26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 61:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4bb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mikey.Generic Sample fa52858cd7c9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample fa52858cd7c9…. Malware family: Mikey.Generic. Threat score 100/100. 9/28 AV engines flagged this file. 15 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4","keywords":["Malicious","Mikey.Generic","malware analysis","sandbox report","threat intelligence","fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4"],"about":{"@type":"SoftwareApplication","name":"fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin","applicationCategory":["peexe","executable"],"identifier":"fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mikey.Generic","antivirusDetections":{"malicious":9,"total":28},"behavioralIndicators":{"malicious":15,"suspicious":28},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T8ea,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00001668.00000000.144860.3D670000.00000004.mdmp, 00000000-00001668.00000000.144860.57B60000.00000004.mdmp, 00000000-00001668.00000001.145074.3D670000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00001668.00000000.144860.3D670000.00000004.mdmp, 00000000-00001668.00000001.145074.3D670000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00001668.00000000.144860.3D670000.00000004.mdmp, 00000000-00001668.00000001.145074.3D670000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found string "ile:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\" (Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" (Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" (Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" (Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" (Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp")28:T976,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") file/memory contains long string with (Indicator: "SleepEx"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTickCount64"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") file/memory contains long string with (Indicator: "SetWaitableTimer"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001668.00000000.144860.6D792000.00000002.mdmp, 00000000-00001668.00000001.145074.4AA4A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001668.00000000.144860.6D792000.00000002.mdmp, 00000000-00001668.00000001.145074.4AA4A000.00000002.mdmp")29:T587,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") file/memory contains long string with (Indicator: "LoadLibrary"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found reference to API "golang.org/x/sys/windows.LoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found reference to API "golang.org/x/sys/windows._LoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001668.00000000.144860.6D792000.00000002.mdmp, 00000000-00001668.00000001.145074.4AA4A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001668.00000000.144860.6D792000.00000002.mdmp, 00000000-00001668.00000001.145074.4AA4A000.00000002.mdmp")2a:T884,"34ec68d08177_b_e23ef6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\8CF427FD790C3AD166068DE81E57EFBB932272D4") "34ec68d08177_b_e23ef6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\8CF427FD790C3AD166068DE81E57EFBB932272D4") "34ec68d08177_b_e23ef6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\91C6D6EE3E8AC86384E548C299295C756C817B81") "34ec68d08177_b_e23ef6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\91C6D6EE3E8AC86384E548C299295C756C817B81") "34ec68d08177_b_e23ef6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436") "34ec68d08177_b_e23ef6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436") "34ec68d08177_b_e23ef6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\AD7E1C28B064EF8F6003402014C3D0E3370EB58A") "34ec68d08177_b_e23ef6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\AD7E1C28B064EF8F6003402014C3D0E3370EB58A") "34ec68d08177_b_e23ef6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4") "34ec68d08177_b_e23ef6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4") "34ec68d08177_b_e23ef6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\B12E13634586A46F1AB2606837582DC4ACFD9497") "34ec68d08177_b_e23ef6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\B12E13634586A46F1AB2606837582DC4ACFD9497") "34ec68d08177_b_e23ef6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\B1BC968BD4F49D622AA89A81F2150152A41D829C")2b:Tae9,"status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: running < 0runtime: g : frame.sp=created by bad messagefile existsbad addressi/o timeoutgocachehashgocachetesthttp2clienthttp2serverrandseednoparchive/tartls10servercrypto/x509archive/zipClassHESIODcomdlg32.dllCfgMgr32.dlladvapi32.dlliphlpapi.dllkernel32.dllnetapi32.dllsetupapi.dllwintrust.dllwtsapi32.dllGetLengthSidOpenServiceWReportEventWRevertToSelfCreateEventWCreateMutexWGetLastErrorGetProcessIdGetStdHandleGetTempPathWLoadLibraryWLoadResourceLockResourceReadConsoleWReleaseMutexResumeThreadSetEndOfFileSetErrorModeSetStdHandleThread32NextUnlockFileExVirtualAllocVirtualQueryTransmitFileNtCreateFileCoCreateGuidGetAddrInfoW152587890625762939453125GetConsoleCPsweepWaiterscleanupQueuetraceStringsspanSetSpinemspanSpecialtraceTypeTabgcBitsArenasmheapSpecialgcpacertraceharddecommitmadvdontneeddumping heapchan receivesynctest.Runcleanup wait span.limit= span.state=bad flushGen MB stacks, scan: total scan: class worker mode nDataRoots= nSpanRoots= wbuf1= wbuf2= gcscandone runtime: gp= found at *( s.elemsize= B (" (Indicator: "enumwindows"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found reference to API "morebuf={pc:: no frame (sp=runtime: frame ts set in timertraceback stuckunexpected kindadvertise errorkey has expirednetwork is downno medium foundno such processRegCreateKeyExWRegDeleteValueWjstmpllitinterptarinsecurepathx509keypairleafx509usepolicieszipinsecurepathGetOpenFileNameWGetSaveFileNameW0123456789abcdefTerminateProcessDuplicateTokenExOpenProcessTokenRegQueryInfoKeyWRegQueryValueExWSetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectDnsNameCompare_WConnectNamedPipeCreateDirectoryWCreateJobObjectWCreateNamedPipeWDefineDosDeviceWFindFirstVolumeWFlushFileBuffersGetComputerNameWGetFullPathNameWGetLogicalDrivesGetLongPathNameWGetNamedPipeInfoGetPriorityClassRemoveDirectoryWSetDllDirectoryWSetPriorityClassVirtualProtectExNetApiBufferFreeRtlGetCurrentPebEnumChildWindowsGetDesktopWindowGetGUIThreadInfoWinVerifyTrustEx23841857910156250123456789ABCDEFGetCurrentThreadGetModuleHandleWRtlVirtualUnwindinteger overflowdecoratemappingsgcshrinkstackofftracefpunwindoffGC scavenge waitGC worker (idle)page trace flushselect (durable)heap reservation/gc/gogc:percent, not a functiongc: unswept span KiB work (bg), mheap.sweepgen=runtime: nelems=workbuf is emptymSpanList.removemSpanList.insertbad special kindpage alloc indexbad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod" (Indicator: "enumchildwindows"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp")33:T2824,"status is not in scan state is currently not supported for use in system callbacksstrings: illegal use of non-zero Builder copied by valuenon-empty pointer map passed for non-pointer-size valuesfailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= runtime: checkmarks found unexpected unmarked object obj=reflect: reflect.Value.Elem on an invalid notinheap pointertried to trace goroutine with invalid or unsupported statusreflect: call of reflect.Value.Len on ptr to non-array Valuemanual span allocation called with non-manually-managed typeaddr range base and limit are not in the same memory segmentruntime: netpoll: PostQueuedCompletionStatus failed (errno= runtime: malformed profBuf buffer - tag and data out of sync is in a tiny block with other (possibly long-lived) values" in Source: 00000000-00000304.00000001.143861.1F14C000.00000002.