34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 66:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4ae,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSIL.LimeRAT.Generic Sample f5f67f6e64c6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f5f67f6e64c6…. Malware family: MSIL.LimeRAT.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 12 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40","keywords":["Malicious","MSIL.LimeRAT.Generic","malware analysis","sandbox report","threat intelligence","f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40"],"about":{"@type":"SoftwareApplication","name":"New-Client.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSIL.LimeRAT.Generic","antivirusDetections":{"malicious":19,"total":28},"behavioralIndicators":{"malicious":12,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T5a6,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "Write" in "f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "set_Position" in "f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Length" in "f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "Read" in "f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "ralphlauren.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "Write" in "ralphlauren.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "ralphlauren.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "set_Position" in "ralphlauren.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Length" in "ralphlauren.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "Read" in "ralphlauren.exe"37:T958,Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "ralphlauren.exe") file/memory contains long string with (Indicator: "MD5CryptoServiceProvider"; File: "ralphlauren.exe") file/memory contains long string with (Indicator: "Rijndael"; File: "ralphlauren.exe") file/memory contains long string with (Indicator: "RijndaelManaged"; File: "ralphlauren.exe") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "ralphlauren.exe") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00001096.00000000.237583.00312000.00000002.mdmp, 00000000-00001096.00000001.237747.05B50000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00001096.00000000.237583.00312000.00000002.mdmp, 00000000-00001096.00000001.237747.05B50000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00001096.00000000.237583.00312000.00000002.mdmp, 00000000-00001096.00000001.237747.05B50000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001096.00000000.237583.00312000.00000002.mdmp, 00000000-00001096.00000001.237747.05B50000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00001096.00000000.237583.00312000.00000002.mdmp, 00000000-00001096.00000001.237747.05B50000.00000004.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp, 00000000-00002860.00000002.241890.0886C000.00000004.mdmp")38:T464,Found string - \.\root\cimv2; Source: "00000000-00001096.00000000.237583.02820000.00000004.mdmp, 00000000-00001096.00000001.237747.02820000.00000004.mdmp, 00000000-00001096.00000001.237747.028B4000.00000004.mdmp") Found string - \.\root\cimv2; Source: "00000000-00002860.00000000.238051.03680000.00000004.mdmp, 00000000-00002860.00000001.239971.03680000.00000004.mdmp, 00000000-00002860.00000001.239971.03716000.00000004.mdmp, 00000000-00002860.00000001.239971.03743000.00000004.mdmp, 00000000-00002860.00000001.239971.0888E000.00000004.mdmp, 00000000-00002860.00000001.239971.09C1D000.00000004.mdmp, 00000000-00002860.00000001.239971.09C6A000.00000004.mdmp, 00000000-00002860.00000001.239971.09D11000.00000004.mdmp, 00000000-00002860.00000002.241890.03680000.00000004.mdmp, 00000000-00002860.00000002.241890.03716000.00000004.mdmp, 00000000-00002860.00000002.241890.03743000.00000004.mdmp, 00000000-00002860.00000002.241890.0886C000.00000004.mdmp, 00000000-00002860.00000002.241890.09C1F000.00000004.mdmp, 00000000-00002860.00000002.241890.09C6E000.00000004.mdmp, 00000000-00002860.00000002.241890.09D11000.00000004.mdmp")39:Te5e," HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:35:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding cf-cache-status: MISS CF-RAY: 9f3a3acb2ae6ed3a-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274....... "GET /raw/DDTVwwbu HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:35:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding Age: 0 cf-cache-status: HIT CF-RAY: 9f3a3ad0cda326d3-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274....... "GET /raw/DDTVwwbu HTTP/1.1 Host: pastebin.com Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:35:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding Age: 0 cf-cache-status: HIT CF-RAY: 9f3a3ad2dd88dfce-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274....... "GET /raw/DDTVwwbu HTTP/1.1 Host: pastebin.com Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:35:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding Age: 0 cf-cache-status: HIT CF-RAY: 9f3a3ad4c9d9ed3a-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274....... "GET /raw/DDTVwwbu HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:35:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding Age: 1 cf-cache-status: HIT CF-RAY: 9f3a3ad71b9edc04-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274....... "GET /raw/DDTVwwbu HTTP/1.1 Host: pastebin.com Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:35:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding Age: 1 cf-cache-status: HIT CF-RAY: 9f3a3ad99bf3eb2c-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274....... "GET /raw/DDTVwwbu HTTP/1.1 Host: pastebin.com Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:35:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding Age: 2 cf-cache-status: HIT CF-RAY: 9f3a3adbb8bb173a-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274....... "GET /raw/DDTVwwbu HTTP/1.1 Host: pastebin.com Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:36:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding Age: 2 cf-cache-status: HIT CF-RAY: 9f3a3adddce416a6-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274....... "GET /raw/DDTVwwbu HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:36:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding Age: 2 cf-cache-status: HIT CF-RAY: 9f3a3adfebe9b231-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274....... "GET /raw/DDTVwwbu HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:36:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding Age: 3 cf-cache-status: HIT CF-RAY: 9f3a3ae1ea02ed3a-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274....... "GET /raw/DDTVwwbu HTTP/1.1 Host: pastebin.com Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:36:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding Age: 3 cf-cache-status: HIT CF-RAY: 9f3a3ae4eea44e48-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274....... "GET /raw/DDTVwwbu HTTP/1.1 Host: pastebin.com Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:36:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding Age: 3 cf-cache-status: HIT CF-RAY: 9f3a3ae6ff8ff497-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274....... "GET /raw/DDTVwwbu HTTP/1.1 Host: pastebin.com Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:36:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding Age: 4 cf-cache-status: HIT CF-RAY: 9f3a3ae92fb749d2-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274....... "GET /raw/DDTVwwbu HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:36:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding Age: 4 cf-cache-status: HIT CF-RAY: 9f3a3aec48b450a1-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274....... "GET /raw/DDTVwwbu HTTP/1.1 Host: pastebin.com Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:36:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding Age: 5 cf-cache-status: HIT CF-RAY: 9f3a3aee3a9867f6-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274....... "GET /raw/DDTVwwbu HTTP/1.1 Host: pastebin.com Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:36:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding Age: 5 cf-cache-status: HIT CF-RAY: 9f3a3af24e4ef555-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274....... "GET /raw/DDTVwwbu HTTP/1.1 Host: pastebin.com Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:36:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding Age: 6 cf-cache-status: HIT CF-RAY: 9f3a3af44c51cfd5-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274....... "GET /raw/DDTVwwbu HTTP/1.1 Host: pastebin.com Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:36:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding Age: 6 cf-cache-status: HIT CF-RAY: 9f3a3af669b2df9a-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274....... "GET /raw/DDTVwwbu HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:36:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding Age: 6 cf-cache-status: HIT CF-RAY: 9f3a3af8be13fa96-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274....... "GET /raw/DDTVwwbu HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:36:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding Age: 7 cf-cache-status: HIT CF-RAY: 9f3a3afacc7d6c48-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274....... "GET /raw/DDTVwwbu HTTP/1.1 Host: pastebin.com Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:36:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding Age: 7 cf-cache-status: HIT CF-RAY: 9f3a3afcbab05f02-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274....... "GET /raw/DDTVwwbu HTTP/1.1 Host: pastebin.com Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:36:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding Age: 7 cf-cache-status: HIT CF-RAY: 9f3a3afea9bf5585-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274....... "GET /raw/DDTVwwbu HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:36:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding Age: 8 cf-cache-status: HIT CF-RAY: 9f3a3b00fdbaebe3-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274....... "GET /raw/DDTVwwbu HTTP/1.1 Host: pastebin.com Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:36:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding Age: 8 cf-cache-status: HIT CF-RAY: 9f3a3b02fb5cdc3c-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274....... "GET /raw/DDTVwwbu HTTP/1.1 Host: pastebin.com Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Date: