26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4cc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious DownloadGuide.D application Sample 206468d91e46… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 206468d91e46…. Malware family: DownloadGuide.D application. Threat score 100/100. 15/28 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/206468d91e461872fce8475289555f923b7444b022e9077e0e949b9f748093d9","keywords":["Malicious","DownloadGuide.D application","malware analysis","sandbox report","threat intelligence","206468d91e461872fce8475289555f923b7444b022e9077e0e949b9f748093d9"],"about":{"@type":"SoftwareApplication","name":"download-audacity-windows.exe","applicationCategory":["peexe","executable"],"identifier":"206468d91e461872fce8475289555f923b7444b022e9077e0e949b9f748093d9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"DownloadGuide.D application","antivirusDetections":{"malicious":15,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T62a,"" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\ui\common\base\base.zip.part" at 00010335-00002820-00000046-48373794 "" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\ui\offers\3cc9566f4a803e726fe2ff36e63a6bc3\uifile.zip.part" at 00010335-00002820-00000046-48378351 "" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\ui\offers\3cc9566f4a803e726fe2ff36e63a6bc3\uifile.zip.part" at 00010335-00002820-00000046-48397740 "" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\ui\common\base\base.zip.part" at 00010335-00002820-00000046-48419989 "" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\ui\common\progress\progress.zip.part" at 00010335-00002820-00000046-48426794 "" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\ui\common\progress\progress.zip.part" at 00010335-00002820-00000046-48447174 "" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\ui\common\last\last.zip.part" at 00010335-00002820-00000046-48449126 "" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\ui\common\last\last.zip.part" at 00010335-00002820-00000046-48491205 "" queries volume information of "C:\Windows\Fonts\times.ttf" at 00010335-00002820-00000046-49395247 "" queries volume information of "C:\Windows\Fonts\times.ttf" at 00010335-00002820-00000046-4941857228:T8d3,"" created file "C:\Users\%OSUSER%\AppData\Local\Temp\DLG7DF0.tmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\dlgres\DLG-Product-Logo.png" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\initWindow\css\style.css" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\initWindow\noconnection.html" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\initWindow\progress.html" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\loadingImage\loadingImage.bmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\ui\common\base\base.zip.part" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\ui\offers\3cc9566f4a803e726fe2ff36e63a6bc3\uifile.zip.part" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\ui\offers\3cc9566f4a803e726fe2ff36e63a6bc3\index.html" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\ui\offers\3cc9566f4a803e726fe2ff36e63a6bc3\css\style.css" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\ui\offers\3cc9566f4a803e726fe2ff36e63a6bc3\img\img1.png" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\ui\offers\3cc9566f4a803e726fe2ff36e63a6bc3\img\progress-bar.png" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\ui\offers\3cc9566f4a803e726fe2ff36e63a6bc3\img\progress.png" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\ui\offers\3cc9566f4a803e726fe2ff36e63a6bc3\js\jquery-1.10.2.min.js" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\ui\common\progress\progress.zip.part" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\ui\common\base\index.html" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\ui\common\base\css\style.css" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\ui\common\base\js\jquery-1.10.2.min.js" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\ui\common\last\last.zip.part" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\DLG\ui\common\progress\index.html"29:T5f0,"GET /public-source/downloadguide/audacity/1.0/default/campaigns/product+website/ui/audacity-flow-5-text-en-us.zip HTTP/1.1Cache-Control: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: az687722.vo.msecnd.netConnection: Close" "GET /public-source/downloadguide/audacity/1.0/default/campaigns/product+website/ui/base.zip HTTP/1.1Cache-Control: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: az687722.vo.msecnd.netConnection: Close" "GET /public-source/downloadguide/audacity/1.0/default/campaigns/product+website/ui/progress.zip HTTP/1.1Cache-Control: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: az687722.vo.msecnd.netConnection: Close" "GET /public-source/downloadguide/audacity/1.0/default/campaigns/product+website/ui/last.zip HTTP/1.1Cache-Control: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: az687722.vo.msecnd.netConnection: Close"2a:T5a1,"" touched file "C:\Windows\SysWOW64\rsaenh.dll" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\SysWOW64\tzres.dll" "" touched file "C:\Windows\SysWOW64\en-US\msctf.dll.mui" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "" touched file "C:\Windows\SysWOW64\wshqos.dll" "" touched file "C:\Windows\SysWOW64\atl.dll" "" touched file "C:\Windows\SysWOW64\stdole2.tlb" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db" "" touched file "C:\Windows\Fonts\StaticCache.dat" "" touched file "C:\Windows\SysWOW64\ieframe.dll" "" touched file "C:\Windows\SysWOW64\en-US\jscript9.dll.mui"2b:T501,Pattern match: "https://secure.comodo.net/CPS0C" Pattern match: "crl.comodoca.com/COMODORSACodeSigningCA.crl0t" Pattern match: "crt.comodoca.com/COMODORSACodeSigningCA.