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001668.00000000.144860.3D670000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001668.00000000.144860.3D670000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001668.00000000.144860.57B60000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001668.00000001.145074.3D670000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001668.00000001.145074.3D670000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00001668.00000001.145074.4AA4A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00001668.00000001.145074.4AA4A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00001668.00000001.145074.4AA4A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001668.00000001.145074.4AA4A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00001668.00000001.145074.4AA4A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00001668.00000001.145074.4AA4A000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001668.00000001.145074.57B60000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00001668.00000001.145074.5815C000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001668.00000001.145074.5815C000.00000004.mdmp "hine\Software\ClassK" in Source: 00000000-00001668.00000001.145074.581C1000.00000004.mdmp "\Registry\Machine\Software\Classes\C" in Source: 00000000-00001668.00000001.145074.58241000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-000" in Source: 00000000-00001668.00000001.145074.58241000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001668.00000001.145074.58241000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007196.00000001.145679.009A8000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007196.00000002.147599.00970000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}" in Source: 00000000-00007196.00000002.147599.00970000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020404-0000-0000-C000-000000000046}" in Source: 00000000-00007196.00000002.147599.00970000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}" in Source: 00000000-00007196.00000002.147599.00970000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}" in Source: 00000000-00007196.00000002.147599.00970000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}" in Source: 00000000-00007196.00000002.147599.00970000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}" in Source: 00000000-00007196.00000002.147599.00970000.00000004.mdmp "ine\Software\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}" in Source: 00000000-00007196.00000002.147599.00970000.00000004.mdmp "Registry\Machine\Software\Classes\InterfaceA" in Source: 00000000-00007196.00000002.147599.00970000.00000004.mdmp "stry\Machine\Software\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}" in Source: 00000000-00007196.00000002.147599.00970000.00000004.mdmp "SOFTWARE\VMware, Inc.\VMware Tools" in Source: 00000000-00008096.00000000.143634.033E0000.00000004.mdmp3f:T471,"dep github.com/tawesoft/golib/v2 v2.5.2 h1:EBVQvl0ZP72hxEoXvL1Zl3U+hiF9hz0e1sjk0PJ/RlE=" (Indicator: "github.com") "github.com/tawesoft/golib/v2/ks.Never" (Indicator: "github.com") "github.com/tawesoft/golib/v2/dialog.init" (Indicator: "github.com") "github.com/tawesoft/golib/v2/dialog.wide" (Indicator: "github.com") "github.com/tawesoft/golib/v2/must.Result[go.shape.*uint8]" (Indicator: "github.com") "github.com/tawesoft/golib/v2/dialog.Message.flags" (Indicator: "github.com") "github.com/tawesoft/golib/v2/dialog.Message.raise" (Indicator: "github.com") "github.com/tawesoft/golib/v2/dialog.IconType.iconFlag" (Indicator: "github.com") "github.com/tawesoft/golib/v2/dialog.Message.Raise" (Indicator: "github.com") "github.com/tawesoft/golib/v2/dialog.Message.clear" (Indicator: "github.com") "github.com/tawesoft/golib/v2@v2.5.2/ks/kitchensink.go" (Indicator: "github.com") "github.com/tawesoft/golib/v2@v2.5.2/dialog/dialog-win.go" (Indicator: "github.com") "github.com/tawesoft/golib/v2@v2.5.2/must/must.go" (Indicator: "github.com") "github.com/tawesoft/golib/v2@v2.5.2/dialog/dialog.go" (Indicator: "github.com")40:Ta5f,"GET /sa1at/ HTTP/1.1 Host: salat.cn User-Agent: Go-http-client/1.1 Content-Length: 354 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 500 Internal Server Error Date: Wed 22 Apr 2026 17:24:14 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=12 cfOrigin;dur=431 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=wkO18HkFLxqJ47%2F54iXCkUUgXam3oJT8RiX3rJaEHU9gxWf6KmVANiXPmtWijWw%2FbObS8i0YM9P8%2Fam%2BiT1%2FvNaBNvjHM3Z5zEdw8nfuu06cDigX1MKrqFYG6w%3D%3D"}]} CF-RAY: 9f065221f8421975-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Wed 22 Apr 2026 17:24:19 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: 9f065244cc2974f9-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 404 Not Found Date: Wed 22 Apr 2026 17:24:20 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: 9f0652490be15e16-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B226572726F72223A226E6F74207265736F6C7665643A2063616E277420756E6D61727368616C206E756C6C227D.......41:T485f,"?@^_`{|}~src\main.rs" Heuristic match: "salat.cn" Heuristic match: "tonapi.io" Pattern match: "remoteadministratortool.ton/resolve" Heuristic match: "cloudflare-dns.com" Heuristic match: "i#.su" Heuristic match: "mainlibrary\std\src\thread\local.rs" Heuristic match: "rust_backtracemainlibrary\std\src\thread\local.rs" Heuristic match: "library\std\src\panicking.rs" Heuristic match: "creating or truncating a file requires write or append accesslibrary\std\src\sys\pal\windows\mod.rs" Heuristic match: "must specify at least one of read, write, or append accesscreating or truncating a file requires write or append accesslibrary\std\src\sys\pal\windows\mod.rs" Heuristic match: "()/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\str\pattern.rs" Heuristic match: ".llvm./rust/deps\rustc-demangle-0.1.26\src\lib.rs" Heuristic match: "fromutf8errorbytes/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\wtf8.rs" Heuristic match: "errorlibrary\std\src\io\stdio.rs" Heuristic match: "bytes/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\wtf8.rs" Heuristic match: "thread name may not contain interior null byteslibrary\std\src\thread\mod.rs" Heuristic match: "errorcustomerrorlibrary\std\src\io\stdio.rs" Heuristic match: "0/rust/deps\rustc-demangle-0.1.26\src\v0.rs" Heuristic match: "kindmessagekinderrorcustomerrorlibrary\std\src\io\stdio.rs" Heuristic match: "failed to spawn thread/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\std\src\thread\mod.rs" Heuristic match: "messagekinderrorcustomerrorlibrary\std\src\io\stdio.rs" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "*abi.name" Heuristic match: "*godebugs.info" Pattern match: "golang.org/x/sys/windows" Pattern match: "golang.org/x/net/dns/dnsmessage" Pattern match: "github.com/tawesoft/golib/v2" Pattern match: "golang.org/x/exp" Pattern match: "golang.org/x/sys" Pattern match: "golang.org/x/text" Heuristic match: "internal/abi.name.name" Heuristic match: "internal/cpu.name" Heuristic match: "type:.eq.internal/godebugs.info" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.