24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 5e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample f42816c2aeb3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f42816c2aeb3…. Malware family: Trojan.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 12 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f42816c2aeb32f892df5c3eda3fca63bba9aa1bd715f0b6aa94a6025dcdc82b1","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","f42816c2aeb32f892df5c3eda3fca63bba9aa1bd715f0b6aa94a6025dcdc82b1"],"about":{"@type":"SoftwareApplication","name":"f42816c2aeb32f892df5c3eda3fca63bba9aa1bd715f0b6aa94a6025dcdc82b1.bin","applicationCategory":["peexe","executable"],"identifier":"f42816c2aeb32f892df5c3eda3fca63bba9aa1bd715f0b6aa94a6025dcdc82b1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":20,"total":27},"behavioralIndicators":{"malicious":12,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T431,Found string "elected compression algorithm is not supported." (Source: "00000000-00006676.00000000.131688.1DEB0000.00000004.mdmp, 00000000-00006676.00000001.131830.052C0000.00000004.mdmp, 00000000-00006676.00000001.131830.05360000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB20000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB40000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB80000.00000004.mdmp") Found string "ZipFile" (Source: "00000000-00006676.00000001.131830.1DEA0000.00000004.mdmp") Found string "ZipArchive" (Source: "00000000-00006676.00000001.131830.1DEA0000.00000004.mdmp") Found string "ZipArchiveMode" (Source: "00000000-00006676.00000001.131830.1DEA0000.00000004.mdmp") Found string "ZipFileExtensions" (Source: "00000000-00006676.00000001.131830.1DEA0000.00000004.mdmp") Found string "ZipArchiveEntry" (Source: "00000000-00006676.00000001.131830.1DEA0000.00000004.mdmp") Found string "bad compression" (Source: "00000000-00007364.00000000.130864.6B6C2000.00000004.mdmp, 00000000-00007364.00000001.130952.6B6C2000.00000004.mdmp")26:T60b,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00006676-00000BC0-1055559658") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00006676.00000000.131688.1DEB0000.00000004.mdmp, 00000000-00006676.00000001.131830.052C0000.00000004.mdmp, 00000000-00006676.00000001.131830.05360000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB20000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB40000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB80000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00006676.00000000.131688.1DEB0000.00000004.mdmp, 00000000-00006676.00000001.131830.052C0000.00000004.mdmp, 00000000-00006676.00000001.131830.05360000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB20000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB40000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB80000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00006676.00000000.131688.1DEB0000.00000004.mdmp, 00000000-00006676.00000001.131830.052C0000.00000004.mdmp, 00000000-00006676.00000001.131830.05360000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB20000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB40000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB80000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00006676.00000001.131830.1EB40000.00000004.mdmp")27:T78a,Found PE header "MZ" - Source: "00000000-00006676.00000000.131688.052A0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006676.00000000.131688.052E0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006676.00000000.131688.1DEB0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006676.00000001.131830.052C0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006676.00000001.131830.05360000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006676.00000001.131830.1DEA0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006676.00000001.131830.1EB20000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006676.00000001.131830.1EB40000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006676.00000001.131830.1EB80000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007512.00000000.132142.03B70000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007512.00000000.132142.03CD0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007512.00000000.132142.05A40000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007512.00000000.132142.05A50000