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "crl.usertrust.com/AddTrustExternalCARoot.crl05" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$" Pattern match: "http://ic-dc.towersbundlebest.com/pr/92aa358a-4084-11e7-bdf5-020f5c607fb3/typ_1.html,cancelPage:http://ic-dc.towersbundlebest.com/pr/92aa358a-4084-11e7-bdf5-020f5c607fb3/inp_1.html,showVersion:false,offersList:[],icons:[],displayName:audacity" Pattern match: "http://dmd.metaservices.microsoft.com/dms/metadata.svc" Pattern match: "http://schemas.microsoft.com/windowsmetadata/services/2007/09/18/dms/DeviceMetadataService/GetDeviceMetadata" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "http://www.symauth.com/cps0*" Pattern match: "www.microsoft.com" Heuristic match: "dlg-configs.buzzrin.de" Heuristic match: "az687722.vo.msecnd.net" Heuristic match: "dlg-messages.buzzrin.de" Pattern match: "jquery.org/license"2c:T448,"POST /config-from-production HTTP/1.1Cache-Control: no-cacheContent-Type: application/jsonUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: dlg-configs.buzzrin.deContent-Length: 215Connection: Close" with no payload "POST /1/dg/3 HTTP/1.1Cache-Control: no-cacheContent-Type: application/jsonUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: dlg-messages.buzzrin.deContent-Length: 373Connection: Close" with no payload "POST /1/dg/3 HTTP/1.1Cache-Control: no-cacheContent-Type: application/jsonUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Host: dlg-messages.buzzrin.deContent-Length: 384Connection: Close" with no payload2d:T15da,Found malicious artifacts related to "104.41.149.192": ... URL: http://dlg-configs.buzzrin.de/config-from-production (AV positives: 2/66 scanned on 12/31/2017 03:51:06) URL: http://dlg-configs.buzzrin.de/ (AV positives: 2/66 scanned on 12/21/2017 11:07:38) URL: http://dlg-configs.buzzrin.de/config-from-production/ (AV positives: 2/64 scanned on 09/22/2017 16:58:10) URL: http://configs.freemium.de/config-from-production (AV positives: 3/65 scanned on 06/26/2017 03:17:50) URL: http://configs.freemium.de/config-from-production/ (AV positives: 2/64 scanned on 06/11/2017 09:16:45) File SHA256: 4dcda3c915831cb272e8a794f6be7f6df43205e94079a1514430e0776ca86483 (AV positives: 41/67 scanned on 01/02/2018 22:04:09) File SHA256: af1786caf608a20ea9b50c7a82b18bfe6b1afebd6e93b620f93dfffa1e2cb4a9 (AV positives: 42/67 scanned on 01/02/2018 21:22:27) File SHA256: d5492f96e84f3dabe298b7a357a9ae5660a6db99776890dc6788b9a07e3de392 (AV positives: 43/66 scanned on 01/02/2018 20:12:31) File SHA256: d11007c84b1eaa392819321a548ecea447951532e73cb2a28ae3bfcf03519b95 (AV positives: 39/67 scanned on 01/02/2018 19:55:33) File SHA256: ff86e6a8b9bfcac4153bfd62da237c2570e18b25e9e217945b124829d4e07504 (AV positives: 44/67 scanned on 01/02/2018 19:51:18) File SHA256: 53704a1e492c5d8afcb3326874e495e94ce7f8628ac192ade9e259f40feb1a4f (Date: 01/02/2018 12:16:15) File SHA256: ece7a37138a1d77f4ab195a1719ba1a9c8e674eb3e872187268548069e60ed65 (Date: 01/02/2018 12:15:58) File SHA256: e1eeab367acffea7dedc5c21b0b0b3725bbf38075f9d9a90d2f3083c5e272d6d (Date: 01/02/2018 07:56:33) File SHA256: 0a9a10439ae5ee2b7361e29731acf982e2810176d2dd3926f9b9dd498e352921 (Date: 01/02/2018 06:33:37) File SHA256: 203faef6e8db236ca9d1059c20ec2fad5b2cfa85c2c58ed0f009edec9a8f49d5 (Date: 01/02/2018 06:18:08) Found malicious artifacts related to "93.184.221.200": ... URL: http://az745681.vo.msecnd.net/downloadguides/195262b6-fb72-4167-a70f-c5830f911e0e/VLC%20Player.exe (AV positives: 1/67 scanned on 04/05/2016 17:22:29) URL: http://az745681.vo.msecnd.net/downloadguides/92e114be-6e12-48e2-8e2c-2af6d690efb4/setup-adobe-acrobat-x-pro.exe (AV positives: 1/67 scanned on 04/05/2016 17:15:03) URL: http://az745681.vo.msecnd.net/downloadguides/cd479ccc-5f04-419a-931d-bacea809ce90/download-audiograbber.exe (AV positives: 2/67 scanned on 04/05/2016 16:55:56) URL: http://az745681.vo.msecnd.net/downloadguides/89c83f9f-0f4c-4277-ba1f-c87e0e033952/download-tubebox.exe (AV positives: 2/67 scanned on 04/05/2016 16:54:59) URL: http://az745681.vo.msecnd.net/downloadguides/24016f38-bdd7-4ade-b21b-ccd21acffdfe/setup-directx-9.exe (AV positives: 3/67 scanned on 04/05/2016 16:54:56) File SHA256: 39d188a0d6d0533b2ec2ff96ec72e7a16b27c07a0b59cb45fabcc8d2afebfddb (AV positives: 38/66 scanned on 01/03/2018 00:51:56) File SHA256: 4dcda3c915831cb272e8a794f6be7f6df43205e94079a1514430e0776ca86483 (AV positives: 41/67 scanned on 01/02/2018 22:04:09) File SHA256: 65077f841f3199e0daa9daee4ea48b2b3fe47a4b1de20e7299e6bcb51a627dce (AV positives: 37/66 scanned on 01/02/2018 21:51:26) File SHA256: af1786caf608a20ea9b50c7a82b18bfe6b1afebd6e93b620f93dfffa1e2cb4a9 (AV positives: 42/67 scanned on 01/02/2018 21:22:27) File SHA256: 8ad52de11d41ae3ed486cdc4a5115696c9619477380ea49d30d80b47d3c39b37 (AV positives: 38/67 scanned on 01/02/2018 20:44:16) File SHA256: 7d27c78b6a713f19c16e54a3a7bf7ad5d220fdc96ec3c274a2cf8a3e25e8ee09 (Date: 01/02/2018 08:46:07) File SHA256: 04f69e8ba62c8f2f796f3e7d8bd3022e9f832a0b815f254355bb7b4da5e0e565 (Date: 01/02/2018 08:17:30) File SHA256: 774ee72b96148673de6b421e0a2dc87c7b94e85cd426baca27d59ff3fe0415de (Date: 01/02/2018 08:05:10) File SHA256: 3b67efac450b58ad5652bba068c4ca87c7093b51b804141d7719f6cfaaf6a24b (Date: 01/02/2018 07:21:29) File SHA256: e0a2319fd2788dae97d86ab72666a4e9c31e62dcdace334ee3a24470ff585109 (Date: 01/02/2018 07:20:24) Found malicious artifacts related to "104.45.146.238": ... URL: http://dlg-messages.buzzrin.de/ (AV positives: 1/66 scanned on 12/22/2017 02:07:01) URL: http://dlg-messages.buzzrin.de/1/dg/3 (AV positives: 3/66 scanned on 12/22/2017 02:05:19) URL: http://dlg-messages.buzzrin.de/1/dg/3/error (AV positives: 2/66 scanned on 12/21/2017 09:36:51) URL: http://dlg-messages.buzzrin.de/1/dg/3/ (AV positives: 2/65 scanned