(*polldesc).info" Heuristic match: "runtime.srcfunc.name" Heuristic match: "errors.is" Pattern match: "eq.sync/atomic.bool" Pattern match: "eq.sync/atomic.int32" Pattern match: "eq.sync/atomic.uint32" Pattern match: "eq.sync/atomic.uint64" Heuristic match: "sync.(*once).do" Pattern match: "eq.sync/atomic.pointer[sync.poolchainelt" Pattern match: "eq.sync/atomic.pointer[internal/sync.indirect[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.node[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[go.shape.interface" Pattern match: "eq.sync/atomic.pointer[go.shape.struct" Heuristic match: "reflect.flag.ro" Heuristic match: "reflect.value.int" Pattern match: "eq.sync/atomic.pointer[internal/bisect.dedup" Heuristic match: "internal/godebug.(*setting).name" Pattern match: "eq.sync/atomic.pointer[internal/godebug.value" Heuristic match: "syscall.errno.is" Heuristic match: "syscall.(*errno).is" Pattern match: "eq.io/fs.patherror" Pattern match: "eq.sync/atomic.pointer[os.dirinfo" Pattern match: "github.com/tawesoft/golib/v2/ks.never" Pattern match: "eq.sync/atomic.pointer[internal/sync.indirect[*internal/abi.type,interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[*internal/abi.type,interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.node[*internal/abi.type,interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[go.shape.*internal/abi.type,go.shape.interface" Pattern match: "eq.net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[unique.node[net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[unique.entry[net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[unique.indirect[net/netip.addrdetail" Pattern match: "hash.net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[unique.entry[go.shape.struct" Pattern match: "golang.org/x/net/dns/dnsmessage.init" Pattern match: "golang.org/x/sys/windows.init" Pattern match: "golang.org/x/sys/windows.(*dllerror).error" Pattern match: "golang.org/x/sys/windows.(*dllerror).unwrap" Pattern match: "golang.org/x/sys/windows.loaddll" Pattern match: "golang.org/x/sys/windows.utf16ptrfromstring" Pattern match: "golang.org/x/sys/windows.(*dll).findproc" Pattern match: "golang.org/x/sys/windows.byteptrfromstring" Pattern match: "golang.org/x/sys/windows.(*lazydll).load" Pattern match: "golang.org/x/sys/windows.(*lazydll).load.deferwrap1" Pattern match: "golang.org/x/sys/windows.(*lazyproc).find" Pattern match: "golang.org/x/sys/windows.(*lazyproc).find.deferwrap1" Pattern match: "golang.org/x/sys/windows.initcandosearchsystem32" Pattern match: "golang.org/x/sys/windows.(*lazydll).newproc" Pattern match: "golang.org/x/sys/windows.loadlibraryex" Pattern match: "golang.org/x/sys/windows.candosearchsystem32" Pattern match: "golang.org/x/sys/windows.isbasename" Pattern match: "golang.org/x/sys/windows.getsystemdirectory" Pattern match: "golang.org/x/sys/windows.byteslicefromstring" Pattern match: "golang.org/x/sys/windows.utf16fromstring" Pattern match: "golang.org/x/sys/windows.utf16tostring" Pattern match: "golang.org/x/sys/windows.getstdhandle" Pattern match: "golang.org/x/sys/windows.(*lazyproc).addr" Pattern match: "golang.org/x/sys/windows.(*lazyproc).mustfind" Pattern match: "golang.org/x/sys/windows.(*proc).addr" Pattern match: "golang.org/x/sys/windows.errnoerr" Pattern match: "golang.org/x/sys/windows._loadlibraryex" Pattern match: "golang.org/x/sys/windows.messagebox" Pattern match: "eq.golang.org/x/sys/windows.dllerror" Pattern match: "eq.golang.org/x/sys/windows.dll" Pattern match: "eq.golang.org/x/sys/windows.proc" Pattern match: "eq.golang.org/x/sys/windows.lazydll" Pattern match: "eq.golang.org/x/sys/windows.lazyproc" Pattern match: "eq.sync/atomic.pointer[string" Pattern match: "golang.org/x/text/unicode/bidi.lookuprune" Pattern match: "golang.org/x/text/unicode/bidi.lookup" Pattern match: "golang.org/x/text/unicode/bidi.(*biditrie).lookupvalue" Pattern match: "golang.org/x/text/unicode/bidi.init" Pattern match: "github.com/tawesoft/golib/v2/dialog.init" Pattern match: "github.com/tawesoft/golib/v2/dialog.wide" Pattern match: "github.com/tawesoft/golib/v2/must.result[go.shape.*uint8" Pattern match: "github.com/tawesoft/golib/v2/dialog.message.flags" Pattern match: "golang.org/x/text/unicode/bidi.properties.class" Pattern match: "github.com/tawesoft/golib/v2/dialog.message.raise" Pattern match: "github.com/tawesoft/golib/v2/dialog.icontype.iconflag" Pattern match: "github.com/tawesoft/golib/v2/dialog.message.clear" Pattern match: "github.com/tawesoft/golib/v2@v2.5.2/ks/kitchensink.go" Pattern match: "golang.org/x/net/dns/dnsmessage/message.go" Pattern match: "golang.org/x/sys@v0.2.0/windows/syscall_windows.go" Pattern match: "golang.org/x/sys@v0.2.0/windows/zsyscall_windows.go" Pattern match: "golang.org/x/sys@v0.2.0/windows/dll_windows.go" Pattern match: "golang.org/x/sys@v0.2.0/windows/syscall.go" Pattern match: "golang.org/x/sys@v0.2.0/windows/security_windows.go" Pattern match: "golang.org/x/text@v0.3.7/unicode/bidi/prop.go" Pattern match: "golang.org/x/text@v0.3.7/unicode/bidi/tables13.0.0.go" Pattern match: "golang.org/x/text@v0.3.7/unicode/bidi/trieval.go" Pattern match: "github.com/tawesoft/golib/v2@v2.5.2/dialog/dialog-win.go" Pattern match: "github.com/tawesoft/golib/v2@v2.5.2/must/must.go" Pattern match: "github.com/tawesoft/golib/v2@v2.5.2/dialog/dialog.go" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "orlib.ni" Heuristic match: "ntrust.net" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Heuristic match: "ystem.management.au" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Heuristic match: "trust.ne" Pattern match: "http://www.microsoft.com0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "w.entrust.net/cp" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimsta" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/windows" Pattern match: "crl.microsoft.com/pki/crl/products/mi#" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Heuristic match: "windows-defender-management-powershell-group-package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "windows-defender-management-powershell-group-wow64-package~31bf3856ad364e35~amd64~~10.0.16299.15.cat"53:T975c,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000304.00000000.143842.E6EA0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000304.00000001.143861.E6EA0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?elu=;nu=;mu=;globalsign" - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;lu=;nu=;mu=;0" - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0pu=;uz_]" - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l09f[" - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3geotrust" - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimsta-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00001668.00000000.144860.58040000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mi" - Source: "00000000-00001668.00000000.144860.58040000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001668.00000000.144860.58040000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00001668.00000000.144860.6D792000.00000002.mdmp") Found URL "http://msdn.microsoft.com/en-us/library/yfsftwz6.aspx" - Source: "00000000-00001668.00000001.145074.4F820000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema" - Source: "00000000-00001668.00000001.145074.4F820000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00001668.00000001.145074.57B60000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?elu=;nu=;mu=;globalsign" - Source: "00000000-00001668.00000001.145074.57B60000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001668.00000001.145074.57B60000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001668.00000001.145074.57B60000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001668.00000001.145074.57B60000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001668.00000001.145074.57B60000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001668.00000001.145074.57B60000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;lu=;nu=;mu=;0" - Source: "00000000-00001668.00000001.145074.57B60000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001668.00000001.145074.57B60000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001668.00000001.145074.57B60000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001668.00000001.145074.57B60000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001668.00000001.145074.57B60000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001668.00000001.145074.57B60000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0pu=;uz_]" - Source: "00000000-00001668.00000001.145074.57B60000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00001668.00000001.145074.57B60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001668.00000001.145074.57B60000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3geotrust" - Source: "00000000-00001668.00000001.145074.57B60000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00001668.00000001.145074.57B60000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00001668.00000001.145074.57B60000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00001668.00000001.145074.57B60000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001668.00000001.145074.57B60000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00001668.00000001.145074.57B60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001668.00000001.145074.57BF3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00001668.00000001.145074.581C1000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr4e" - Source: "00000000-00007196.00000000.143760.05800000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00007196.00000000.143760.05800000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00007196.00000000.143760.05800000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpmo" - Source: "00000000-00007196.00000000.143760.05800000.00000004.mdmp") Found URL "https://dns.google/resolve?name=salator.estls" - Source: "00000000-00007196.00000000.143760.05800000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00007196.00000000.143760.05800000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00007196.00000000.143760.05800000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00007196.00000000.143760.05800000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00007196.00000000.143760.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0s" - Source: "00000000-00007196.00000000.143760.05800000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00007196.00000000.143760.05800000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crt0+$0" - Source: "00000000-00007196.00000000.143760.05800000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/o" - Source: "00000000-00007196.00000000.143760.05800000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr10)http://pki.goog/gsr1/gsr1.crt02+0)0'!http://crl.pki.goog/gsr1/gsr1.crl0;40207okzgm=" - Source: "00000000-00007196.00000000.143760.05800000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00007196.00000000.143760.05800000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn0<0http://cps.chambersign.org/cps/chambersroot.html0?w" - Source: "00000000-00007196.00000000.143760.05800000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0990709183120z190709184036z0salt" - Source: "00000000-00007196.00000000.143760.05800000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0;09071http://crl.usertrust.com/utn-userfirst-object.crl0)k%%-qcn>k't" - Source: "00000000-00007196.00000000.143760.05800000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?-kh9&9s\qwbynbktd'!+pb3h" - Source: "00000000-00007196.00000001.145679.05D00000.00000004.mdmp") Found URL "http://cert.ssl.com/sslcom-subca-ssl-ecc-384-r2.cer0" - Source: "00000000-00007196.00000001.145679.05D3A000.00000004.mdmp") Found URL "http://ocsps.ssl.com0cloudflare-dns.com*.cloudflare-dns.comone.one.one.one0" - Source: "00000000-00007196.00000001.145679.05D3A000.00000004.mdmp") Found URL "http://crls.ssl.com/sslcom-subca-ssl-ecc-384-r2.crl01" - Source: "00000000-00007196.00000001.145679.05D3A000.00000004.mdmp") Found URL "http://www.ssl.com/repository/sslcom-rootca-ecc-384-r1.crt0" - Source: "00000000-00007196.00000001.145679.05D3A000.00000004.mdmp") Found URL "http://ocsps.ssl.com040200*http://crls.ssl.com/ssl.com-ecc-rootca.crl0zby?7q" - Source: "00000000-00007196.00000001.145679.05D3A000.00000004.mdmp") Found URL "http://o.pki.goog/wr20%http://i.pki.goog/wr2.crt0dns.googledns.google.com*.dns.google.com8888.googledns64.dns.googleh" - Source: "00000000-00007196.00000001.145679.05D3A000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/75r4zya3va0.crl0=q2%(fdj" - Source: "00000000-00007196.00000001.145679.05D3A000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crt0+$0" - Source: "00000000-00007196.00000001.145679.05D3A000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0" - Source: "00000000-00007196.00000001.145679.05D3A000.00000004.mdmp") Found URL "https://wrat.in:992/sa1at/" - Source: "00000000-00007196.00000001.145679.05D52000.00000004.mdmp") Found URL "http://o.pki.goog/wr20%http://i.pki.goog/wr2.crt0dns.googledns.google.com*.dns.google.com8888.googledns64.dns.googleh" - Source: "00000000-00007196.00000001.145679.05D70000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/75r4zya3va0.crl0=q2%(fdj" - Source: "00000000-00007196.00000001.145679.05D70000.00000004.mdmp") Found URL "http://ocsps.ssl.comcloudflare-dns.com*.cloudflare-dns.comhttp://ocsps.ssl.comtls13" - Source: "00000000-00007196.00000001.145679.05D94000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=wrat.in:9920b7aee454338e3697d864d956f01e4b1a28c6918pk6vpk6vssl.com" - Source: "00000000-00007196.00000001.145679.05D94000.00000004.mdmp") Found URL "http://crls.ssl.com/ssl.com-ecc-rootca.crl[nh$aj''x" - Source: "00000000-00007196.00000001.145679.05D94000.00000004.mdmp") Found URL "https://wrat.in:992/sa1at/https://tonapi.io/v2/dns/webratpanel.ton/resolvehttps://tonapi.io/v2/dns/webratpanel.ton/resolvehttps://dns.google/resolve?name=tonapi.iocfmbq5y9http://c.pki.goog/r/r1.crl0s" - Source: "00000000-00007196.00000001.145679.05D94000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/k340%http://i.pki.goog/we1.crt0'websalat.top*.websalat.top0/0-0+%http://c.pki.goog/we1/pl4xitjsdsk.crl0whh1gog" - Source: "00000000-00007196.00000001.145679.05E0E000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00007196.00000001.145679.05E0E000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00007196.00000001.145679.05E0E000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00007196.00000001.145679.05E0E000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:texas1houston1ssl" - Source: "00000000-00007196.00000001.145679.05E0E000.00000004.mdmp") Found URL "http://cert.ssl.com/sslcom-subca-ssl-ecc-384-r2.cer0" - Source: "00000000-00007196.00000001.145679.05E0E000.00000004.mdmp") Found URL "http://ocsps.ssl.com0cloudflare-dns.com*.cloudflare-dns.comone.one.one.one0" - Source: "00000000-00007196.00000001.145679.05E0E000.00000004.mdmp") Found URL "http://crls.ssl.com/sslcom-subca-ssl-ecc-384-r2.crl01" - Source: "00000000-00007196.00000001.145679.05E0E000.00000004.mdmp") Found URL "http://www.ssl.com/repository/sslcom-rootca-ecc-384-r1.crt0" - Source: "00000000-00007196.00000001.145679.05E0E000.00000004.mdmp") Found URL "http://ocsps.ssl.com040200*http://crls.ssl.com/ssl.com-ecc-rootca.crl0zby?7q" - Source: "00000000-00007196.00000001.145679.05E0E000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:google" - Source: "00000000-00007196.00000001.145679.05E0E000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/sic0%http://i.pki.goog/we1.crt0!" - Source: "00000000-00007196.00000001.145679.05E0E000.00000004.mdmp") Found URL "http://c.pki.goog/we1/8jmypb8gmec.crl0=q2%2p:,1]s\qw20260419141110z0t0r0j0" - Source: "00000000-00007196.00000001.145679.05E0E000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:n;eqapdq" - Source: "00000000-00007196.00000001.145679.05E0E000.00000004.mdmp") Found URL "http://www.ssl.com/repository/sslcom-rootca-ecc-384-r1.crt0" - Source: "00000000-00007196.00000001.145679.05E24000.00000004.mdmp") Found URL "http://ocsps.ssl.com040200*http://crls.ssl.com/ssl.com-ecc-rootca.crl0zby?7q" - Source: "00000000-00007196.00000001.145679.05E24000.00000004.mdmp") Found URL "https://217.26.28.234/sa1n6https://217.26.28.234/sa1at/g+" - Source: "00000000-00007196.00000001.145679.05E24000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007196.00000002.147599.00970000.00000004.mdmp") Found URL "http://cert.ssl.com/sslcom-subca-ssl-ecc-384-r2.cerhttp://crls.ssl.com/sslcom-subca-ssl-ecc-384-r2.crlhttp://www.ssl.com/repository/sslcom-rootca-ecc-384-r1.crt;acr1k66666666666666666666666666666666?\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\local" - Source: "00000000-00007196.00000002.147599.05D00000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/sichttp://i.pki.goog/we1.crtshyetootvalton.access.orbs.network:443!wed," - Source: "00000000-00007196.00000002.147599.05D00000.00000004.mdmp") Found URL "https://217.26.28.234/sa1https://217.26.28.234/sa1at/>https://salator.es/sa1at/5https://salator.es/sa1at/rhttps://salator.es/sa1at/rhttps://salator.es/sa1at/cloudflare-dns.com].!slpgbk7gqnf=,!\62" - Source: "00000000-00007196.00000002.147599.05D00000.00000004.mdmp") Found URL "http://cert.ssl.com/sslcom-subca-ssl-ecc-384-r2.cer0" - Source: "00000000-00007196.00000002.147599.05D3A000.00000004.mdmp") Found URL "http://ocsps.ssl.com0cloudflare-dns.com*.cloudflare-dns.comone.one.one.one0" - Source: "00000000-00007196.00000002.147599.05D3A000.00000004.mdmp") Found URL "http://crls.ssl.com/sslcom-subca-ssl-ecc-384-r2.crl01" - Source: "00000000-00007196.00000002.147599.05D3A000.00000004.mdmp") Found URL "http://www.ssl.com/repository/sslcom-rootca-ecc-384-r1.crt0" - Source: "00000000-00007196.00000002.147599.05D3A000.00000004.mdmp") Found URL "http://ocsps.ssl.com040200*http://crls.ssl.com/ssl.com-ecc-rootca.crl0zby?7q" - Source: "00000000-00007196.00000002.147599.05D3A000.00000004.mdmp") Found URL "http://o.pki.goog/wr20%http://i.pki.goog/wr2.crt0dns.googledns.google.com*.dns.google.com8888.googledns64.dns.googleh" - Source: "00000000-00007196.00000002.147599.05D3A000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/75r4zya3va0.crl0=q2%(fdj" - Source: "00000000-00007196.00000002.147599.05D3A000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crt0+$0" - Source: "00000000-00007196.00000002.147599.05D3A000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0texas1houston1ssl" - Source: "00000000-00007196.00000002.147599.05D3A000.00000004.mdmp") Found URL "https://wrat.in:992/sa1at/" - Source: "00000000-00007196.00000002.147599.05D52000.00000004.mdmp") Found URL "http://o.pki.goog/wr20%http://i.pki.goog/wr2.crt0dns.googledns.google.com*.dns.google.com8888.googledns64.dns.googleh" - Source: "00000000-00007196.00000002.147599.05D70000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/75r4zya3va0.crl0=q2%(fdj" - Source: "00000000-00007196.00000002.147599.05D70000.00000004.mdmp") Found URL "http://ocsps.ssl.comcloudflare-dns.com*.cloudflare-dns.comhttp://ocsps.ssl.comtls13" - Source: "00000000-00007196.00000002.147599.05D94000.00000004.mdmp") Found URL "https://217.26.28.234/sa1at/" - Source: "00000000-00007196.00000002.147599.05D94000.00000004.mdmp") Found URL "https://salator.es/sa1at/" - Source: "00000000-00007196.00000002.147599.05D94000.00000004.mdmp") Found URL "http://crls.ssl.com/ssl.com-ecc-rootca.crl" - Source: "00000000-00007196.00000002.147599.05D94000.00000004.mdmp") Found URL "https://salator.es/sa1at/get" - Source: "00000000-00007196.00000002.147599.05D94000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0s" - Source: "00000000-00007196.00000002.147599.05D94000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0" - Source: "00000000-00007196.00000002.147599.05D94000.00000004.mdmp") Found URL "http://cert.ssl.com/sslcom-subca-ssl-ecc-384-r2.cer0" - Source: "00000000-00007196.00000002.147599.05DFE000.00000004.mdmp") Found URL "http://ocsps.ssl.com0cloudflare-dns.com*.cloudflare-dns.comone.one.one.one0" - Source: "00000000-00007196.00000002.147599.05DFE000.00000004.mdmp") Found URL "http://crls.ssl.com/sslcom-subca-ssl-ecc-384-r2.crl01" - Source: "00000000-00007196.00000002.147599.05DFE000.00000004.mdmp") Found URL "http://www.ssl.com/repository/sslcom-rootca-ecc-384-r1.crt0" - Source: "00000000-00007196.00000002.147599.05DFE000.00000004.mdmp") Found URL "http://ocsps.ssl.com040200*http://crls.ssl.com/ssl.com-ecc-rootca.crl0zby?7q" - Source: "00000000-00007196.00000002.147599.05DFE000.00000004.mdmp") Found URL "http://o.pki.goog/wr20%http://i.pki.goog/wr2.crt0dns.googledns.google.com*.dns.google.com8888.googledns64.dns.googleh" - Source: "00000000-00007196.00000002.147599.05DFE000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/75r4zya3va0.crl0=q2%(fdj" - Source: "00000000-00007196.00000002.147599.05DFE000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crt0+$0" - Source: "00000000-00007196.00000002.147599.05DFE000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/otexas1houston1ssl" - Source: "00000000-00007196.00000002.147599.05DFE000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/k340%http://i.pki.goog/we1.crt0'websalat.top*.websalat.top0/0-0+%http://c.pki.goog/we1/pl4xitjsdsk.crl0whh1gog" - Source: "00000000-00007196.00000002.147599.05E0E000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00007196.00000002.147599.05E0E000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00007196.00000002.147599.05E0E000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00007196.00000002.147599.05E0E000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:texas1houston1ssl" - Source: "00000000-00007196.00000002.147599.05E0E000.00000004.mdmp") Found URL "http://cert.ssl.com/sslcom-subca-ssl-ecc-384-r2.cer0" - Source: "00000000-00007196.00000002.147599.05E0E000.00000004.mdmp") Found URL "http://ocsps.ssl.com0cloudflare-dns.com*.cloudflare-dns.comone.one.one.one0" - Source: "00000000-00007196.00000002.147599.05E0E000.00000004.mdmp") Found URL "http://crls.ssl.com/sslcom-subca-ssl-ecc-384-r2.crl01" - Source: "00000000-00007196.00000002.147599.05E0E000.00000004.mdmp") Found URL "http://www.ssl.com/repository/sslcom-rootca-ecc-384-r1.crt0" - Source: "00000000-00007196.00000002.147599.05E0E000.00000004.mdmp") Found URL "http://ocsps.ssl.com040200*http://crls.ssl.com/ssl.com-ecc-rootca.crl0zby?7q" - Source: "00000000-00007196.00000002.147599.05E0E000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:google" - Source: "00000000-00007196.00000002.147599.05E0E000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/sic0%http://i.pki.goog/we1.crt0!" - Source: "00000000-00007196.00000002.147599.05E0E000.00000004.mdmp") Found URL "http://c.pki.goog/we1/8jmypb8gmec.crl0=q2%2p:,1]s\qw20260419141110z0t0r0j0" - Source: "00000000-00007196.00000002.147599.05E0E000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:" - Source: "00000000-00007196.00000002.147599.05E0E000.00000004.mdmp") Found URL "http://www.ssl.com/repository/sslcom-rootca-ecc-384-r1.crt0" - Source: "00000000-00007196.00000002.147599.05E24000.00000004.mdmp") Found URL "http://ocsps.ssl.com040200*http://crls.ssl.com/ssl.com-ecc-rootca.crl0zby?7q" - Source: "00000000-00007196.00000002.147599.05E24000.00000004.mdmp") Found URL "https://217.26.28.234/sa1at/1_" - Source: "00000000-00007196.00000002.147599.05E24000.00000004.mdmp") Found URL "https://217.26.28.234/sa1https://217.26.28.234/sa1at/t" - Source: "00000000-00007196.00000002.147599.05E24000.00000004.mdmp")54:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001668) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00001668) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001668) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001668) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001668) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001668) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001668) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001668) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00001668) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00001668) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00001668) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00001668) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00001668) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00001668) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00001668) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00001668) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00001668) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00001668) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00001668) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00001668)55:T106a,file/memory contains long string with (Indicator: "aes"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") file/memory contains long string with (Indicator: "rsa2"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found string "SymGetModuleBase64" (Indicator: "base64"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found string "chacha8" (Indicator: "chacha"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found string "*chacha8rand.State" (Indicator: "chacha"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found string "internal/chacha8rand" (Indicator: "chacha"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found string "(scan MB in pacer: % CPU ( zombiegc bits, j0 = head = panic: GODEBUG nmsys= locks= dying= allocs m->g0= pad1= pad2= text= minpc= value= (scan) types : type avx512fruntimeos/execfips140tls3destlssha1Usage:" (Indicator: "3des"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") file/memory contains long string with (Indicator: "3des"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found string "internal/chacha8rand.block" (Indicator: "chacha"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found string "runtime.initAlgAES" (Indicator: "aes"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found string "aeshashbody" (Indicator: "aes"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found string "internal/chacha8rand/chacha8.go" (Indicator: "chacha"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found string "internal/chacha8rand/chacha8_amd64.s" (Indicator: "chacha"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001668.00000000.144860.3D670000.00000004.mdmp, 00000000-00001668.00000001.145074.3D670000.00000004.mdmp, 00000000-00001668.00000001.145074.57BF3000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00001668.00000000.144860.57B60000.00000004.mdmp, 00000000-00001668.00000001.145074.57B60000.00000004.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001668.00000000.144860.F4350000.00000004.mdmp, 00000000-00001668.00000000.144860.F4390000.00000004.mdmp, 00000000-00001668.00000001.145074.F4310000.00000004.mdmp, 00000000-00001668.00000001.145074.F4330000.00000004.mdmp, 00000000-00001668.00000001.145074.F4370000.00000004.mdmp") Found string "soapbase64binary" (Indicator: "base64"; Source: "00000000-00001668.00000000.144860.F4350000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001668.00000000.144860.F4350000.00000004.mdmp, 00000000-00001668.00000000.144860.F4390000.00000004.mdmp, 00000000-00001668.00000001.145074.F4310000.00000004.mdmp, 00000000-00001668.00000001.145074.F4330000.00000004.mdmp, 00000000-00001668.00000001.145074.F4370000.00000004.mdmp")56:Tbd9,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found reference to API "Process32First" (Indicator: "Process32First"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") file/memory contains long string with (Indicator: "EnumProcesses"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") file/memory contains long string with (Indicator: "Module32Next"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") file/memory contains long string with (Indicator: "Thread32First"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") file/memory contains long string with (Indicator: "Process32Next"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") file/memory contains long string with (Indicator: "Module32First"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001668.00000000.144860.6D792000.00000002.mdmp, 00000000-00001668.00000001.145074.4AA4A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001668.00000000.144860.6D792000.00000002.mdmp, 00000000-00001668.00000001.145074.4AA4A000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001668.00000000.144860.6D792000.00000002.mdmp, 