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007512.00000000.132142.1E430000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007512.00000000.132142.1E440000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007512.00000001.134061.03CE0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007512.00000001.134061.03D20000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007512.00000001.134061.1E400000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007512.00000001.134061.1F180000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007512.00000001.134061.1F190000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007512.00000001.134061.1F1B0000.00000004.mdmp")28:T610,Found string - \.\root\cimv2; Source: "00000000-00006676.00000001.131830.1E520000.00000004.mdmp, 00000000-00006676.00000001.131830.1EC31000.00000004.mdmp") Found string - \\.\DISPLAY1; Source: "00000000-00007364.00000000.130864.E7BF0000.00000004.mdmp, 00000000-00007364.00000001.130952.E7BF0000.00000004.mdmp") Found string - \\.\DISPLAY2; Source: "00000000-00007364.00000000.130864.E7BF0000.00000004.mdmp, 00000000-00007364.00000001.130952.E7BF0000.00000004.mdmp") Found string - \\.\DISPLAY3; Source: "00000000-00007364.00000000.130864.E7BF0000.00000004.mdmp, 00000000-00007364.00000001.130952.E7BF0000.00000004.mdmp") Found string - \\.\DISPLAY4; Source: "00000000-00007364.00000000.130864.E7BF0000.00000004.mdmp, 00000000-00007364.00000001.130952.E7BF0000.00000004.mdmp") Found string - \\.\DISPLAY5; Source: "00000000-00007364.00000000.130864.E7BF0000.00000004.mdmp, 00000000-00007364.00000001.130952.E7BF0000.00000004.mdmp") Found string - \\.\DISPLAY6; Source: "00000000-00007364.00000000.130864.E7BF0000.00000004.mdmp, 00000000-00007364.00000001.130952.E7BF0000.00000004.mdmp") Found string - \\.\DISPLAY7; Source: "00000000-00007364.00000000.130864.E7BF0000.00000004.mdmp, 00000000-00007364.00000001.130952.E7BF0000.00000004.mdmp") Found string - \\.\DISPLAY8; Source: "00000000-00007364.00000000.130864.E7BF0000.00000004.mdmp, 00000000-00007364.00000001.130952.E7BF0000.00000004.mdmp") Found string - \.\S&; Source: "00000000-00007364.00000000.130864.EC830000.00000004.mdmp, 00000000-00007364.00000001.130952.EC830000.00000004.mdmp")29:T87e,"d=xz" - Source: "00000000-00007364.00000000.130864.EC830000.00000004.mdmp") Found URL "http://www.microsoft.com/typography/0e" - Source: "00000000-00007364.00000000.130864.EC830000.00000004.mdmp") Found URL "http://msdl.microsoft.com/download/symbols_nt_symbol_pathmsdia140.dllsrv*c:&" - Source: "00000000-00007364.00000001.130952.6B61F000.00000002.mdmp") Found URL "https://curl.se/docs/http-cookies.html" - Source: "00000000-00007364.00000001.130952.6B61F000.00000002.mdmp") Found URL "https://curl.se/docs/alt-svc.html" - Source: "00000000-00007364.00000001.130952.6B61F000.00000002.mdmp") Found URL "https://curl.se/docs/hsts.html" - Source: "00000000-00007364.00000001.130952.6B61F000.00000002.mdmp") Found URL "https://github.com/julietaula/montserrat)montserrat" - Source: "00000000-00007364.00000001.130952.6B6C2000.00000004.mdmp") Found URL "http://www.zkysky.com.ar/http://www.zkysky.com.ar/this" - Source: "00000000-00007364.00000001.130952.6B6C2000.00000004.mdmp") Found URL "http://scripts.sil.org/oflhttp://scripts.sil.org/oflmontserratmedium^" - Source: "00000000-00007364.00000001.130952.6B6C2000.00000004.mdmp") Found URL "https://github.com/julietaula/montserrat)montserratregular7.200;ula" - Source: "00000000-00007364.00000001.130952.6B6C2000.00000004.mdmp") Found URL "http://scripts.sil.org/oflhttp://scripts.sil.org/ofl^" - Source: "00000000-00007364.00000001.130952.6B6C2000.00000004.mdmp") Found URL "https://github.com/julietaula/montserrat)montserratbold7.200;ula" - Source: "00000000-00007364.00000001.130952.6B6C2000.00000004.mdmp") Found URL "https://github.com/julietaula/montserrat)montserratmedium7.200;ula" - Source: "00000000-00007364.00000001.130952.6B6C2000.00000004.mdmp") Found URL "http://scripts.sil.org/oflhttp://scripts.sil.org/oflnullabreveuni1eaeuni1eb6uni1eb0uni1eb2uni1eb4uni01cduni1ea4uni1eacuni1ea6uni1ea8uni1eaauni0200uni1ea0uni1ea2uni0202amacronaogonekaringacuteaeacuteuni1e08ccircumflexcdotaccentuni01c4dcarondcroatuni1e0cuni1e0euni01c5ebreveecaronuni1e1cuni1ebeuni1ec6uni1ec0uni1ec2uni1ec4uni0204edotaccentuni1eb8uni1ebauni0206emacronuni1e16uni1e14eogonekuni1ebcuni01b7uni01eegcarongcircumflexgcommaaccentgdotaccentuni1e20uni01e4hbaruni1e2auni021ehcircumflexuni1e24ibreveuni0208uni1e2euni1ecauni1ec8uni020aimacroniogonekitildeuni00a40301jcircumflexuni01e8kcommaaccentuni01c7lacutelcaronlcommaaccentldotuni1e36uni01c8uni1e3auni1e42uni01canacutencaronncommaaccentuni1e44uni1e46uni01cbuni1e48obreveuni1ed0uni1ed8uni1ed2uni1ed4uni1ed6uni020cuni022auni0230uni1eccuni1eceohornuni1edauni1ee2uni1edcuni1edeuni1ee0ohungarumlautuni020eomacronuni1e52uni1e50uni01eaoslashacuteuni1e4cuni1e4euni022cracutercaronrcommaaccentuni0210uni1e5auni0212uni1e5esacuteuni1e64unia78buni1e66scircumflexscommaaccentuni1e60uni1e62uni1e68uni1e9euni018ftbartcaronuni0162uni021auni1e6cuni1e6eubreveuni01d3uni0214uni1ee4uni1ee6uhornuni1ee8uni1ef0uni1eeauni1eecuni1eeeuhungarumlautuni0216umacronuni1e7auogonekuringutildeuni1e78wacutewcircumflex" - Source: "00000000-00007364.00000001.130952.6B6C2000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007364.00000001.130952.E7BF0000.00000004.mdmp") Found URL "http://www.microsoft.com/typographymicrosoft" - Source: "00000000-00007364.00000001.130952.EC830000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/mit_license)," - Source: "00000000-00007364.00000001.130952.EC830000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hd=xz" - Source: "00000000-00007364.00000001.130952.EC830000.00000004.mdmp") Found URL "http://www.microsoft.com/typography/0e" - Source: "00000000-00007364.00000001.130952.EC830000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007512.00000000.132142.03720000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mn%ydigicert" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0k%[" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcthawte," - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e0a0!0c0!156282604840,5628,6,ljbk31812604840,5628,3,nmaxcount,2,0,,400f%w0digicert" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?0l1" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l[$x" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.mi_com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://ocsp.digice:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007512.00000001.134061.204E0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007980.00000000.130635.03780000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00008012.00000001.131312.728D1000.00000020.mdmp")52:T48f,Found string "+ncalrpc:[OLEE746B0786A8AD003C72462C30FAA]" (Indicator: "ncalrpc"; Source: "00000000-00001572.00000000.130763.030C0000.00000004.mdmp") Found string "B+ncalrpc:[OLEE746B0786A8AD003C72462C30FAA]" (Indicator: "ncalrpc"; Source: "00000000-00001572.00000000.130763.0318A000.00000004.mdmp") Found string "+ncalrpc:[OLE061E3A34B4AA2C479D44027D32DE]" (Indicator: "ncalrpc"; Source: "00000000-00001572.00000000.130763.0318A000.00000004.mdmp") Found string "+ncalrpc:[OLEEE2AC4667DBA00146EC21200CDE4]" (Indicator: "ncalrpc"; Source: "00000000-00006676.00000000.131688.03020000.00000004.mdmp, 00000000-00006676.00000001.131830.03051000.00000004.mdmp") Found string "B+ncalrpc:[OLE481CEB6F3CD06CFD174791545DF2]" (Indicator: "ncalrpc"; Source: "00000000-00006676.00000001.131830.03051000.00000004.mdmp") Found string "B+ncalrpc:[OLEE746B0786A8AD003C72462C30FAA]" (Indicator: "ncalrpc"; Source: "00000000-00006676.00000001.131830.03051000.00000004.mdmp, 00000000-00006676.00000001.131830.1EC78000.00000004.mdmp") Found string "+ncalrpc:[OLEE746B0786A8AD003C72462C30FAA]" (Indicator: "ncalrpc"; Source: "00000000-00006676.00000001.131830.1EC5F000.00000004.mdmp")53:T943,"DCRatBuild.exe" called "FindFirstFileW" with parameter %TEMP%\DCRatBuild.exe (UID: 00000000-00001572) "DCRatBuild.exe" called "FindFirstFileW" with parameter cmSCee.bat (UID: 00000000-00001572) "DCRatBuild.exe" called "FindFirstFileW" with parameter \\?\C:\blockcomRuntimeNetdhcp\cmSCee.bat (UID: 00000000-00001572) "DCRatBuild.exe" called "FindFirstFileW" with parameter ProviderrefNet.exe (UID: 00000000-00001572) "DCRatBuild.exe" called "FindFirstFileW" with parameter \\?\C:\blockcomRuntimeNetdhcp\ProviderrefNet.exe (UID: 00000000-00001572) "DCRatBuild.exe" called "FindFirstFileW" with parameter RYrDDdpZeATTYmegPnT1MkjXy0XJG.vbe (UID: 00000000-00001572) "DCRatBuild.exe" called "FindFirstFileW" with parameter \\?\C:\blockcomRuntimeNetdhcp\RYrDDdpZeATTYmegPnT1MkjXy0XJG.vbe (UID: 00000000-00001572) "ProviderrefNet.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006676) "ProviderrefNet.