on 09/06/2017 09:33:53) URL: http://dlg-messages.buzzrin.de/1/dg/3/error/ (AV positives: 3/65 scanned on 06/24/2017 09:03:11) File SHA256: 39d188a0d6d0533b2ec2ff96ec72e7a16b27c07a0b59cb45fabcc8d2afebfddb (AV positives: 38/66 scanned on 01/03/2018 00:51:56) File SHA256: 4dcda3c915831cb272e8a794f6be7f6df43205e94079a1514430e0776ca86483 (AV positives: 41/67 scanned on 01/02/2018 22:04:09) File SHA256: 65077f841f3199e0daa9daee4ea48b2b3fe47a4b1de20e7299e6bcb51a627dce (AV positives: 37/66 scanned on 01/02/2018 21:51:26) File SHA256: af1786caf608a20ea9b50c7a82b18bfe6b1afebd6e93b620f93dfffa1e2cb4a9 (AV positives: 42/67 scanned on 01/02/2018 21:22:27) File SHA256: 8ad52de11d41ae3ed486cdc4a5115696c9619477380ea49d30d80b47d3c39b37 (AV positives: 38/67 scanned on 01/02/2018 20:44:16) File SHA256: ece7a37138a1d77f4ab195a1719ba1a9c8e674eb3e872187268548069e60ed65 (Date: 01/02/2018 12:15:58) File SHA256: 1ca798d9f24b6df3b9d22ed377cfa01686745b8959a11dc7c087265c896b5a14 (Date: 01/02/2018 08:10:58) File SHA256: 3b67efac450b58ad5652bba068c4ca87c7093b51b804141d7719f6cfaaf6a24b (Date: 01/02/2018 07:21:29) File SHA256: e0a2319fd2788dae97d86ab72666a4e9c31e62dcdace334ee3a24470ff585109 (Date: 01/02/2018 07:20:24) File SHA256: a547eb5f4083a8c65f4e572b816faec7a12851238e4a29b261ac6b26a0b8955b (Date: 01/02/2018 06:43:14)2e:T15da,Found malicious artifacts related to "104.41.149.192": ... URL: http://dlg-configs.buzzrin.de/config-from-production (AV positives: 2/66 scanned on 12/31/2017 03:51:06) URL: http://dlg-configs.buzzrin.de/ (AV positives: 2/66 scanned on 12/21/2017 11:07:38) URL: http://dlg-configs.buzzrin.de/config-from-production/ (AV positives: 2/64 scanned on 09/22/2017 16:58:10) URL: http://configs.freemium.de/config-from-production (AV positives: 3/65 scanned on 06/26/2017 03:17:50) URL: http://configs.freemium.de/config-from-production/ (AV positives: 2/64 scanned on 06/11/2017 09:16:45) File SHA256: 4dcda3c915831cb272e8a794f6be7f6df43205e94079a1514430e0776ca86483 (AV positives: 41/67 scanned on 01/02/2018 22:04:09) File SHA256: af1786caf608a20ea9b50c7a82b18bfe6b1afebd6e93b620f93dfffa1e2cb4a9 (AV positives: 42/67 scanned on 01/02/2018 21:22:27) File SHA256: d5492f96e84f3dabe298b7a357a9ae5660a6db99776890dc6788b9a07e3de392 (AV positives: 43/66 scanned on 01/02/2018 20:12:31) File SHA256: d11007c84b1eaa392819321a548ecea447951532e73cb2a28ae3bfcf03519b95 (AV positives: 39/67 scanned on 01/02/2018 19:55:33) File SHA256: ff86e6a8b9bfcac4153bfd62da237c2570e18b25e9e217945b124829d4e07504 (AV positives: 44/67 scanned on 01/02/2018 19:51:18) File SHA256: 53704a1e492c5d8afcb3326874e495e94ce7f8628ac192ade9e259f40feb1a4f (Date: 01/02/2018 12:16:15) File SHA256: ece7a37138a1d77f4ab195a1719ba1a9c8e674eb3e872187268548069e60ed65 (Date: 01/02/2018 12:15:58) File SHA256: e1eeab367acffea7dedc5c21b0b0b3725bbf38075f9d9a90d2f3083c5e272d6d (Date: 01/02/2018 07:56:33) File SHA256: 0a9a10439ae5ee2b7361e29731acf982e2810176d2dd3926f9b9dd498e352921 (Date: 01/02/2018 06:33:37) File SHA256: 203faef6e8db236ca9d1059c20ec2fad5b2cfa85c2c58ed0f009edec9a8f49d5 (Date: 01/02/2018 06:18:08) Found malicious artifacts related to "93.184.221.200": ... URL: http://az745681.vo.msecnd.net/downloadguides/195262b6-fb72-4167-a70f-c5830f911e0e/VLC%20Player.exe (AV positives: 1/67 scanned on 04/05/2016 17:22:29) URL: http://az745681.vo.msecnd.net/downloadguides/92e114be-6e12-48e2-8e2c-2af6d690efb4/setup-adobe-acrobat-x-pro.exe (AV positives: 1/67 scanned on 04/05/2016 17:15:03) URL: http://az745681.vo.msecnd.net/downloadguides/cd479ccc-5f04-419a-931d-bacea809ce90/download-audiograbber.exe (AV positives: 2/67 scanned on 04/05/2016 16:55:56) URL: http://az745681.vo.msecnd.net/downloadguides/89c83f9f-0f4c-4277-ba1f-c87e0e033952/download-tubebox.exe (AV positives: 2/67 scanned on 04/05/2016 16:54:59) URL: http://az745681.vo.msecnd.net/downloadguides/24016f38-bdd7-4ade-b21b-ccd21acffdfe/setup-directx-9.exe (AV positives: 3/67 scanned on 04/05/2016 16:54:56) File SHA256: 39d188a0d6d0533b2ec2ff96ec72e7a16b27c07a0b59cb45fabcc8d2afebfddb (AV positives: 38/66 scanned on 01/03/2018 00:51:56) File SHA256: 4dcda3c915831cb272e8a794f6be7f6df43205e94079a1514430e0776ca86483 (AV positives: 41/67 scanned on 01/02/2018 22:04:09) File SHA256: 65077f841f3199e0daa9daee4ea48b2b3fe47a4b1de20e7299e6bcb51a627dce (AV positives: 37/66 scanned on 01/02/2018 21:51:26) File SHA256: af1786caf608a20ea9b50c7a82b18bfe6b1afebd6e93b620f93dfffa1e2cb4a9 (AV positives: 42/67 scanned on 01/02/2018 21:22:27) File SHA256: 8ad52de11d41ae3ed486cdc4a5115696c9619477380ea49d30d80b47d3c39b37 (AV positives: 38/67 scanned on 01/02/2018 20:44:16) File SHA256: 7d27c78b6a713f19c16e54a3a7bf7ad5d220fdc96ec3c274a2cf8a3e25e8ee09 (Date: 01/02/2018 08:46:07) File SHA256: 04f69e8ba62c8f2f796f3e7d8bd3022e9f832a0b815f254355bb7b4da5e0e565 (Date: 01/02/2018 08:17:30) File SHA256: 774ee72b96148673de6b421e0a2dc87c7b94e85cd426baca27d59ff3fe0415de (Date: 01/02/2018 08:05:10) File SHA256: 3b67efac450b58ad5652bba068c4ca87c7093b51b804141d7719f6cfaaf6a24b (Date: 01/02/2018 07:21:29) File SHA256: e0a2319fd2788dae97d86ab72666a4e9c31e62dcdace334ee3a24470ff585109 (Date: 01/02/2018 07:20:24) Found malicious artifacts related to "104.45.146.238": ... URL: http://dlg-messages.buzzrin.de/ (AV positives: 1/66 scanned on 12/22/2017 02:07:01) URL: http://dlg-messages.buzzrin.de/1/dg/3 (AV positives: 3/66 scanned on 12/22/2017 02:05:19) URL: http://dlg-messages.buzzrin.de/1/dg/3/error (AV positives: 2/66 scanned on 12/21/2017 09:36:51) URL: http://dlg-messages.buzzrin.de/1/dg/3/ (AV positives: 2/65 scanned on 09/06/2017 09:33:53) URL: http://dlg-messages.buzzrin.de/1/dg/3/error/ (AV positives: 3/65 scanned on 06/24/2017 09:03:11) File SHA256: 39d188a0d6d0533b2ec2ff96ec72e7a16b27c07a0b59cb45fabcc8d2afebfddb (AV positives: 38/66 scanned