Li-Proto: http/2 Content-Encoding: gzip Set-Cookie: lidc="b=TGST08:s=T:r=T:a=T:p=T:g=3268:u=1:x=1:i=1778022661:t=1778109061:v=2:sig=AQFIAfpb7co-XPiZtsQ1LMSoPD619tbb"; Expires=Wed 06 May 2026 23:11:01 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure X-Li-Uuid: AAZRGikqoT1xM1QiD8a5Lg== Nel: {"report_to":"network-errors" "max_age":1296000 "success_fraction":0.00066 "failure_fraction":1 "include_subdomains":true} X-Msedge-Ref: Ref A: D9B636B7552949B49FE22621B64D98F2 Ref B: BY1AA1072318031 Ref C: 2026-05-05T23:11:01Z X-Li-Pop: afd-prod-ltx1-x Report-To: {"group":"network-errors" "max_age":2592000 "endpoints":[{"url":"https://www.linkedin.com/li/rep"}] "include_subdomains":true} X-Cache: CONFIG_NOCACHE Alt-Svc: h3=":443"; ma=86400 Linkedin-Action: 1 with response body ==>BINARY_CONTENT....... "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 307 Temporary Redirect Content-Type: text/html; charset=utf-8 Date: Tue 05 May 2026 23:11:02 GMT Server: nginx/1.25.5 Set-Cookie: uuid2=1203165759865162647; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon 03-Aug-2026 23:11:02 GMT; Domain=.adnxs.com; Secure; HttpOnly Expires: Sat 15 Nov 2008 16:00:00 GMT X-Xss-Protection: 0 An-X-Request-Uuid: c3c70e33-f0b3-4c98-ba9e-d1e00f9c928f X-Proxy-Origin: 64.124.12.162; 64.124.12.162; 897.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; *.adnxs.com Location: https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D Cache-Control: no-store no-cache private P3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml" CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Pragma: no-cache Accept-Ch: Sec-CH-UA-Full-Version-List Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Bitness with no response body "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2 Host: edgeassetservice.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/octet-stream Date: Tue 05 May 2026 23:11:07 GMT Last-Modified: Wed 08 Apr 2026 16:21:07 GMT X-Azure-Ref: 20260505T231107Z-1676997bc64tlrxvhC1CHIzn4400000003fg000000007v0z X-Ms-Version: 2009-09-19 X-Ms-Lease-Status: unlocked X-Fd-Int-Roxy-Purgeid: 0 Vary: Accept-Encoding Content-Encoding: br X-Cache: TCP_HIT Cache-Control: public max-age=604800 X-Ms-Request-Id: a933e5f9-401e-003f-6815-da0262000000 X-Ms-Blob-Type: BlockBlob with no response body "GET /mouse-gesture/config.json HTTP/2 Host: edge-consumer-static.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json Date: Tue 05 May 2026 23:11:24 GMT X-Azure-Ref: 20260505T231124Z-177fd759dc8xmnq4hC1SJCcy300000000kv0000000001gfh X-Ms-Version: 2009-09-19 X-Ms-Lease-Status: unlocked X-Ms-Blob-Type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id Server x-ms-version Content-Type ETag Last-Modified x-ms-lease-status x-ms-blob-type Content-Length Date Transfer-Encoding Access-Control-Allow-Origin: * Last-Modified: Tue 24 Oct 2023 08:27:00 GMT X-Fd-Int-Roxy-Purgeid: 83583309 Etag: 0x8DBD46AFE482320 X-Cache: TCP_HIT Cache-Control: public max-age=432000 Accept-Ranges: bytes X-Ms-Request-Id: d03f4500-301e-0074-4f0b-d78687000000 with no response body "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2 Host: clients2.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-Os: Windows Priority: u=4, i Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Accept-Encoding: gzip, deflate, br, zstd Sec-Mesh-Client-Os-Version: 10.0.16299 Sec-Mesh-Client-Webview: 0 Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-chrome-extension X-Guploader-Uploadid: AAVLpEis81CpjLtmth890m4RK5igQw6mks5PQG3d_xY8PEgRXla6-EYcv_drz6rQMSN_RR1FcL7Ie2o Date: Tue 05 May 2026 22:52:18 GMT Server: UploadServer Last-Modified: Tue 14 Apr 2026 15:03:12 GMT Expires: Wed 05 May 2027 22:52:18 GMT Etag: 1db0e9cf_2cf27c25_ffe43034_bc33e3f0_b05b60af Accept-Ranges: bytes Cache-Control: public max-age=31536000 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 1146 X-Goog-Hash: crc32c=939wAg== with response body ==>BINARY_CONTENT.......4c:T1e79,"+g3#8yf_(yf_(x*(gyf_(*(gyf_(x*(g398" Pattern match: "https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf.netframeworkassemblyserviceabletruepreferinboxtrueinheriteditemlsystem.resources.resourcereader" Pattern match: "https://github.com/dotnet/runtimezbinaryformatter" Pattern match: "https://github.com/naudio/naudio*naudio.mixer.mixer+" Pattern match: "https://github.com/naudio/naudioitemgkq7][/6[psl" Pattern match: "https://github.com/naudio/naudiovbetter" Pattern match: "https://github.com/naudio/naudio3system.resources.tools.stronglytypedresourcebuilder16.0.0.0uysystem.windows.forms.orientation" Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0|r~,&ve-|=+xzq/rv:v6w~21}a~m|j" Pattern match: "https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f.netframeworkassemblyserviceabletruepreferinboxtruetursystem.diagnostics.tracing.eventlevel" Pattern match: "https://github.com/naudio/naudio~" Pattern match: "https://t.me/sillyisafed" Pattern match: "https://ipwhois.app/json/" Heuristic match: "ecn.dev.virtualearth.net" Heuristic match: "trc.taboola.com" Heuristic match: "px.ads.linkedin.com" Heuristic match: "m.adnxs.com" Heuristic match: "edgeassetservice.azureedge.net" Pattern match: "www.googleapis.com" Heuristic match: "edge-consumer-static.azureedge.net" Heuristic match: "clients2.googleusercontent.com" Heuristic match: "ib.adnxs.com" Heuristic match: "r.msftstatic.com" Heuristic match: "sb.scorecardresearch.com"63:T12e2,GET /REST/v1/Imagery/Map/roadondemandfull/40.780 -73.970/5?mapSize=268 136&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|lv:1_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US HTTP/2 Host: ecn.dev.virtualearth.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2 Host: trc.taboola.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2 Host: px.ads.linkedin.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67" Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2 Host: edgeassetservice.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /mouse-gesture/config.json HTTP/2 Host: edge-consumer-static.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2 Host: clients2.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-Os: Windows Priority: u=4 i Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Accept-Encoding: gzip deflate br zstd Sec-Mesh-Client-Os-Version: 10.0.16299 Sec-Mesh-Client-Webview: 0 Sec-Fetch-Dest: empty 64:T1884,Contains base62 string in header "ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyT" in header "GET /REST/v1/Imagery/Map/roadondemandfull/40.780,-73.970/5?mapSize=268,136&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|lv:1_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US HTTP/2Host: ecn.dev.virtualearth.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "222166F75FD3671F181970045E3D66DC;" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "253D222166F75FD3671F181970045E3D6" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9M" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzG" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty"65:T62f,Found HTTPS GET request to https://ecn.dev.virtualearth.net/REST/v1/Imagery/Map/roadondemandfull/40.780 -73.970/5?mapSize=268 136&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|lv:1_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US Found HTTPS GET request to https://trc.taboola.com/sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= Found HTTPS GET request to https://px.ads.linkedin.com/setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= Found HTTPS GET request to https://m.adnxs.com/mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D Found HTTPS GET request to https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService Found HTTPS POST request to https://www.googleapis.com/chromewebstore/v1.1/items/verify Found HTTPS GET request to https://edge-consumer-static.azureedge.net/mouse-gesture/config.json Found HTTPS GET request to https://clients2.googleusercontent.com/crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx66:T5c9,YARA signature for RSA public and private key matched on file "naudio.winmm.dll" YARA signature for RSA public and private key matched on file "aforge.video.dll" YARA signature for RSA public and private key matched on file "system.security.accesscontrol.dll" YARA signature for RSA public and private key matched on file "aforge.dll" YARA signature for RSA public and private key matched on file "newtonsoft.json.dll" YARA signature for RSA public and private key matched on file "aforge.video.directshow.dll" YARA signature for RSA public and private key matched on file "naudio.dll" YARA signature for RSA public and private key matched on file "naudio.midi.dll" YARA signature for RSA public and private key matched on file "microsoft.win32.registry.dll" YARA signature for RSA public and private key matched on file "costura.dll" YARA signature for RSA public and private key matched on file "system.runtime.compilerservices.unsafe.dll" YARA signature for RSA public and private key matched on file "naudio.core.dll" YARA signature for RSA public and private key matched on file "system.resources.extensions.dll" YARA signature for RSA public and private key matched on file "naudio.wasapi.dll" YARA signature for RSA public and private key matched on file "system.security.principal.windows.dll" YARA signature for RSA