24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4bd,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 01e771dc6cf9… — Score 97/100 — Hybrid Analysis","description":"Malicious verdict for sample 01e771dc6cf9…. Malware family: Win/malicious_confidence_100%. Threat score 97/100. 22/25 AV engines flagged this file. 7 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256"],"about":{"@type":"SoftwareApplication","name":"9hciunery8g","applicationCategory":["peexe","executable"],"identifier":"01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256","additionalType":"Malicious sample"},"threatScore":97,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":22,"total":25},"behavioralIndicators":{"malicious":7,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T8c6,"" touched file "C:\Windows\Globalization\Sorting\sortdefault.nls" "" touched file "C:\Users\rNefdes\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\rNefdes\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\rNefdes\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "C:\Windows\system32\en-US\PROPSYS.dll.mui" "" touched file "C:\Windows\system32\en-US\SETUPAPI.dll.mui" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" touched file "C:\Windows\Globalization\Sorting\sortdefault.nls" "02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" touched file "C:\Users\rNefdes\AppData\Local\Microsoft\Windows\Caches" "02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" touched file "C:\Users\rNefdes\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" touched file "C:\Users\rNefdes\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" touched file "C:\Windows\system32\en-US\PROPSYS.dll.mui" "02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" touched file "C:\Windows\system32\en-US\SETUPAPI.dll.mui" "02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db"26:T10c0,"" wrote 32 bytes to a remote process "C:\01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256.exe" (Handle: 468) "" wrote 52 bytes to a remote process "C:\01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256.exe" (Handle: 468) "" wrote 4 bytes to a remote process "C:\01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256.exe" (Handle: 468) "" wrote 32 bytes to a remote process "C:\01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256.exe" (Handle: 100) "" wrote 52 bytes to a remote process "C:\01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256.exe" (Handle: 100) "" wrote 4 bytes to a remote process "C:\01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256.exe" (Handle: 100) "" wrote 1024 bytes to a remote process "C:\01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256.exe" (Handle: 100) "" wrote 5632 bytes to a remote process "C:\01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256.exe" (Handle: 100) "" wrote 512 bytes to a remote process "C:\01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256.exe" (Handle: 100) "" wrote 243200 bytes to a remote process "C:\01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256.exe" (Handle: 100) "" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" (Handle: 172) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" (Handle: 172) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" (Handle: 172) "02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" (Handle: 468) "02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" (Handle: 468) "02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" (Handle: 468) "02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" (Handle: 100) "02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" (Handle: 100) "02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" (Handle: 100) "02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" wrote 1024 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" (Handle: 100) "02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" wrote 5632 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" (Handle: 100) "02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" wrote 512 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" (Handle: 100) "02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" wrote 243200 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe" (Handle: 