on 01/03/2018 00:51:56) File SHA256: 4dcda3c915831cb272e8a794f6be7f6df43205e94079a1514430e0776ca86483 (AV positives: 41/67 scanned on 01/02/2018 22:04:09) File SHA256: 65077f841f3199e0daa9daee4ea48b2b3fe47a4b1de20e7299e6bcb51a627dce (AV positives: 37/66 scanned on 01/02/2018 21:51:26) File SHA256: af1786caf608a20ea9b50c7a82b18bfe6b1afebd6e93b620f93dfffa1e2cb4a9 (AV positives: 42/67 scanned on 01/02/2018 21:22:27) File SHA256: 8ad52de11d41ae3ed486cdc4a5115696c9619477380ea49d30d80b47d3c39b37 (AV positives: 38/67 scanned on 01/02/2018 20:44:16) File SHA256: ece7a37138a1d77f4ab195a1719ba1a9c8e674eb3e872187268548069e60ed65 (Date: 01/02/2018 12:15:58) File SHA256: 1ca798d9f24b6df3b9d22ed377cfa01686745b8959a11dc7c087265c896b5a14 (Date: 01/02/2018 08:10:58) File SHA256: 3b67efac450b58ad5652bba068c4ca87c7093b51b804141d7719f6cfaaf6a24b (Date: 01/02/2018 07:21:29) File SHA256: e0a2319fd2788dae97d86ab72666a4e9c31e62dcdace334ee3a24470ff585109 (Date: 01/02/2018 07:20:24) File SHA256: a547eb5f4083a8c65f4e572b816faec7a12851238e4a29b261ac6b26a0b8955b (Date: 01/02/2018 06:43:14)2f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A////////////////////////////////////////////////////////////////////d3d3f///d3d/////////93iHd3d3d3d3d3///////3eI//iHd3iIiIdw//////94iP//+IeIiP//dw//////iIj4Z4h4iIiP//d3/////4iI+CIiiIiIiP//d/////+IiPiiJ4iIiP///4d/////iIj4MyeIiP+P//+Hf////4j4+DMoiIj3eP//93////+I/4h3OIiP+Ij/iId/////iP+IizeIj/iI+IiHf////4j/iLu3j///j/iIh3////+I6IiId4////+IiId/////iGiIiIh///+IiIh3/////4hoiIiIiP//iIiId/////+Ij4iIiIeP//iIh3//////iI+Oju7oeI/4iHf//////4iPj/iIiOd3d3f///////+P/4////+IiId3f///////j/h3eIiP/4iIiP///////4iId3d3iIj/+H////////iPiIiIiIiI//h////////4/4iIiIiIiP//d///////+IiIiIiIiIf//4f///////iIiIiIiIiHj/iH/////////4iIiIiIh4iI//////////////////////////////////////////////////////////////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"206468d91e461872fce8475289555f923b7444b022e9077e0e949b9f748093d9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790439317986,"unified_at":"2026-09-26T16:15:17.986Z","metadata":{"hashes":{"sha256":"206468d91e461872fce8475289555f923b7444b022e9077e0e949b9f748093d9","sha1":"72f49afd9f784c70d28bd89b1ee8d581940c2f59","md5":"04cb105e0e58281bd94fb692191a255f","sha512":"75167c6ece15735ce737a5f1289eefcb775ec4c2b43a4f8404997537d8e02b614751632e696780ff56fd6f51f1df3e2764749445f78f0240408fe4f647fe6907","ssdeep":"12288:fW9WJrucV/e5GzfL1LQaMB3+NShR/o1SXZtmswt2QaV7PE:uQwcU5GzfL1xMx+NShR/o1SXTmswwbVA","ssdeep_chunks":["12288:fW9WJru","12288:W9WJruc","12288:9WJrucV","12288:WJrucV/","12288:JrucV/e","12288:rucV/e5","12288:ucV/e5G","12288:cV/e5Gz","12288:V/e5Gzf","12288:/e5GzfL","12288:e5GzfL1","12288:5GzfL1L","12288:GzfL1LQ","12288:zfL1LQa","12288:fL1LQaM","12288:L1LQaMB","12288:1LQaMB3","12288:LQaMB3+","12288:QaMB3+N","12288:aMB3+NS","12288:MB3+NSh","12288:B3+NShR","12288:3+NShR/","12288:+NShR/o","12288:NShR/o1","12288:ShR/o1S","12288:hR/o1SX","12288:R/o1SXZ","12288:/o1SXZt","12288:o1SXZtm","12288:1SXZtms","12288:SXZtmsw","12288:XZtmswt","12288:Ztmswt2","12288:tmswt2Q","12288:mswt2Qa","12288:swt2QaV","12288:wt2QaV7","12288:t2QaV7P","12288:2QaV7PE","24576:fW9WJru","24576:W9WJruc","24576:9WJrucV","24576:WJrucV/","24576:JrucV/e","24576:rucV/e5","24576:ucV/e5G","24576:cV/e5Gz","24576:V/e5Gzf","24576:/e5GzfL","24576:e5GzfL1","24576:5GzfL1L","24576:GzfL1LQ","24576:zfL1LQa","24576:fL1LQaM","24576:L1LQaMB","24576:1LQaMB3","24576:LQaMB3+","24576:QaMB3+N","24576:aMB3+NS","24576:MB3+NSh","24576:B3+NShR","24576:3+NShR/","24576:+NShR/o","24576:NShR/o1","24576:ShR/o1S","24576:hR/o1SX","24576:R/o1SXZ","24576:/o1SXZt","24576:o1SXZtm","24576:1SXZtms","24576:SXZtmsw","24576:XZtmswt","24576:Ztmswt2","24576:tmswt2Q","24576:mswt2Qa","24576:swt2QaV","24576:wt2QaV7","24576:t2QaV7P","24576:2QaV7PE","12288:uQwcU5G","12288:QwcU5Gz","12288:wcU5Gzf","12288:cU5GzfL","12288:U5GzfL1","12288:5GzfL1x","12288:GzfL1xM","12288:zfL1xMx","12288:fL1xMx+","12288:L1xMx+N","12288:1xMx+NS","12288:xMx+NSh","12288:Mx+NShR","12288:x+NShR/","12288:R/o1SXT","12288:/o1SXTm","12288:o1SXTms","12288:1SXTmsw","12288:SXTmsww","12288:XTmswwb","12288:TmswwbV","12288:mswwbVA"],"imphash":"7d7c19c712cf933cf2fcc86f830eeff3"},"file_info":{"file_name":"download-audacity-windows.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":532136,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1514941228000,"last_seen":1629363465000,"last_multi_scan":1629363465000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":21,"suspicious_count":17,"malicious_count":7,"total":45},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"GrayWare[AdWare]/Win32.DownloadGuide.dd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dldr.Agent.plzbm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Application.Bundler.DownloadGuide.48","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Application.Win32.DownloadGuide.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/DownloadGuide.D application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"PUA.DownloadGuide","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Unwanted-Program ( 004ceeee1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"not-a-virus:HEUR:Downloader.Win32.DownloaderGuide.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Covus.ewqchz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"PUA.Freemiumgm2.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"PUA.Downloader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"PUP.Win32.Freemium.