26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T482,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious JS/Downldr.GN Sample 09921777f2aa… — Score 58/100 — Hybrid Analysis","description":"Malicious verdict for sample 09921777f2aa…. Malware family: JS/Downldr.GN. Threat score 58/100. 12/27 AV engines flagged this file. 3 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/09921777f2aaf0fef2c90b2aea909b506e07bb4500ab92f38731061da27604d0","keywords":["Malicious","JS/Downldr.GN","malware analysis","sandbox report","threat intelligence","09921777f2aaf0fef2c90b2aea909b506e07bb4500ab92f38731061da27604d0"],"about":{"@type":"SoftwareApplication","name":"FlashPlayer.jse","applicationCategory":["script","javascript"],"identifier":"09921777f2aaf0fef2c90b2aea909b506e07bb4500ab92f38731061da27604d0","additionalType":"Malicious sample"},"threatScore":58,"malwareFamily":"JS/Downldr.GN","antivirusDetections":{"malicious":12,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":1},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T7ad,"wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")28:T712,"wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "wscript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "wscript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "wscript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "wscript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")29:T4f7,"\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\c:!users!l4r0y7c!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\c:!users!l4r0y7c!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" "\Sessions\1\BaseNamedObjects\Local\!IETld!Mutex" "\Sessions\1\BaseNamedObjects\Local\c:!users!l4r0y7c!appdata!roaming!microsoft!windows!ietldcache!" "\Sessions\1\BaseNamedObjects\RasPbFile" "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\c:!users!l4r0y7c!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "Local\ZonesLockedCacheCounterMutex" "Local\c:!users!l4r0y7c!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "Local\_!MSFTHISTORY!_" "Local\ZoneAttributeCacheCounterMutex" "Local\ZonesCacheCounterMutex" "Local\ZonesCounterMutex"2a:T8c5,"wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"09921777f2aaf0fef2c90b2aea909b506e07bb4500ab92f38731061da27604d0","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":58,"unified_at_epoch_ms":1790263713100,"unified_at":"2026-09-24T15:28:33.100Z","metadata":{"hashes":{"sha256":"09921777f2aaf0fef2c90b2aea909b506e07bb4500ab92f38731061da27604d0","sha1":"d7dc406433ad86f04047cf16015e07df6b4b0d7a","md5":"a15fa4f7e2d692fda7f6b5da93db8d26","sha512":"36ddf4e526623caee5a9d95d62b5d73f644339faf83e1043498b407ef8391cd9c2747f75d501c2ec0bae383ac84e244a8826688b24901c882c7491ffbe7aeb41","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"FlashPlayer.jse","file_type":["script","javascript"],"file_type_id":"jse","file_size":12189,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1500549897000,"last_seen":1623252644000,"last_multi_scan":1623252644000}},"detections":{"summary":{"verdict":"malicious","score":58,"tags":null},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":23,"suspicious_count":1,"malicious_count":3,"total":27},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HTML/ExpKit.Gen2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"JS:Trojan.Cryxos.4218","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.JS.Agent.QKT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"JS/Downldr.GN!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"JS:Trojan.Cryxos.4218 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"JS/TrojanDownloader.Agent.QKT trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"SVM:TrojanDownloader/JS.Nemucod.u","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Downloader-FBXO!A15FA4F7E2D6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Script.TrjGen.eswtre","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"JS.Fakefirefoxupdate.38308","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"JS.Downloader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"JS.Dropper.KK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"JS/Downldr.GN","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"wscript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$27","origin":"Registry Access","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$28","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"isrg.trustid.ocsp.identrust.com\"\n \"ocsp.int-x3.letsencrypt.org\"\n \"uubeilisthoopla.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"209.126.113.203:443\"\n \"192.35.177.195:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"wscript.exe\" created file \"%TEMP%\\CabD74B.tmp\"\n \"wscript.exe\" created file \"%TEMP%\\TarD74C.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$29","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"wscript.exe\" called \"Msxml2.XMLHTTP.CreateObject\" ... \n \"wscript.exe\" called \"Msxml2.XMLHTTP.open\" ... \n \"wscript.exe\" called \"Msxml2.XMLHTTP.send\" ... \n \"wscript.exe\" called \"Msxml2.XMLHTTP.responseText\" with result: \"404 Not Found

404 Not Found