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00006676) "ProviderrefNet.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006676) "ProviderrefNet.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006676) "ProviderrefNet.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006676) "ProviderrefNet.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006676) "ProviderrefNet.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006676) "ProviderrefNet.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00006676) "ProviderrefNet.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00006676) "ProviderrefNet.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00006676) "ProviderrefNet.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00006676) "ProviderrefNet.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00006676) "ProviderrefNet.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00006676) "ProviderrefNet.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\012idQW4GZte6d3a15f#\* (UID: 00000000-00006676)54:T1536,Found string "P~AeS" (Indicator: "aes"; Source: "00000000-00001572.00000000.130763.002AE000.00000004.mdmp") Found string "PQAeS~" (Indicator: "aes"; Source: "00000000-00001572.00000000.130763.002AE000.00000004.mdmp") Found string "8$4,6-9'$6.:*?#1pHhX~AeSlZrNbS" (Indicator: "aes"; Source: "00000000-00001572.00000000.130763.002AE000.00000004.mdmp") Found string "$4,8-9'66.:$?#1*HhXpAeS~ZrNlS" (Indicator: "aes"; Source: "00000000-00001572.00000000.130763.002AE000.00000004.mdmp") Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00001572.00000000.130763.05890000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00001572.00000000.130763.05890000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00001572.00000000.130763.05890000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00001572.00000000.130763.05890000.00000002.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006676.00000000.131688.03020000.00000004.mdmp, 00000000-00006676.00000001.131830.030E2000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00006676.00000000.131688.1DEB0000.00000004.mdmp, 00000000-00006676.00000001.131830.052C0000.00000004.mdmp, 00000000-00006676.00000001.131830.05360000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB20000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB40000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB80000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00006676.00000000.131688.1DEB0000.00000004.mdmp, 00000000-00006676.00000001.131830.052C0000.00000004.mdmp, 00000000-00006676.00000001.131830.05360000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB20000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB40000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB80000.00000004.mdmp") Found string "AesCryptoServiceProvider" (Indicator: "aes"; Source: "00000000-00006676.00000000.131688.1DEB0000.00000004.mdmp, 00000000-00006676.00000001.131830.052C0000.00000004.mdmp, 00000000-00006676.00000001.131830.05360000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB20000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB40000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB80000.00000004.mdmp") Found string "AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00006676.00000000.131688.1DEB0000.00000004.mdmp, 00000000-00006676.00000001.131830.052C0000.00000004.mdmp, 00000000-00006676.00000001.131830.05360000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB20000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB40000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB80000.00000004.mdmp") Found string "CreateDecryptor" (Indicator: "createdecryptor"; Source: "00000000-00006676.00000000.131688.1DEB0000.00000004.mdmp, 00000000-00006676.00000001.131830.052C0000.00000004.mdmp, 00000000-00006676.00000001.131830.05360000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB20000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB40000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB80000.00000004.mdmp") Found string "CreateEncryptor" (Indicator: "createencryptor"; Source: "00000000-00006676.00000000.131688.1DEB0000.00000004.mdmp, 00000000-00006676.00000001.131830.052C0000.00000004.mdmp, 