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Downloader.DownloaderGuide","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Downloader.DownloaderGuide.Win32.6147","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"DownloadGuide.D application","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 48936-3447-0041AE7E\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00010335-00002820-719-12-00BF0932\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00010335-00002820-719-33-00BF471A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00010335-00002820-719-2006-00BFAE7E","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API RegDeleteKeyExW@KERNEL32.DLL at 00010335-00002820-719-472-00BE487C","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00010335-00002820-719-394-00BF2EE1\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00010335-00002820-719-420-00BFB5E5","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00010335-00002820-719-276-00BF0605\n GetProcessHeap@KERNEL32.DLL at 00010335-00002820-719-204-00BF04BB","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$27","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"PATH\"; Value: \"00000000010000005800000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D006900630072006F0073006F006600740020004F00660066006900630065005C004F0066006600690063006500310034005C000000\")\n \"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\206468D91E461872FCE8475289555F923B7444B022E9077E0E949B9F748093D9.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\206468D91E461872FCE8475289555F923B7444B022E9077E0E949B9F748093D9.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"dlg-configs.buzzrin.de\"\n \"az687722.vo.msecnd.net\"\n \"dlg-messages.buzzrin.de\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.41.149.192:80\"\n \"93.184.221.200:80\"\n \"104.45.146.238:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"$28","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\DlgCpp\"\n \"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_\"\n \"Local\\ZonesCacheCounterMutex\"\n \"_!SHMSFTHISTORY!_\"\n \"DlgCpp\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$29","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"\" called \"Microsoft.XMLHTTP.1.0.CreateObject\" ...","origin":"API Call","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"MS_AutodialMonitor\"\n \"\" searching for class \"MS_WebCheckMonitor\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE\" (SHA1: 02:FA:F3:E2:91:43:54:68:60:78:57:69:4D:F5:E4:5B:68:85:18:68; see report for more information)\n The input sample is signed with a certificate issued by \"CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: 75:FB:26:0D:F8:7C:9F:C9:44:5B:CA:9A:93:0B:E5:20:32:79:82:DC; see report for more information)\n The input sample is signed with a certificate issued by \"CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE\" (SHA1: F5:AD:0B:CC:1A:D5:6C:D1:50:72:5B:1C:86:6C:30:AD:92:EF:21:B0; see report for more information)\n The input sample is signed with a certificate issued by \"CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: B6:9E:75:2B:BE:88:B4:45:82:00:A7:C0:F4:F5:B3:CC:E6:F3:5B:47; see report for more information)","origin":"Certificate Data","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"index.html\" has type \"HTML document UTF-8 Unicode text with CRLF line terminators\"\n \"img1.png\" has type \"PNG image data 164 x 314 2-bit colormap non-interlaced\"\n \"base.zip.part\" has type \"Zip archive data at least v2.0 to extract\"\n \"last.zip.part\" has type \"Zip archive data at least v2.0 to extract\"\n \"style.css\" has type \"assembler source ASCII text with CRLF line terminators\"\n \"bar-bg.png\" has type \"PNG image data 1 x 23 8-bit/color RGBA non-interlaced\"\n \"bar-rb.png\" has type \"PNG image data 19 x 23 8-bit/color RGBA non-interlaced\"\n \"style.css\" has type \"ASCII text with CRLF line terminators\"\n \"progress.zip.part\" has type \"Zip archive data at least v2.0 to extract\"\n \"br-bg.png\" has type \"PNG image data 1 x 23 8-bit grayscale non-interlaced\"\n \"loadingImage.bmp\" has type \"PC bitmap Windows 3.x format 5850 x 78 x 32\"\n \"progress.png\" has type \"PNG image data 417 x 21 8-bit/color RGBA non-interlaced\"\n \"jquery-1.10.2.min.js\" has type \"ASCII text with very long lines with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2a","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2b","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"206468d91e461872fce8475289555f923b7444b022e9077e0e949b9f748093d9.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00010335-00002820-00000033-47904728","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rdata with unusual entropies 7.29471073187","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.dll at 48936-1190-004076BB\n FindResourceW@KERNEL32.DLL at 00010335-00002820-719-562-00BE76BB","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"$2c","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 42029568)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 42029568)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 512)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 73399552)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"3.1.0.201\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\DLG\\test.part\" with delete access\n \"\" opened \"%TEMP%\\DLG\\ui\\common\\base\\base.zip.part\" with delete access\n \"\" opened \"%TEMP%\\DLG\\ui\\offers\\3cc9566f4a803e726fe2ff36e63a6bc3\\uifile.zip.part\" with delete access\n \"\" opened \"%TEMP%\\DLG\\ui\\common\\progress\\progress.zip.part\" with delete access\n \"\" opened \"%TEMP%\\DLG\\ui\\common\\last\\last.zip.part\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n RegEnumKeyExW\n RegOpenKeyExW\n RegDeleteKeyW\n WriteFile\n OutputDebugStringW\n GetModuleFileNameW\n IsDebuggerPresent\n UnhandledExceptionFilter\n LoadLibraryExW\n CreateThread\n TerminateProcess\n LoadLibraryW\n GetTickCount\n LoadLibraryA\n GetStartupInfoW\n GetProcAddress\n FindNextFileW\n FindFirstFileW\n CreateFileW\n