100)27:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==28:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2c:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":97,"unified_at_epoch_ms":1790282839183,"unified_at":"2026-09-24T20:47:19.183Z","metadata":{"hashes":{"sha256":"01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256","sha1":"c5270e39548d9259b421ad5e94f3e8ebdd2f1cf5","md5":"20a51bf0c489d3f2792cfae6ef4ee337","sha512":"d19ea2f3b2d4ba0748e9fada38ed869955965b332b2db5135802e0bb7d14ef64b5d6e659798f9290e342f101a12b47cc61d6f36a410681d32e83c5565576ef9c","ssdeep":"6144:6B/vBTr95uVJqa54ZNH9bbLcHsjVpWMF9sgaNYiE8qEB6hRogtJ/PbRIZE:6zr95uHCdbEM3WBi8n0TPlIZ","ssdeep_chunks":["6144:6B/vBTr","6144:B/vBTr9","6144:/vBTr95","6144:vBTr95u","6144:BTr95uV","6144:Tr95uVJ","6144:r95uVJq","6144:95uVJqa","6144:5uVJqa5","6144:uVJqa54","6144:VJqa54Z","6144:Jqa54ZN","6144:qa54ZNH","6144:a54ZNH9","6144:54ZNH9b","6144:4ZNH9bb","6144:ZNH9bbL","6144:NH9bbLc","6144:H9bbLcH","6144:9bbLcHs","6144:bbLcHsj","6144:bLcHsjV","6144:LcHsjVp","6144:cHsjVpW","6144:HsjVpWM","6144:sjVpWMF","6144:jVpWMF9","6144:VpWMF9s","6144:pWMF9sg","6144:WMF9sga","6144:MF9sgaN","6144:F9sgaNY","6144:9sgaNYi","6144:sgaNYiE","6144:gaNYiE8","6144:aNYiE8q","6144:NYiE8qE","6144:YiE8qEB","6144:iE8qEB6","6144:E8qEB6h","6144:8qEB6hR","6144:qEB6hRo","6144:EB6hRog","6144:B6hRogt","6144:6hRogtJ","6144:hRogtJ/","6144:RogtJ/P","6144:ogtJ/Pb","6144:gtJ/PbR","6144:tJ/PbRI","6144:J/PbRIZ","6144:/PbRIZE","12288:6B/vBTr","12288:B/vBTr9","12288:/vBTr95","12288:vBTr95u","12288:BTr95uV","12288:Tr95uVJ","12288:r95uVJq","12288:95uVJqa","12288:5uVJqa5","12288:uVJqa54","12288:VJqa54Z","12288:Jqa54ZN","12288:qa54ZNH","12288:a54ZNH9","12288:54ZNH9b","12288:4ZNH9bb","12288:ZNH9bbL","12288:NH9bbLc","12288:H9bbLcH","12288:9bbLcHs","12288:bbLcHsj","12288:bLcHsjV","12288:LcHsjVp","12288:cHsjVpW","12288:HsjVpWM","12288:sjVpWMF","12288:jVpWMF9","12288:VpWMF9s","12288:pWMF9sg","12288:WMF9sga","12288:MF9sgaN","12288:F9sgaNY","12288:9sgaNYi","12288:sgaNYiE","12288:gaNYiE8","12288:aNYiE8q","12288:NYiE8qE","12288:YiE8qEB","12288:iE8qEB6","12288:E8qEB6h","12288:8qEB6hR","12288:qEB6hRo","12288:EB6hRog","12288:B6hRogt","12288:6hRogtJ","12288:hRogtJ/","12288:RogtJ/P","12288:ogtJ/Pb","12288:gtJ/PbR","12288:tJ/PbRI","12288:J/PbRIZ","12288:/PbRIZE","6144:6zr95uH","6144:zr95uHC","6144:r95uHCd","6144:95uHCdb","6144:5uHCdbE","6144:uHCdbEM","6144:HCdbEM3","6144:CdbEM3W","6144:dbEM3WB","6144:bEM3WBi","6144:EM3WBi8","6144:M3WBi8n","6144:3WBi8n0","6144:WBi8n0T","6144:Bi8n0TP","6144:i8n0TPl","6144:8n0TPlI","6144:n0TPlIZ"],"imphash":"92ecf985d7128974aed3f20f6dfa66d0"},"file_info":{"file_name":"9hciunery8g","file_type":["peexe","executable"],"file_type_id":"exe","file_size":423424,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1506590181000,"last_seen":1741713290000,"last_multi_scan":1741713290000}},"detections":{"summary":{"verdict":"malicious","score":97,"tags":["trickbot"]},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":7,"suspicious_count":8,"malicious_count":7,"total":22},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Trickbot","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.vsdru","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Cryptolocker.FU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/TrickBot.Q trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Spy.Win32.Gen.sd!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005181551 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.adc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Zonidel.etldhn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Agent-AXFQ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Mansabo.423424","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.HYZV-0661","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.TrickBot.BJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Inject","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_42.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Mansabo.Win32.37","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 12799-1078-00409C21","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 12799-1123-0041220B","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\01E771DC6CF9572EAC3D87120D7A7D1FF95FDC1499B668C7FDE2919E0F685256.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\01E771DC6CF9572EAC3D87120D7A7D1FF95FDC1499B668C7FDE2919E0F685256.EXE\")\n \"02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\02F772ED6DG9673FAD4E87230E7A7E2GG96GED2599C668D7GEF3929F0G686366.EXE\")\n \"02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\02F772ED6DG9673FAD4E87230E7A7E2GG96GED2599C668D7GEF3929F0G686366.