Wed 29 Apr 2026 00:36:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 vary: accept-encoding Age: 8 cf-cache-status: HIT CF-RAY: 9f3a3b060bf12716-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A202020203C6D657461206E616D653D2276696577706F7274.......4b:T26ff,"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002860.00000001.239971.03750000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00002860.00000001.239971.03750000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00002860.00000001.239971.03750000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00002860.00000001.239971.03750000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00002860.00000001.239971.03750000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002860.00000001.239971.03750000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ydigicert" - Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysance_?02ancea?q8" - Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002860.00000001.239971.09BE7000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002860.00000001.239971.09C30000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002860.00000001.239971.09C30000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002860.00000001.239971.09C30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00002860.00000001.239971.09C6A000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002860.00000001.239971.09C6A000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lc7s3ance)z@gn1vssn[5]" - Source: "00000000-00002860.00000001.239971.09C6A000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002860.00000002.241890.03680000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002860.00000002.241890.03727000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*loctype" - Source: "00000000-00002860.00000002.241890.03727000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002860.00000002.241890.03727000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002860.00000002.241890.03727000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002860.00000002.241890.03727000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00002860.00000002.241890.03750000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002860.00000002.241890.03750000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l>b5." - Source: "00000000-00002860.00000002.241890.03750000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002860.00000002.241890.03750000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002860.00000002.241890.03750000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002860.00000002.241890.03750000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?emgvw,czc%wvflw.<" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ydigicert" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysance_?02ancea?q8" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002860.00000002.241890.08912000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00002860.00000002.241890.08912000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lc" - Source: "00000000-00002860.00000002.241890.08912000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00002860.00000002.241890.08912000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00002860.00000002.241890.08912000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00002860.00000002.241890.08912000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00002860.00000002.241890.08912000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002860.00000002.241890.08912000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00002860.00000002.241890.08912000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lp-fvvf82aroot\cimv2cim_pcvideocontrollercim_videocontrollercim_controllercim_logicaldevicecim_logicalelementcim_managedsystemelementwuuuwin32_videocontrollercimwin32localeuuid" - Source: "00000000-00002860.00000002.241890.08912000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00002860.00000002.241890.09BE0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002860.00000002.241890.09C28000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002860.00000002.241890.09C28000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002860.00000002.241890.09C28000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lance%'q%kfp" - Source: "00000000-00002860.00000002.241890.09C6E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00002860.00000002.241890.09CBB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002860.00000002.241890.09CBB000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l_gv$+'nzte3e(z_gv$_gv$uint32mappingstringswin32api" - Source: "00000000-00002860.00000002.241890.09CBB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002860.00000002.241890.09CF8000.00000004.mdmp")59:T925,Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001096.00000000.237583.02820000.00000004.mdmp, 00000000-00001096.00000001.237747.02820000.00000004.mdmp") Found string "+ncalrpc:[OLE2CBA5478BD971DE34390EDABD97B]" (Indicator: "ncalrpc"; Source: "00000000-00001096.00000000.237583.02820000.00000004.mdmp, 00000000-00001096.00000001.237747.02820000.00000004.mdmp") Found string "+ncalrpc:[OLE22F729157F49894E229844E87448]" (Indicator: "ncalrpc"; Source: "00000000-00001096.00000000.237583.02820000.00000004.mdmp, 00000000-00001096.00000001.237747.02820000.00000004.mdmp") Found string "B+ncalrpc:[OLE2CBA5478BD971DE34390EDABD97B]" (Indicator: "ncalrpc"; Source: "00000000-00001096.00000000.237583.02820000.00000004.mdmp, 00000000-00001096.00000001.237747.02820000.00000004.mdmp, 00000000-00001096.00000001.237747.028B4000.00000004.mdmp") Found string "+ncalrpc:[OLE90B0136A3925F7A4C2176567CA14]" (Indicator: "ncalrpc"; Source: "00000000-00001096.00000001.237747.02820000.00000004.mdmp, 00000000-00001096.00000001.237747.028F3000.00000004.mdmp") Found string "B+ncalrpc:[OLE90B0136A3925F7A4C2176567CA14]" (Indicator: "ncalrpc"; Source: "00000000-00001096.00000001.237747.028B4000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00002860.00000000.238051.03680000.00000004.mdmp, 00000000-00002860.00000001.239971.03680000.00000004.mdmp, 00000000-00002860.00000002.241890.03680000.00000004.mdmp") Found string "+ncalrpc:[OLE2CBA5478BD971DE34390EDABD97B]" (Indicator: "ncalrpc"; Source: "00000000-00002860.00000000.238051.03680000.00000004.mdmp, 00000000-00002860.00000001.239971.03680000.00000004.mdmp, 00000000-00002860.00000002.241890.03680000.00000004.mdmp") Found string "+ncalrpc:[OLE228904646E08625FCCFDD411D575]" (Indicator: "ncalrpc"; Source: "00000000-00002860.00000000.238051.03680000.00000004.mdmp, 00000000-00002860.00000001.239971.03680000.00000004.mdmp, 00000000-00002860.00000002.241890.03680000.00000004.mdmp") Found string "B+ncalrpc:[OLE2CBA5478BD971DE34390EDABD97B]" (Indicator: "ncalrpc"; Source: "00000000-00002860.00000000.238051.03680000.00000004.mdmp, 00000000-00002860.00000001.239971.09C9E000.00000004.mdmp, 00000000-00002860.00000002.241890.09C6E000.00000004.mdmp")5a:T44b,Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00001096.00000000.237583.02820000.00000004.mdmp, 00000000-00001096.00000001.237747.02820000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00002860.00000000.238051.03680000.00000004.mdmp, 00000000-00002860.00000001.239971.03680000.00000004.mdmp, 00000000-00002860.00000001.239971.0888E000.00000004.mdmp, 00000000-00002860.00000002.241890.03680000.00000004.mdmp, 00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found string ":\WINDOWS\SysWOW64\Kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp, 00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp, 00000000-00002860.00000002.241890.0886C000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00002860.00000001.239971.0888E000.00000004.mdmp, 00000000-00002860.00000002.241890.0886C000.00000004.mdmp")5b:T1172,Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; File: "f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00001096.00000000.237583.00312000.00000002.mdmp, 00000000-00001096.00000001.237747.05B50000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001096.00000000.237583.02820000.00000004.mdmp, 00000000-00001096.00000001.237747.02820000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001096.00000000.237583.02820000.00000004.mdmp, 00000000-00001096.00000001.237747.02820000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001096.00000000.237583.02820000.00000004.mdmp, 00000000-00001096.00000001.237747.02820000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001096.00000000.237583.02820000.00000004.mdmp, 00000000-00001096.00000001.237747.02820000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001096.00000000.237583.02820000.00000004.mdmp, 00000000-00001096.00000001.237747.02820000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001096.00000000.237583.02820000.00000004.mdmp, 00000000-00001096.00000001.237747.02820000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001096.00000000.237583.02820000.00000004.mdmp, 00000000-00001096.00000001.237747.02820000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001096.00000000.237583.02820000.00000004.mdmp, 00000000-00001096.00000001.237747.02820000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002860.00000000.238051.03680000.00000004.mdmp, 00000000-00002860.00000001.239971.03680000.00000004.mdmp, 00000000-00002860.00000002.241890.03680000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002860.00000000.238051.03680000.00000004.mdmp, 00000000-00002860.00000001.239971.03680000.00000004.mdmp, 00000000-00002860.00000002.241890.03680000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002860.00000000.238051.03680000.00000004.mdmp, 00000000-00002860.00000001.239971.03680000.00000004.mdmp, 00000000-00002860.00000002.241890.03680000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002860.00000000.238051.03680000.00000004.mdmp, 00000000-00002860.00000001.239971.03680000.00000004.mdmp, 00000000-00002860.00000002.241890.03680000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002860.00000000.238051.03680000.00000004.mdmp, 00000000-00002860.00000001.239971.03680000.00000004.mdmp, 00000000-00002860.00000002.241890.03680000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002860.00000000.238051.03680000.00000004.mdmp, 00000000-00002860.00000001.239971.03680000.00000004.mdmp, 00000000-00002860.00000002.241890.03680000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002860.00000000.238051.03680000.00000004.mdmp, 00000000-00002860.00000001.239971.03680000.00000004.mdmp, 