GetCommandLineW\n GetModuleHandleW\n FindResourceW\n Sleep\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET MALWARE PUP Win32/DownloadGuide.A\" (SID: 2018513, Rev: 3, Severity: 1) categorized as \"A Network Trojan was detected\" (PUA/PUP/Adware)\n Detected alert \"ET MALWARE PUP W32/DownloadGuide.D\" (SID: 2019974, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\" (PUA/PUP/Adware)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"37/67 Antivirus vendors marked sample as malicious (55% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"37/67 Antivirus vendors marked sample as malicious (55% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2d","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$2e","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_W@NTDLL.DLL at 00010335-00002820-719-2012-00C0BEE2","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":9,"imported_dlls_count":93,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":101,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":3,"contacted_urls_count":7,"http_requests_count":7},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"5a4c28df7ca3e17f5d402a65","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Application.Bundler.DownloadGuide","contacted_countries":["EU","USA"],"submit_name":"download-audacity-windows.exe","analysis_start_time":"2018-01-03T01:50:24+00:00","indicators_count":{"informative":21,"suspicious":18,"malicious":8},"tags":["Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.41.149.192","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"address":"93.184.221.200","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"address":"104.45.146.238","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]}],"dns_resolutions":[{"domain":"dlg-messages.buzzrin.de","address":"104.45.146.238","country":"United States","registrar_organization":"united-domains AG","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"domain":"dlg-configs.buzzrin.de","address":"104.41.149.192","country":"United States","registrar_organization":"united-domains AG","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"domain":"az687722.vo.msecnd.net","address":"93.184.221.200","country":"European Union","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Microsoft Corporation","registrar_creation_date":"2008-09-29T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]}],"http_requests":[{"host":"dlg-configs.buzzrin.de","host_ip":"104.41.149.192:80","url":"/","method":"HEAD","response_code":"200","response_phrase":"OK","header":"HEAD / HTTP/1.1\nConnection: Close\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\nHost: dlg-configs.buzzrin.de\nContent-Length: 0\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"host":"dlg-configs.buzzrin.de","host_ip":"104.41.149.192:80","url":"/config-from-production","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /config-from-production HTTP/1.1\nCache-Control: no-cache\nContent-Type: application/json\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\nHost: dlg-configs.buzzrin.de\nContent-Length: 215\nConnection: Close","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"host":"az687722.vo.msecnd.net","host_ip":"93.184.221.200:80","url":"/public-source/downloadguide/audacity/1.0/default/campaigns/product+website/ui/audacity-flow-5-text-en-us.zip","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /public-source/downloadguide/audacity/1.0/default/campaigns/product+website/ui/audacity-flow-5-text-en-us.zip HTTP/1.1\nCache-Control: no-cache\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\nHost: az687722.vo.msecnd.net\nConnection: Close","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"host":"az687722.vo.msecnd.net","host_ip":"93.184.221.200:80","url":"/public-source/downloadguide/audacity/1.0/default/campaigns/product+website/ui/base.zip","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /public-source/downloadguide/audacity/1.0/default/campaigns/product+website/ui/base.zip HTTP/1.1\nCache-Control: no-cache\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\nHost: az687722.vo.msecnd.net\nConnection: Close","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"host":"dlg-messages.buzzrin.de","host_ip":"104.45.146.238:80","url":"/1/dg/3","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /1/dg/3 HTTP/1.1\nCache-Control: no-cache\nContent-Type: application/json\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\nHost: dlg-messages.buzzrin.de\nContent-Length: 373\nConnection: Close","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"host":"az687722.vo.msecnd.net","host_ip":"93.184.221.200:80","url":"/public-source/downloadguide/audacity/1.0/default/campaigns/product+website/ui/progress.zip","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /public-source/downloadguide/audacity/1.0/default/campaigns/product+website/ui/progress.zip HTTP/1.1\nCache-Control: no-cache\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\nHost: az687722.vo.msecnd.net\nConnection: Close","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"host":"az687722.vo.msecnd.net","host_ip":"93.184.221.200:80","url":"/public-source/downloadguide/audacity/1.0/default/campaigns/product+website/ui/last.zip","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /public-source/downloadguide/audacity/1.0/default/campaigns/product+website/ui/last.zip HTTP/1.1\nCache-Control: no-cache\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\nHost: az687722.vo.msecnd.net\nConnection: Close","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}],"processes":[{"pid":2820,"ppid":0,"name":"206468d91e461872fce8475289555f923b7444b022e9077e0e949b9f748093d9.exe","command_line":"","sha256":"206468d91e461872fce8475289555f923b7444b022e9077e0e949b9f748093d9","normalized_path":"C:\\206468d91e461872fce8475289555f923b7444b022e9077e0e949b9f748093d9.exe","uid":"00010335-00002820","icon":"$2f"}],"all_imported_dlls":["dwmapi.dll","ntmarta.dll","bcrypt.dll","d2d1.dll","dxgi.dll","msls31.dll","winnsi.dll","KernelBase.dll","msctf.dll","normaliz.dll","comdlg32.dll","IPHLPAPI.DLL","DWrite.