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\3z8e9f8z98efzef8\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"3z8e9f8z98efzef8\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" with commandline \"-l\" (UID: 00014849-00002992)\n Spawned process \"\" (UID: 00015389-00003496)\n Spawned process \"02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe\" (UID: 00016260-00002624)\n Spawned process \"02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe\" with commandline \"-l\" (UID: 00016670-00002740)\n Spawned process \"02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe\" (UID: 00017260-00002836)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$25","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.9125107539","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"C:\\01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256.exe\", Handle: 468)\n \"\" is creating a new process (Name: \"C:\\01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256.exe\", Handle: 100)\n \"\" is creating a new process (Name: \"%APPDATA%\\winapp\\02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe\", Handle: 172)\n \"02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe\" is creating a new process (Name: \"%APPDATA%\\winapp\\02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe\", Handle: 468)\n \"02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe\" is creating a new process (Name: \"%APPDATA%\\winapp\\02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe\", Handle: 100)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe\" opened \"MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n GetCommandLineW\n LoadLibraryA\n DeleteFileA\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n GetCommandLineA\n GetProcAddress\n FindNextFileW\n WriteFile\n FindFirstFileExW\n GetModuleHandleW\n TerminateProcess\n CreateProcessA\n GetModuleHandleExW\n CreateFileW\n Sleep","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256.exe.bin\" has a section named \".gfids\"","origin":"Static Parser","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"9/65 Antivirus vendors marked sample as malicious (13% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"9/65 Antivirus vendors marked spawned process \"\" (PID: 2992) as malicious (classified as \"QVM10.1.24D8.Malware\" with 13% detection rate)\n 9/65 Antivirus vendors marked spawned process \"\" (PID: 3496) as malicious (classified as \"QVM10.1.24D8.Malware\" with 13% detection rate)\n 9/65 Antivirus vendors marked spawned process \"02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe\" (PID: 2624) as malicious (classified as \"QVM10.1.24D8.Malware\" with 13% detection rate)\n 9/65 Antivirus vendors marked spawned process \"02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe\" (PID: 2740) as malicious (classified as \"QVM10.1.24D8.Malware\" with 13% detection rate)\n 9/65 Antivirus vendors marked spawned process \"02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe\" (PID: 2836) as malicious (classified as \"QVM10.1.24D8.Malware\" with 13% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Loads the task scheduler COM API","description":"\"02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at 72110000","origin":"Loaded Module","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"\" set thread context in remote process \"C:\\01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256.exe\" (PID 00000da8)\n \"02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe\" set thread context in remote process \"%APPDATA%\\winapp\\02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe\" (PID 00000b14)","origin":"API Call","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$26","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00014737-00002960)\n Spawned process \"\" with commandline \"-l\" (UID: 00014849-00002992)\n Spawned process \"\" (UID: 00015389-00003496)\n Spawned process \"02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe\" (UID: 00016260-00002624)\n Spawned process \"02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe\" with commandline \"-l\" (UID: 00016670-00002740)\n Spawned process \"02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe\" (UID: 00017260-00002836)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]}],"incidents":[{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":12,"imported_dlls_count":48,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":13,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["trickbot"],"sample_flags":["Multi-Process","User