00000000-00006676.00000001.131830.05360000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB20000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB40000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB80000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006676.00000000.131688.1DEB0000.00000004.mdmp, 00000000-00006676.00000001.131830.052C0000.00000004.mdmp, 00000000-00006676.00000001.131830.05360000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB20000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB40000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB80000.00000004.mdmp") Found string "Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006676.00000000.131688.1E520000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006676.00000000.131688.1E520000.00000004.mdmp, 00000000-00006676.00000001.131830.1E520000.00000004.mdmp") Found string "ZipFile" (Indicator: "zipfile"; Source: "00000000-00006676.00000001.131830.1DEA0000.00000004.mdmp") Found string "ZipFileExtensions" (Indicator: "zipfile"; Source: "00000000-00006676.00000001.131830.1DEA0000.00000004.mdmp") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00006676.00000001.131830.1EF60000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00006676.00000001.131830.1EF60000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00006676.00000001.131830.1EF60000.00000002.mdmp") Found string "System.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00006676.00000001.131830.1EF60000.00000002.mdmp")55:T5ac,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "f42816c2aeb32f892df5c3eda3fca63bba9aa1bd715f0b6aa94a6025dcdc82b1.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001572.00000000.130763.002A3000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001572.00000000.130763.002A3000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001572.00000000.130763.002A3000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001572.00000000.130763.002A3000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001572.00000000.130763.002A3000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006676.00000000.131688.052A0000.00000004.mdmp, 00000000-00006676.00000001.131830.1EB20000.00000004.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00006676.00000001.131830.052C0000.00000004.mdmp") Found reference to API "11084348353,6552,3121,,CreateToolhelp32Snapshot,kernel32.dll,"00:34:04.687",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007364.00000000.130864.E7BF0000.00000004.mdmp")56:T55e,Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "f42816c2aeb32f892df5c3eda3fca63bba9aa1bd715f0b6aa94a6025dcdc82b1.bin") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "f42816c2aeb32f892df5c3eda3fca63bba9aa1bd715f0b6aa94a6025dcdc82b1.bin") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "f42816c2aeb32f892df5c3eda3fca63bba9aa1bd715f0b6aa94a6025dcdc82b1.bin") Found reference to API "PathFindFileNameA" (Indicator: "PathFindFileName"; File: "f42816c2aeb32f892df5c3eda3fca63bba9aa1bd715f0b6aa94a6025dcdc82b1.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001572.00000000.130763.002A3000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001572.00000000.130763.002A3000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001572.00000000.130763.002A3000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001572.00000000.130763.002A3000.00000002.mdmp") Found reference to API "GetTempFileName" (Indicator: "GetTempFileName"; Source: "00000000-00006676.00000001.131830.052C0000.00000004.mdmp, 00000000-00006676.00000001.131830.1DEA0000.00000004.mdmp")57:T610,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001572.00000000.130763.030C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00006676.00000000.131688.03020000.00000004.mdmp, 00000000-00006676.00000001.131830.03051000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006676.00000000.131688.03020000.00000004.mdmp, 00000000-00006676.00000001.131830.03051000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00006676.00000001.131830.1E520000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\Device\"; Source: "00000000-00006676.00000001.131830.1E520000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00006676.00000001.131830.1E520000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007364.00000000.130864.E7BF0000.00000004.mdmp, 00000000-00007364.00000001.130952.E7BF0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\SharkHack.exe" (Indicator: "\Device\"; Source: "00000000-00007364.00000000.130864.E7BF0000.00000004.mdmp, 00000000-00007364.00000001.130952.E7BF0000.00000004.mdmp")58:Tb22," HTTP/1.1 200 OK\naccess-control-allow-origin: *\nx-content-type-options: nosniff\ncontent-type: application/json; charset=utf-8\nContent-Length: 325\ndate: Mon\n 09 Feb 2026 09:59:11 GMT\nvary: accept-encoding\nvia: 1.1 google\nAlt-Svc: h3=\":443\"; ma=2592000\nh3-29=\":443\"; ma=2592000 with response body ==>7B0A2020226970223A202236342E3132342E31322E313632222C0A202022686F73746E616D65223A202236342E3132342E31322E3136322E696469612D313434.