26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T42c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample 3baac51400e7… — Score 80/100 — Hybrid Analysis","description":"Suspicious verdict for sample 3baac51400e7…. Threat score 80/100. 0/26 AV engines flagged this file. 1 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3baac51400e72c067c0533dd37d751d33b51c937ba441dcb57b51b3bfefa4e6d","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","3baac51400e72c067c0533dd37d751d33b51c937ba441dcb57b51b3bfefa4e6d"],"about":{"@type":"SoftwareApplication","name":"MPBE_Demo_1_0_2.exe","applicationCategory":["peexe","executable"],"identifier":"3baac51400e72c067c0533dd37d751d33b51c937ba441dcb57b51b3bfefa4e6d","additionalType":"Suspicious sample"},"threatScore":80,"antivirusDetections":{"malicious":0,"total":26},"behavioralIndicators":{"malicious":1,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T15f7,Found API call GetVersionExA@KERNEL32.DLL (Target: "Setup.Exe"; Stream UID: "00025530-00002948-36344-47-00404CF2") which is directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "setne al". See related instructions: "... +0 push ebp +1 mov ebp, esp +3 sub esp, 00000098h +9 mov eax, dword ptr [00418718h] +14 mov dword ptr [ebp-04h], eax +17 lea eax, dword ptr [ebp-00000098h] +23 push eax +24 mov dword ptr [ebp-00000098h], 00000094h +34 call dword ptr [00401120h] ;GetVersionExA +40 mov ecx, dword ptr [ebp-04h] +43 xor eax, eax +45 cmp dword ptr [ebp-00000088h], 02h +52 setne al" ... at 00025530-00002948-36344-47-00404CF2 Found API call GetVersionExA@KERNEL32.DLL (Target: "Setup.Exe"; Stream UID: "00025530-00002948-36344-1-0040B7AF") which is directly followed by "cmp ecx, 02h" and "je 0040B80Fh". See related instructions: "... +19 call 0040C440h +24 mov dword ptr [ebp-18h], esp +27 mov esi, esp +29 mov dword ptr [esi], edi +31 push esi +32 call dword ptr [00401120h] ;GetVersionExA +38 mov ecx, dword ptr [esi+10h] +41 mov dword ptr [0041973Ch], ecx +47 mov eax, dword ptr [esi+04h] +50 mov dword ptr [00419748h], eax +55 mov edx, dword ptr [esi+08h] +58 mov dword ptr [0041974Ch], edx +64 mov esi, dword ptr [esi+0Ch] +67 and esi, 00007FFFh +73 mov dword ptr [00419740h], esi +79 cmp ecx, 02h +82 je 0040B80Fh" ... at 00025530-00002948-36344-1-0040B7AF Found API call GetVersionExA@KERNEL32.DLL (Target: "Setup.Exe"; Stream UID: "00025530-00002948-36344-146-00404D30") which is directly followed by "cmp dword ptr [ebp-10h], 02h" and "jne 00404D92h". See related instructions: "... +0 push ebp +1 lea ebp, dword ptr [esp-78h] +5 sub esp, 0000009Ch +11 mov eax, dword ptr [00418718h] +16 push esi +17 push edi +18 push 00000025h +20 mov dword ptr [ebp+74h], eax +23 pop ecx +24 xor eax, eax +26 lea edi, dword ptr [ebp-20h] +29 rep stosd +31 lea eax, dword ptr [ebp-20h] +34 xor esi, esi +36 push eax +37 inc esi +38 mov dword ptr [ebp-20h], 00000094h +45 call dword ptr [00401120h] ;GetVersionExA +51 cmp dword ptr [ebp-10h], 02h +55 jne 00404D92h" ... at 00025530-00002948-36344-146-00404D30 Found API call GetVersionExA@KERNEL32.DLL (Target: "Setup.Exe"; Stream UID: "00025530-00002948-36344-358-004048B5") which is directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "jne 004048F4h". See related instructions: "... +0 push ebp +1 mov ebp, esp +3 sub esp, 00000098h +9 mov eax, dword ptr [00418718h] +14 mov dword ptr [ebp-04h], eax +17 lea eax, dword ptr [ebp-00000098h] +23 push eax +24 mov dword ptr [ebp-00000098h], 00000094h +34 call dword ptr [00401120h] ;GetVersionExA +40 cmp dword ptr [ebp-00000088h], 02h +47 jne 004048F4h" ... at 00025530-00002948-36344-358-004048B5 