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","wow64.dll","iertutil.dll","clbcatq.dll","nlaapi.dll","WSHTCPIP.DLL","d3d10warp.dll","rasadhlp.dll","msasn1.dll","imm32.dll","api-ms-win-downlevel-version-l1-1-0.dll","version.dll","uxtheme.dll","jscript.dll","sxs.dll","wshqos.dll","Wldap32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","wship6.dll","netprofm.dll","crypt32.dll","d3d11.dll","WindowsCodecs.dll","oleaut32.dll","wow64win.dll","lpk.dll","usp10.dll","msvcrt.dll","sechost.dll","atl.dll","ntdll.dll","devobj.dll","mlang.dll","cryptbase.dll","shlwapi.dll","profapi.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","cfgmgr32.dll","secur32.dll","ole32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","psapi.dll","npmproxy.dll","kernel32.dll","rpcrt4.dll","userenv.dll","comctl32.dll","RpcRtRemote.dll","ws2_32.dll","dispex.dll","propsys.dll","sspicli.dll","wininet.dll","cryptsp.dll","mshtml.dll","msxml3.dll","msxml3r.dll","wintrust.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","shell32.dll","rsaenh.dll","nsi.dll","dhcpcsvc.dll","FWPUCLNT.DLL","setupapi.dll","apphelp.dll","wow64cpu.dll","gdi32.dll","mswsock.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","dnsapi.dll","dhcpcsvc6.dll","msimtf.dll","jscript9.dll","user32.dll","advapi32.dll","urlmon.dll","ieframe.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"img1.png","sha256":"0b26609ae9e0f053dbc1b73eb33bc24797b2be5f29bb1ad1fd089f56baeeeaef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"DLG7DF0.tmp","sha256":"8ec69e605927392ddd10194c95d4c185d3efe6d0dc8874b6a5bad3d759c806d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"DLG-Product-Logo.png","sha256":"bd284633e72034f963ae0db7bbf7714cd735dcb51d905969f1d8b03b73952033","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"noconnection.html","sha256":"b4508b7dcc08b2b93cd64bee68bd5174fe48f48280e59f9a81d4861c3ef0431d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"progress.html","sha256":"6c926310dc1495ef47e07efd9b695f34c7d4f755fa011cd73455b5e4ed93898b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"loadingImage.bmp","sha256":"57f3c81751562f8327a62e3381b93367755a2dddc18becc6fedefe6ca6554d63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"base.zip.part","sha256":"698353621370e81d4c95465ecfd421e77ce289fafb3d357b5d702839333d2fe3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"last.zip.part","sha256":"bcfa91e53aa5eb9dc451a4a2f781937b3340b03cdfc310b767718573ac9b3d60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"151.gif","sha256":"eaaaf0870af1afa3c0f800b055d4fcb3827d2937ba9c0fa0da16a55a23631cf9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"bar-bg.png","sha256":"f79d2e4d15a6e8a01b6dc586b870069fe5687d9ef7d76b36ccdf7f3b38c7b30c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"bar-lb.png","sha256":"55816fb1d66fc4c2f6f21812598dd249427aca9f1e053c5c8f3779c742bb36c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"bar-rb.png","sha256":"8a1ee7e13b4e11d008cd73344e7d44c843a4e1e34ac16ce1978f3aedc2f26f88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"br-b.png","sha256":"2632037d75cdbd99a20223c29a82605b4fe673a6c8b335755e7559847711888e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"br-bg.png","sha256":"a69455e4be20f60b2dd773d7794e009391e821dd4114fa78f5bc5f4320b983bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"br-lb.png","sha256":"7aa67d869b0c26c0a43039883c15f5f2ee9d760d0953df832a190bae970ebe94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"br-rb.png","sha256":"39ebb12dc93b5700a29fe38e0b0f400d02f9b70507646ff940c656b3ca225a25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"icon.png","sha256":"d7995fc3f048903072ad690c41c78042cf7b352a60ba79debd8bb2bdea7dfd39","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"progress.zip.part","sha256":"8875780fc92a48b870494e857e5a1bfe0c3e90313834aa24dddea5e7b7e60bf6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"style.css","sha256":"c3f2c9ee3ed0e4b4a2e00885b161e35defe4aa40d5bd81d0fca83241d7a57fa1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"progress-bar.png","sha256":"8cf5ba182438452512e370053cf92775c1c0e1e8424c1d046bcee17cc02502fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG7DF0.tmp","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\requirements","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\dlgres","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\dlgres\\DLG-Product-Logo.png","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\initWindow\\css","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\initWindow\\css\\style.css","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\initWindow\\noconnection.html","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\initWindow","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\initWindow\\progress.html","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\loadingImage","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\loadingImage\\loadingImage.bmp","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\progress","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\last","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\offers\\3cc9566f4a803e726fe2ff36e63a6bc3\\uifile.zip.part","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\offers\\3cc9566f4a803e726fe2ff36e63a6bc3\\uifile.zip","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\offers\\3cc9566f4a803e726fe2ff36e63a6bc3\\index.html","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