public and private key matched on file "naudio.asio.dll" YARA signature for RSA public and private key matched on file "naudio.winforms.dll"67:T8a5," nul\" (Indicator: \"chcp\"; File: \"ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin\")\n Found string \"/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \\\"\" (Indicator: \"ping\"; File: \"ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin\"), Found string \"hostname\" (Indicator: \"hostname\"; File: \"ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69fa787272f927402408056e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"key3.db\" (Indicator: \"key3.db\"; in File: \"ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin\")\n Found string \"key4.db\" (Indicator: \"key4.db\"; in File: \"ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin\")\n Found string \"\\\\key4.db\" (Indicator: \"key4.db\"; in File: \"ebfa991546216326f9e6cd9ce5c28f2c92011a4e95c42fe0b21728e0609029a8.bin\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":1,"id":"string-405","sources":[{"report_type":"sandbox","report_id":"69fa787272f927402408056e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"69fa787272f927402408056e"}]},{"level":"informative","category":"System Security","name":"Able to retrieve security identifier (.NET)","description":"file/memory contains long string(File: \"system.security.principal.windows.dll\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-945","sources":[{"report_type":"sandbox","report_id":"69fa787272f927402408056e"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\" \"{\"hash\":\"5iyWYxpucA4gDm7Mz9dPYNo+fwtX4xVSlGgQPyAaark=\",\"ids\":[\"ghbmnnjooekpmoecnnnilnnbdlolhkhi\"],\"protocol_version\":1}\" HTTP/2 200 OK\nContent-Type: application/json; charset=UTF-8\nDate: Tue\n 05 May 2026 23:11:07 GMT\nServer: ESF\nX-Xss-Protection: 0\nX-Content-Type-Options: nosniff\nVary: Referer\nContent-Encoding: gzip\nX-Frame-Options: SAMEORIGIN\nAlt-Svc: h3=\":443\"; ma=2592000\nh3-29=\":443\"; ma=2592000 with response body ==>BINARY_CONTENT.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"69fa787272f927402408056e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$6f","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"69fa787272f927402408056e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$70","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"69fa787272f927402408056e"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"69fa787272f927402408056e"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - Queries video controller using WMI","description":"YARA signature for WMI query for video controller matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1047","relevance":3,"id":"yara-51","sources":[{"report_type":"sandbox","report_id":"69fa787272f927402408056e"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_EXE_Packed_Fody\" matched file \"sample.bin\" as \"Detects executables manipulated with Fody\" (Author: ditekSHen)\n YARA signature \"INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store\" matched file \"sample.bin\" as \"Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers\" (Author: ditekSHen)\n YARA signature \"INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender\" matched file \"sample.bin\" as \"Detects executables embedding registry key / value combination indicative of disabling Windows Defender features\" (Author: ditekSHen)\n YARA signature \"INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA\" matched file \"sample.bin\" as \"Detects Windows executables referencing non-Windows User-Agents\" (Author: ditekSHen)","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"69fa787272f927402408056e"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Able to create/switch the desktop","description":"Empty::SwitchDesktop(System.IntPtr) at efa9c1beb896165aa10d578c3f8f1b70-60000bb-Empty~Start\n Empty::SwitchDesktop(System.IntPtr) at efa9c1beb896165aa10d578c3f8f1b70-60000bc-Empty~Stop\n Empty::CreateDesktop(System.String,System.IntPtr,System.IntPtr,System.Int32,System.UInt32,System.IntPtr) at efa9c1beb896165aa10d578c3f8f1b70-60000bd-cctor\n Commands.ControlStuff::CreateDesktop(System.String,System.IntPtr,System.IntPtr,System.Int32,System.UInt32,System.IntPtr) at efa9c1beb896165aa10d578c3f8f1b70-60003d2-ctor\n Commands.DisplayStuff::CreateDesktop(System.String,System.IntPtr,System.IntPtr,System.Int32,System.UInt32,System.IntPtr) at efa9c1beb896165aa10d578c3f8f1b70-60003ea-ctor","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-8","sources":[{"report_type":"sandbox","report_id":"69fa787272f927402408056e"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"