00000000-00001668.00000001.145074.4AA4A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001668.00000000.144860.6D792000.00000002.mdmp, 00000000-00001668.00000001.145074.4AA4A000.00000002.mdmp")57:Td09,Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTempPath"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found reference to API "internal/syscall/windows.GetSystemDirectory" (Indicator: "GetSystemDirectory"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found reference to API "internal/syscall/windows.NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found reference to API "internal/syscall/windows.ErrorLoadingGetTempPath2" (Indicator: "GetTempPath"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found reference to API "golang.org/x/sys/windows.GetSystemDirectory" (Indicator: "GetSystemDirectory"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001668.00000000.144860.6D792000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001668.00000000.144860.6D792000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001668.00000000.144860.6D792000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001668.00000000.144860.6D792000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001668.00000000.144860.6D792000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001668.00000000.144860.6D792000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00001668.00000000.144860.6D792000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001668.00000000.144860.6D792000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001668.00000000.144860.6D792000.00000002.mdmp, 00000000-00001668.00000001.145074.4AA4A000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001668.00000000.144860.6D792000.00000002.mdmp")58:T54f,file/memory contains long string with (Indicator: "CopySid"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") file/memory contains long string with (Indicator: "FreeSid"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") file/memory contains long string with (Indicator: "EqualSid"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") file/memory contains long string with (Indicator: "IsValidSid"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") file/memory contains long string with (Indicator: "IsWellKnownSid"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") file/memory contains long string with (Indicator: "MakeAbsoluteSD"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") file/memory contains long string with (Indicator: "AdjustTokenGroups"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") file/memory contains long string with (Indicator: "IsTokenRestricted"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp") file/memory contains long string with (Indicator: "InitializeSid"; Source: "00000000-00000304.00000001.143861.1F14C000.00000002.mdmp")59:Tf67,"status= pluginpath= : unknown pc called from runtime: pid=level 3 resetsrmount errortimer expiredexchange fullRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeUsage of %s:\" (Indicator: \"sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=level 3 resetsrmount errortimer expiredexchange fullRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeUsage of %s:\") in Source: 00000000-00000304.00000001.143861.1F14C000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00001668.00000000.144860.57B60000.00000004.mdmp, 00000000-00001668.00000001.145074.57B60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2e","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2f","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$30","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$31","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001668-00000C2C-1229209340\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001668-00000C2C-1230305844\")\n file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(Source: \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\")\n Found string \"etUserNameA\" (Source: \"00000000-00001668.00000000.144860.57B60000.00000004.mdmp\")\n Found string \"etUserNameExW\" (Source: \"00000000-00001668.00000000.144860.57B60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001668-00000C2C-1229209340\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001668-00000C2C-1230305844\")\n file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00007196-00000C2C-1216308925\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; Source: \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\")\n Found string \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"file/memory contains long string with (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007196-00000C2C-1212439987\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007196-00000C2C-1212440018\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007196-00000C2C-1212440092\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001668-00000C2C-1230571497\")\n file/memory contains long string with (Indicator: \"FreeSid\"; Source: \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; File: \"fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00007196-00000C2C-1213057972\")\n file/memory contains long string with (Indicator: \"getaddrinfo\"; Source: \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin\"\n Found system information discovery API: \"GetSystemInfo\" in file \"fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in file \"fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin\"\n Found system information discovery API: \"QuerySystemInformation (in long string)\" in \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00001668.00000000.144860.6D792000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"status= pluginpath= : unknown pc called from runtime: pid=level 3 resetsrmount errortimer expiredexchange fullRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeUsage of %s:\" in \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\"\n Found registry query API: \"syscall.RegOpenKeyEx\" in \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\"\n Found registry query API: \"syscall.RegQueryValueEx\" in \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\"\n Found registry query API: \"syscall.RegEnumKeyEx\" in \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"file/memory contains long string with (Indicator: \"GetUserName\"; Source: \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"LookupAccountSid\"; Source: \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"WTSQueryUserToken\"; Source: \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$54","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"status= pluginpath= : unknown pc called from runtime: pid=level 3 resetsrmount errortimer expiredexchange fullRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeUsage of %s:\" in \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001668)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00000304.00000000.143842.E6EA0000.00000004.mdmp, 00000000-00000304.00000001.143861.E6EA0000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001668.00000000.144860.3D670000.00000004.mdmp, 00000000-00001668.00000001.145074.3D670000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001668.00000000.144860.3D670000.00000004.mdmp, 00000000-00001668.00000001.145074.3D670000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"file/memory contains long string with (Indicator: \"WTSQueryUserToken\"; Source: \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00001668.00000000.144860.6D792000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00001668.00000000.144860.6D792000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00000304.00000001.143861.1F14C000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001668.00000000.144860.6D792000.00000002.mdmp, 00000000-00001668.00000001.145074.4AA4A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin\")\n Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; File: \"fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001668.00000000.144860.6D792000.00000002.mdmp, 00000000-00001668.00000001.145074.4AA4A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"34ec68d08177_b_e23ef6.