nginx... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->\" ...","origin":"API Call","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"wscript.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"wscript.exe\" called \"OpenSCManager\" requesting access rights \"0XE0000000L\"","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"informative","category":"General","name":"Requested access to a system service","description":"\"wscript.exe\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"wscript.exe\" called \"OpenService\" to access the \"rasman\" service\n \"wscript.exe\" called \"OpenService\" to access the \"RASMAN\" service\n \"wscript.exe\" called \"OpenService\" to access the \"CryptSvc\" service\n \"wscript.exe\" called \"OpenService\" to access the \"cryptsvc\" service\n \"wscript.exe\" called \"OpenService\" to access the \"\" service\n \"wscript.exe\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"wscript.exe\" called \"OpenService\" to access the \"gpsvc\" service\n \"wscript.exe\" called \"OpenService\" to access the \"WinHttpAutoProxySvc\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"informative","category":"General","name":"Sent a control code to a service","description":"\"wscript.exe\" called \"ControlService\" and sent control code \"0X400\" to the service \"CryptSvc\"\n \"wscript.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"cryptsvc\"\n \"wscript.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"gpsvc\"\n \"wscript.exe\" called \"ControlService\" and sent control code \"0XFC\" to the service \"gpsvc\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08\" has type \"data\"\n \"TarD74C.tmp\" has type \"data\"\n \"D8929461E6A6DEE6246B814BEC19FC69\" has type \"data\"\n \"CabD74B.tmp\" has type \"Microsoft Cabinet archive data 50939 bytes 1 file\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"wscript.exe\" opened \"MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"wscript.exe\" touched file \"%WINDIR%\\System32\\en-US\\WScript.exe.mui\"\n \"wscript.exe\" touched file \"%WINDIR%\\System32\\WScript.exe\"\n \"wscript.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"wscript.exe\" touched file \"%WINDIR%\\system32\\rsaenh.dll\"\n \"wscript.exe\" touched file \"%WINDIR%\\System32\\en-US\\jscript.dll.mui\"\n \"wscript.exe\" touched file \"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui\"\n \"wscript.exe\" touched file \"%WINDIR%\\System32\\msxml3r.dll\"\n \"wscript.exe\" touched file \"%WINDIR%\\system32\\scrrun.dll\"\n \"wscript.exe\" touched file \"%WINDIR%\\System32\\msxml3.dll\\1\"\n \"wscript.exe\" touched file \"%WINDIR%\\System32\\msxml3.dll\"\n \"wscript.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"wscript.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"wscript.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat\"\n \"wscript.exe\" touched file \"%WINDIR%\\system32\\en-US\\CRYPT32.dll.mui\"\n \"wscript.exe\" touched file \"%WINDIR%\\System32\\en-US\\WINHTTP.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"isrg.trustid.ocsp.identrust.com\"\n Heuristic match: \"ocsp.int-x3.letsencrypt.org\"\n Heuristic match: \"uubeilisthoopla.net\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"informative","category":"System Security","name":"Modifies Software Policy Settings","description":"$2a","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"informative","category":"System Security","name":"Modifies proxy settings","description":"\"wscript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"CabD74B.tmp\" has type \"Microsoft Cabinet archive data 50939 bytes 1 file\"","origin":"Binary File","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/65 reputation engines marked \"http://isrg.trustid.ocsp.identrust.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/58 Antivirus vendors marked sample as malicious (6% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Script file shows a combination of malicious behavior","description":"The script produces internet activity\n is obfuscated and drops files","origin":"Indicator Combinations","relevance":7,"id":"summary-5","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":30,"imported_dlls_count":83,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":38,"files_deleted_count":0,"registry_keys_created_count":72,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":72,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":3,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5970905f7ca3e124ca60f1f3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":58,"malware_family":"Downldr.GN","contacted_countries":["USA"],"submit_name":"FlashPlayer.jse","analysis_start_time":"2017-07-20T13:14:05+00:00","indicators_count":{"informative":23,"suspicious":1,"malicious":3},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"209.126.113.203","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"address":"192.35.177.195","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]}],"dns_resolutions":[{"domain":"ocsp.int-x3.letsencrypt.org","address":"23.38.103.26","country":"United States","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"domain":"isrg.trustid.ocsp.identrust.com","address":"192.35.177.195","country":"United States","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"domain":"uubeilisthoopla.net","address":"209.126.113.203","country":"United States","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]}],"http_requests":[{"host":"isrg.trustid.ocsp.identrust.com","host_ip":"192.35.177.195:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: isrg.trustid.ocsp.identrust.com","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"host":"ocsp.int-x3.letsencrypt.org","host_ip":"23.38.103.26:80","url":"/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgNhNxmi4jWzz%2B3UDgJFNaEDXA%3D%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgNhNxmi4jWzz%2B3UDgJFNaEDXA%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.int-x3.letsencrypt.org","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}],"processes":[{"pid":2388,"ppid":0,"name":"wscript.exe","command_line":"\"C:\\09921777f2aaf0fef2c90b2aea909b506e07bb4500ab92f38731061da27604d0.jse\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","normalized_path":"%WINDIR%\\System32\\wscript.exe","uid":"00016558-00002388","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAA6ElEQVR42s2WgQrFIAhF/fQ+rT/biIfQelo3u0KCjMVW55paIp2VUh62y461H5h2BcAWRAZArRWHyABoBkNkAcAQM4CdzKcn4W9chtH/96ZS5/KE9N9AADpWipg+Lt5n/jGArfxxlWvWq1sQAYC5em9xDyIEEFFPBUAjYM1J2QJL+RgBtDcEq0CgKCQCfFVbTxRiGwDLBRwiBMCMRBiAFYkjAEYkSAAShjjKAeQCuuoRR1XgNaSxG1IjsDoR+8WRLklvRF+AhBxAks6CoFaBd9T2rvs/u4wcVYFsWkonZNj9AKu9ZrjcZC9vbgLxkdYVYgAAAABJRU5ErkJggg=="}],"all_imported_dlls":["bcryptprimitives.dll","Wldap32.dll","devrtl.dll","cabinet.dll","advapi32.dll","lpk.dll","uxtheme.dll","SensApi.dll","normaliz.dll","npmproxy.dll","cfgmgr32.dll","setupapi.dll","KernelBase.dll","msisip.dll","comctl32.dll","schannel.dll","rasadhlp.dll","NapiNSP.dll","pnrpnsp.dll","winhttp.dll","user32.dll","nsi.dll","dnsapi.dll","nlaapi.dll","webio.dll","sechost.dll","rpcrt4.dll","msasn1.dll","rsaenh.dll","gpapi.dll","oleaut32.dll","cryptbase.dll","msxml3r.dll","rtutils.dll","winrnr.dll","cryptnet.dll","jscript.dll","cryptsp.dll","WSHTCPIP.DLL","shell32.dll","scrrun.dll","sspicli.dll","devobj.dll","imm32.dll","msctf.dll","sxs.dll","wintrust.dll","iertutil.dll","IPHLPAPI.DLL","rasman.dll","dhcpcsvc.dll","version.dll","clbcatq.dll","wshext.dll","RpcRtRemote.dll","urlmon.dll","ws2_32.dll","dhcpcsvc6.dll","bcrypt.dll","kernel32.dll","ole32.dll","shlwapi.dll","wininet.dll","profapi.dll","credssp.dll","secur32.dll","usp10.dll","scrobj.dll","msxml3.dll","ntmarta.dll","userenv.dll","FWPUCLNT.DLL","netprofm.dll","ntdll.dll","msvcrt.dll","dwmapi.dll","winnsi.dll","wship6.dll","ncrypt.dll","gdi32.dll","crypt32.dll","rasapi32.dll","mswsock.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"D8929461E6A6DEE6246B814BEC19FC69","sha256":"6bed06a80d4be315dffca046eeadd32874a0b9460c223e37d998c182864288ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08","sha256":"98b8ec2c577aa332e02234b3c84f34f9cc3a4a918dda7d93473065f197cb8ef2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"CabD74B.tmp","sha256":"c929701c67a05f90827563eedccf5eba8e65b2da970189a0371f28cd896708b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"TarD74C.tmp","sha256":"7e58975a4e1e86940f84e744709426939b85ae174dbbf020da3c893a54fd1da2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]}],"files_written":[{"path":"%WINDIR%\\System32\\en-US\\WScript.exe.mui","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%WINDIR%\\System32\\WScript.exe","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%WINDIR%\\System32\\en-US\\jscript.dll.mui","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%WINDIR%\\system32\\scrrun.dll","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%WINDIR%\\System32\\msxml3.dll\\1","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%WINDIR%\\System32\\msxml3.dll","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%WINDIR%\\system32\\en-US\\CRYPT32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\E49827401028F7A0F97B5576C77A26CB_C95AFE779A09B6B8C03D47AD8998ACC3","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\644B8874112055B5E195ECB0E8F243A4","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%WINDIR%\\System32\\en-US\\WINHTTP.dll.mui","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\431AD6E1C6D57ECCACF45CF10E4EBD9C","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\D8929461E6A6DEE6246B814BEC19FC69","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\D8929461E6A6DEE6246B814BEC19FC69","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%WINDIR%\\system32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\WSCRIPT_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\WSCRIPT_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!l4r0y7c!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!l4r0y7c!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!l4r0y7c!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!l4r0y7c!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"Local\\c:!users!l4r0y7c!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"Local\\c:!users!l4r0y7c!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"Local\\c:!users!l4r0y7c!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"Local\\c:!users!l4r0y7c!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5970905f7ca3e124ca60f1f3"}]}]}},"report_ids":{"sandbox_job_ids":["5970905f7ca3e124ca60f1f3"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious JS/Downldr.GN Sample 09921777f2aa… — Score 58/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 09921777f2aa…. Malware family: JS/Downldr.GN. Threat score 58/100. 12/27 AV engines flagged this file. 3 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/09921777f2aaf0fef2c90b2aea909b506e07bb4500ab92f38731061da27604d0"}],["$","meta","4",{"property":"og:title","content":"Malicious JS/Downldr.GN Sample 09921777f2aa… — Score 58/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 09921777f2aa…. Malware family: JS/Downldr.GN. Threat score 58/100. 12/27 AV engines flagged this file. 3 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/09921777f2aaf0fef2c90b2aea909b506e07bb4500ab92f38731061da27604d0"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious JS/Downldr.GN Sample 09921777f2aa… — Score 58/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 09921777f2aa…. Malware family: JS/Downldr.GN. Threat score 58/100. 12/27 AV engines flagged this file. 3 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]