Comment"],"sandbox_reports":[{"id":"59ccbcac7ca3e14537487da3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":97,"malware_family":"QVM10.1.24D8.Malware","submit_name":"9hciunery8g","analysis_start_time":"2017-09-28T10:09:28+00:00","indicators_count":{"informative":7,"suspicious":8,"malicious":7},"tags":["Multi-Process","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}],"processes":[{"pid":2960,"ppid":0,"name":"01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256.exe","command_line":"","sha256":"01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256","normalized_path":"C:\\01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256.exe","uid":"00014737-00002960","icon":"$27"},{"pid":2992,"ppid":2960,"name":"01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256.exe","command_line":"-l","sha256":"01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256","normalized_path":"C:\\01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256.exe","parent_uid":"00014737-00002960","uid":"00014849-00002992","icon":"$28"},{"pid":3496,"ppid":2992,"name":"01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256.exe","command_line":"","sha256":"01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256","normalized_path":"C:\\01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256.exe","parent_uid":"00014849-00002992","uid":"00015389-00003496","icon":"$29"},{"pid":2624,"ppid":3496,"name":"02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe","command_line":"","sha256":"01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256","normalized_path":"%APPDATA%\\winapp\\02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe","parent_uid":"00015389-00003496","uid":"00016260-00002624","icon":"$2a"},{"pid":2740,"ppid":2624,"name":"02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe","command_line":"-l","sha256":"01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256","normalized_path":"%APPDATA%\\winapp\\02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe","parent_uid":"00016260-00002624","uid":"00016670-00002740","icon":"$2b"},{"pid":2836,"ppid":2740,"name":"02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe","command_line":"","sha256":"01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256","normalized_path":"%APPDATA%\\winapp\\02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe","parent_uid":"00016670-00002740","uid":"00017260-00002836","icon":"$2c"}],"all_imported_dlls":["winhttp.dll","nsi.dll","msctf.dll","uxtheme.dll","ntmarta.dll","Wldap32.dll","apphelp.dll","userenv.dll","usp10.dll","msvcrt.dll","rpcss.dll","oleaut32.dll","cfgmgr32.dll","user32.dll","advapi32.dll","crypt32.dll","setupapi.dll","ws2_32.dll","taskschd.dll","imm32.dll","ole32.dll","comctl32.dll","urlmon.dll","wininet.dll","iertutil.dll","sspicli.dll","devobj.dll","ntdll.dll","shell32.dll","cryptbase.dll","propsys.dll","IPHLPAPI.DLL","winnsi.dll","ncrypt.dll","bcrypt.dll","kernel32.dll","KernelBase.dll","lpk.dll","clbcatq.dll","gdi32.dll","sechost.dll","rpcrt4.dll","shlwapi.dll","psapi.dll","profapi.dll","webio.dll","tzres.dll","msasn1.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%APPDATA%\\winapp","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"path":"C:\\01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256.exe","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"path":"%WINDIR%\\system32\\en-US\\PROPSYS.dll.mui","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"path":"%APPDATA%\\winapp\\02f772ed6dg9673fad4e87230e7a7e2gg96ged2599c668d7gef3929f0g686366.exe","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"path":"%WINDIR%\\system32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\3z8e9f8z98efzef8","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"name":"3z8e9f8z98efzef8","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\VLock","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]},{"name":"Global\\VLock","sources":[{"report_type":"sandbox","report_id":"59ccbcac7ca3e14537487da3"}]}]}},"report_ids":{"sandbox_job_ids":["59ccbcac7ca3e14537487da3"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 01e771dc6cf9… — Score 97/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 01e771dc6cf9…. Malware family: Win/malicious_confidence_100%. Threat score 97/100. 22/25 AV engines flagged this file. 7 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 01e771dc6cf9… — Score 97/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 01e771dc6cf9…. Malware family: Win/malicious_confidence_100%. Threat score 97/100. 22/25 AV engines flagged this file. 7 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/01e771dc6cf9572eac3d87120d7a7d1ff95fdc1499b668c7fde2919e0f685256"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 01e771dc6cf9… — Score 97/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 01e771dc6cf9…. Malware family: Win/malicious_confidence_100%. Threat score 97/100. 22/25 AV engines flagged this file. 7 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]