00000000-00002860.00000002.241890.03680000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002860.00000000.238051.03680000.00000004.mdmp, 00000000-00002860.00000001.239971.03680000.00000004.mdmp, 00000000-00002860.00000002.241890.03680000.00000004.mdmp")5c:T9e4,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001096.00000000.237583.02820000.00000004.mdmp, 00000000-00001096.00000001.237747.02820000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002860.00000000.238051.03680000.00000004.mdmp, 00000000-00002860.00000001.239971.03680000.00000004.mdmp, 00000000-00002860.00000002.241890.03680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$37","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Load\" in \"f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin\"\n Observed function \"System.Load\" in \"ralphlauren.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"ralphlauren.exe\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"ralphlauren.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethods\" in \"f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin\"\n Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin\"\n Observed namespace \"System\" and MemberReference \"GetMethods\" in \"ralphlauren.exe\"\n Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"ralphlauren.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001096.00000001.237747.05B50000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$38","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$39","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$3a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"cription=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002860.00000001.239971.0888E000.00000004.mdmp, 00000000-00002860.00000002.241890.0886C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin\"\n Observed function \"ToBase64String\" in \"f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin\"\n Observed function \"FromBase64String\" in \"ralphlauren.exe\"\n Observed function \"ToBase64String\" in \"ralphlauren.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; File: \"f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin\")\n file/memory contains long string with (Indicator: \"CreateDecryptor\"; File: \"ralphlauren.exe\")\n Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00001096.00000000.237583.00312000.00000002.mdmp, 00000000-00001096.00000001.237747.05B50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin\")\n file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"ralphlauren.exe\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00001096.00000000.237583.00312000.00000002.mdmp, 00000000-00001096.00000001.237747.05B50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin\"]\n Observed namespace \"System.Security.Cryptography\" in [Source: \"ralphlauren.exe\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"cription=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002860.00000001.239971.0888E000.00000004.mdmp, 00000000-00002860.00000002.241890.0886C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin\"\n Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"ralphlauren.exe\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin\"\n Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"ralphlauren.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00002860.00000001.239971.0888E000.00000004.mdmp, 00000000-00002860.00000002.241890.0886C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains symmetric decryption functionality in .NET code","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin\"\n Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"ralphlauren.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"pastebin\" in header \"GET /raw/DDTVwwbu HTTP/1.1Host: pastebin.comConnection: Keep-Alive\"\n Contains base64 string in header \"Keep\" in header \"GET /raw/DDTVwwbu HTTP/1.1Host: pastebin.comConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$3b","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002860-00000C2C-2654968555\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetDirectories\" in \"f5f67f6e64c6524f7cd1dcda342b95c9c175f86e7e2c10c24dd5af478f0a0b40.bin\"\n Observed dotnet function \"GetDirectories\" in \"ralphlauren.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002860-00000C2C-2654968555\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00001096-00000C2C-2643689447\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00001096-00000C2C-2643690286\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001096-00000C2C-2648169725\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001096-00000C2C-2648169750\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002860-00000C2C-2656105076\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00001096.00000000.237583.02820000.00000004.mdmp, 00000000-00001096.00000001.237747.02820000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00002860.00000000.238051.03680000.00000004.mdmp, 00000000-00002860.00000001.239971.03680000.00000004.mdmp, 00000000-00002860.00000002.241890.03680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69f15241b61e818c5f00f84c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"