\offers\\3cc9566f4a803e726fe2ff36e63a6bc3\\css","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\offers\\3cc9566f4a803e726fe2ff36e63a6bc3\\css\\style.css","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\offers\\3cc9566f4a803e726fe2ff36e63a6bc3\\img\\img1.png","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\offers\\3cc9566f4a803e726fe2ff36e63a6bc3\\img\\progress-bar.png","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\offers\\3cc9566f4a803e726fe2ff36e63a6bc3\\img","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\offers\\3cc9566f4a803e726fe2ff36e63a6bc3\\img\\progress.png","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\offers","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\offers\\3cc9566f4a803e726fe2ff36e63a6bc3","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\offers\\3cc9566f4a803e726fe2ff36e63a6bc3\\js","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\offers\\3cc9566f4a803e726fe2ff36e63a6bc3\\js\\jquery-1.10.2.min.js","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\base\\base.zip","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\base\\css","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\base\\js","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\progress\\progress.zip","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\progress\\index.html","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\progress\\css","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\progress\\css\\style.css","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\progress\\img\\151.gif","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\progress\\img\\bar-bg.png","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\progress\\img\\bar-lb.png","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\progress\\img\\bar-rb.png","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\progress\\img\\br-b.png","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\progress\\img\\br-bg.png","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\progress\\img\\br-lb.png","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\progress\\img\\br-rb.png","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\progress\\img\\icon.png","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\progress\\img\\img1.png","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\progress\\img\\progress-bar.png","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\progress\\img","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\last\\last.zip","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\progress\\img\\progress.png","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\last\\index.html","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\last\\css","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\last\\css\\style.css","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\last\\img","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\last\\img\\img1.png","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\last\\js","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\last\\js\\jquery-1.10.2.min.js","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\progress\\js","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\progress\\js\\jquery-1.10.2.min.js","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%WINDIR%\\SysWOW64\\atl.dll","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%WINDIR%\\SysWOW64\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%WINDIR%\\SysWOW64\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\base\\css\\style.css","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\base\\js\\jquery-1.10.2.min.js","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\jscript9.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%WINDIR%\\SysWOW64\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%WINDIR%\\SysWOW64\\msxml3.dll\\1","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%WINDIR%\\SysWOW64\\msxml3.dll","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\base\\index.html","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"C:\\206468d91e461872fce8475289555f923b7444b022e9077e0e949b9f748093d9.exe","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%WINDIR%\\Fonts\\times.ttf","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%WINDIR%\\SysWOW64\\shell32.dll","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"path":"%TEMP%\\DLG\\ui\\common\\base","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DlgCpp","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"DlgCpp","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a4c28df7ca3e17f5d402a65"}]}]}},"report_ids":{"sandbox_job_ids":["5a4c28df7ca3e17f5d402a65"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious DownloadGuide.D application Sample 206468d91e46… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 206468d91e46…. Malware family: DownloadGuide.D application. Threat score 100/100. 15/28 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/206468d91e461872fce8475289555f923b7444b022e9077e0e949b9f748093d9"}],["$","meta","4",{"property":"og:title","content":"Malicious DownloadGuide.D application Sample 206468d91e46… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 206468d91e46…. Malware family: DownloadGuide.D application. Threat score 100/100. 15/28 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/206468d91e461872fce8475289555f923b7444b022e9077e0e949b9f748093d9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious DownloadGuide.D application Sample 206468d91e46… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 206468d91e46…. Malware family: DownloadGuide.D application. Threat score 100/100. 15/28 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]