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"build2_a74e55.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"77135882B7D2DC010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"34ec68d08177_b_e23ef6.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$59","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force\" (UID: 00000000-00001668)","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"34ec68d08177_b_e23ef6.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2FD\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")\n \"build2_a74e55.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"77135882B7D2DC010000000000000000000000000200000000\")\n \"build2_a74e55.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\MRT\"; Key: \"DONTOFFERTHROUGHWUAU\"; Value: \"0100000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2FD\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"file/memory contains long string with (Indicator: \"ExitWindows\"; Source: \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"& { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.OriginInfo }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin\")\n file/memory contains long string with (Indicator: \"OpenMutex\"; Source: \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"CreateMutex\"; Source: \"00000000-00000304.00000001.143861.1F14C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"34ec68d08177_b_e23ef6.exe\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections\"- Location: [%TEMP%\\34ec68d08177_b_e23ef6.exe]- [targetUID: 00000000-00007196]\n \"build2_a74e55.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections\"- Location: [%TEMP%\\build2_a74e55.exe]- [targetUID: 00000000-00008056]\n \"win_message_clean_30ac2e.exe\" has type \"PE32+ executable for MS Windows 6.01 (GUI) x86-64 8 sections\"- Location: [%TEMP%\\win_message_clean_30ac2e.exe]- [targetUID: 00000000-00008096]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00001668]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"34ec68d08177_b_e23ef6.exe\" was detected as \"UPX -> www.upx.sourceforge.net\"\n \"win_message_clean_30ac2e.exe\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\" \"{\"address\":\"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq\",\"method\":\"dnsresolve\",\"stack\":[[\"tvm.Slice\",\"te6cckEBAQEAEgAAIHRvbgBzaHlldG9vdHZhbACNoplI\"],[\"num\",\"105311596331855300602201538317979276640056460191511695660591596829410056223515\"]]}\" HTTP/2 200 OK\nContent-Type: application/json\nDate: Wed\n 22 Apr 2026 17:23:07 GMT\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Headers: X-API-key\nX-API-key\nX-Ton-Client-Version\nDNT\nX-CustomHeader\nKeep-Alive\nUser-Agent\nX-Requested-With\nIf-Modified-Since\nCache-Control\nContent-Type\nX-Api-Version: 2.0.0\nX-Timer: S1776878587.847517\nVS0\nVE185\nX-Served-By: cache-lax-kwhp1940144-LAX\nX-Cache: MISS\nAccept-Ranges: bytes\nX-Cache-Hits: 0\nStrict-Transport-Security: max-age=300\nVia: 1.1 varnish with no response body","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 104.21.19.248\"\n \"UDP connection to 90.156.169.78\"\n \"UDP connection to 104.21.81.197\"\n \"UDP connection to 1.1.1.1\"\n \"UDP connection to 172.64.153.168\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"34ec68d08177_b_e23ef6.exe\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections\"- Location: [%TEMP%\\34ec68d08177_b_e23ef6.exe]- [targetUID: 00000000-00007196]\n \"build2_a74e55.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections\"- Location: [%TEMP%\\build2_a74e55.exe]- [targetUID: 00000000-00008056]\n \"win_message_clean_30ac2e.exe\" has type \"PE32+ executable for MS Windows 6.01 (GUI) x86-64 8 sections\"- Location: [%TEMP%\\win_message_clean_30ac2e.exe]- [targetUID: 00000000-00008096]\n \"qxmygqtkqtbc.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections\"- Location: [%ALLUSERSPROFILE%\\virxvwzjmgfs\\qxmygqtkqtbc.exe]- [targetUID: 00000000-00008056]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$5a","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"UDP traffic to 104.21.19.248 on port 443\n UDP traffic to 90.156.169.78 on port 443\n UDP traffic to 104.21.81.197 on port 443\n UDP traffic to 1.1.1.1 on port 443\n UDP traffic to 172.64.153.168 on port 443\n TCP traffic to 167.82.50.132 on port 443 is sent without HTTP header\n TCP traffic to 104.16.248.249 on port 443 is sent without HTTP header\n TCP traffic to 217.26.28.234 on port 443 is sent without HTTP header\n TCP traffic to 172.64.153.168 on port 443 is sent without HTTP header\n TCP traffic to 172.67.194.254 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"win_message_clean_30ac2e.exe\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"win_message_clean_30ac2e.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"34ec68d08177_b_e23ef6.exe\"\n YARA signature for invalid Timestamp of PE file \"win_message_clean_30ac2e.exe\"\n YARA signature for invalid Timestamp of PE file \"34ec68d08177_b_e23ef6.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"file/memory contains long string with (Indicator: \"cmd=\"; File: \"fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4.bin\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":3,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"win_message_clean_30ac2e.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1f01093c\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":5,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$5b","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00001668)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00001668)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieves adapter information","description":"$5c","origin":"API Call","mitre_attack_id":"T1016","relevance":5,"id":"api-153","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 1591-1237-004022B5\n Process32Next@KERNEL32.dll at 1591-1238-0041B428\n Process32First@KERNEL32.dll at 1591-1240-0041B422\n CreateToolhelp32Snapshot@KERNEL32.dll at 1591-1241-0041B41C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineW@KERNEL32.dll at 1591-1032-0041B3EC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.dll at 1591-1162-0042220C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"69e903a91b7312a5af08f646"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"