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$42","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"DCRatBuild.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 72EE0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"ProviderrefNet.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at E9DB0000\n \"WinStore.App.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at E9DB0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 72920000\n \"ProviderrefNet.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 0F070000\n \"WinStore.App.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 121D0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"$43","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"ProviderrefNet.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at EB3B0000\n \"WinStore.App.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at EB3B0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"3E;71/.66*)fPdQ_PNHNHNH7*6.6.6.8\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$50","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$51","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /json HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53\nHost: ipinfo.io\nConnection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"ipinfo.io\" (6 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://ipinfo.io/json","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"ipinfo.io\" (89 days old)\n Short term registered certificate: \"sharkhack.pro\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"185.178.208.138\" on port \"443\"\n HTTPS traffic to \"34.117.59.81\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00001572\"\n YARA signature for AES encryption matched on process \"00000000-00007512\"\n YARA signature for AES encryption matched on process \"00000000-00006676\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$52","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00006676.00000000.131688.03020000.00000004.mdmp, 00000000-00006676.00000001.131830.03051000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"16826686248,7936,3024,,RtlGetVersion,NTDLL.dll,\"00:34:19.703\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006676.00000001.131830.1E520000.00000004.mdmp\")\n Found reference to API \"16207644032,7936,3024,,RtlGetVersion,NTDLL.dll,\"00:34:19.453\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006676.00000001.131830.1EC78000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: f42816c2aeb32f892df5c3eda3fca63bba9aa1bd715f0b6aa94a6025dcdc82b1.bin]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in \"00000000-00001572.00000000.130763.002A3000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00001572.00000000.130763.002A3000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"get_ProcessName\" (Source: \"00000000-00006676.00000001.131830.1EB20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\" Simonzh\"\n \"Idle.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"C:\\MSOCache\\All Users\\RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"\"C:\\MSOCache\\All Users\\RuntimeBroker.exe\"\" (Indicator: \"runtimebroker.exe\")\n \"che\\All Users\\RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"C:\\WINDOWS\\Temp\\AslLog_ApphelpDebug_RuntimeBroker.exe_3660.txt\" (Indicator: \"runtimebroker.exe\")\n \"C:\\WINDOWS\\Temp\\AslLog_shimengstate_RuntimeBroker.exe_3660.txt\" (Indicator: \"runtimebroker.exe\")\n \"C:\\WINDOWS\\Temp\\AslLog_ShimDebugLog_RuntimeBroker.exe_3660.txt\" (Indicator: \"runtimebroker.exe\")\n \"\" (Indicator: \"runtimebroker.exe\")\n \"schtasks.exe /create /tn \"RuntimeBrokerR\" /sc MINUTE /mo 7 /tr \"'C:\\MSOCache\\All Users\\RuntimeBroker.exe'\" /rl HIGHEST /f\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6989afa8e637c19b4b0adb8f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"