Found API call GetVersionExA@KERNEL32.DLL (Target: "Setup.Exe"; Stream UID: "00025530-00002948-36344-728-004165E5") which is directly followed by "cmp dword ptr [ebp-10h], 02h" and "jne 00416647h". See related instructions: "... +59 call 00413BC0h +64 add esp, 0Ch +67 lea eax, dword ptr [ebp-20h] +70 push eax +71 mov dword ptr [ebp-20h], 00000094h +78 call dword ptr [00401120h] ;GetVersionExA +84 cmp dword ptr [ebp-10h], 02h +88 jne 00416647h" ... at 00025530-00002948-36344-728-004165E5 Found API call GetVersionExA@KERNEL32.DLL (Target: "Setup.Exe"; Stream UID: "00025530-00002948-36344-135-00405794") which is directly followed by "cmp dword ptr [ebp+0000019Ch], 05h" and "ja 0040589Dh". See related instructions: "... +0 push ebp +1 lea ebp, dword ptr [esp-00000230h] +8 sub esp, 000002B0h +14 mov eax, dword ptr [00418718h] +19 push esi +20 mov dword ptr [ebp+0000022Ch], eax +26 push edi +27 lea eax, dword ptr [ebp+00000198h] +33 push eax +34 mov dword ptr [ebp+00000198h], 00000094h +44 call dword ptr [00401120h] ;GetVersionExA +50 cmp dword ptr [ebp+0000019Ch], 05h +57 ja 0040589Dh" ... at 00025530-00002948-36344-135-00405794 Found API call GetVersionExA@KERNEL32.dll (Target: "Setup.Exe.3635973906"; Stream UID: "16962-445-004048B5") which is directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "jne 004048F4h". See related instructions: "... +0 push ebp +1 mov ebp, esp +3 sub esp, 00000098h +9 mov eax, dword ptr [00418718h] +14 mov dword ptr [ebp-04h], eax +17 lea eax, dword ptr [ebp-00000098h] +23 push eax +24 mov dword ptr [ebp-00000098h], 00000094h +34 call dword ptr [00401120h] ;GetVersionExA +40 cmp dword ptr [ebp-00000088h], 02h +47 jne 004048F4h" ... at 16962-445-004048B5 Found API call GetVersionExA@KERNEL32.dll (Target: "Setup.Exe.3635973906"; Stream UID: "16962-1-0040B7AF") which is directly followed by "cmp ecx, 02h" and "je 0040B80Fh". See related instructions: "... +19 call 0040C440h +24 mov dword ptr [ebp-18h], esp +27 mov esi, esp +29 mov dword ptr [esi], edi +31 push esi +32 call dword ptr [00401120h] ;GetVersionExA +38 mov ecx, dword ptr [esi+10h] +41 mov dword ptr [0041973Ch], ecx +47 mov eax, dword ptr [esi+04h] +50 mov dword ptr [00419748h], eax +55 mov edx, dword ptr [esi+08h] +58 mov dword ptr [0041974Ch], edx +64 mov esi, dword ptr [esi+0Ch] +67 and esi, 00007FFFh +73 mov dword ptr [00419740h], esi +79 cmp ecx, 02h +82 je 0040B80Fh" ... at 16962-1-0040B7AF Found API call GetVersionExA@KERNEL32.dll (Target: "Setup.Exe.3635973906"; Stream UID: "16962-817-004165E5") which is directly followed by "cmp dword ptr [ebp-10h], 02h" and "jne 00416647h". See related instructions: "... +59 call 00413BC0h +64 add esp, 0Ch +67 lea eax, dword ptr [ebp-20h] +70 push eax +71 mov dword ptr [ebp-20h], 00000094h +78 call dword ptr [00401120h] ;GetVersionExA +84 cmp dword ptr [ebp-10h], 02h +88 jne 00416647h" ... at 16962-817-004165E528:T591,"\Sessions\1\BaseNamedObjects\Local\!IETld!Mutex" "\Sessions\1\BaseNamedObjects\Local\c:!users!8zh8xtz!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "\Sessions\1\BaseNamedObjects\Local\c:!users!8zh8xtz!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\c:!users!8zh8xtz!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\c:!users!8zh8xtz!appdata!roaming!microsoft!windows!ietldcache!" "\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "Local\c:!users!8zh8xtz!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "Local\!IETld!Mutex" "VSIMSILOADER_{EF37F6D9-69DA-11d2-86C5-00A0C9A8B90C}" "Local\c:!users!8zh8xtz!appdata!roaming!microsoft!windows!cookies!" "Local\c:!users!8zh8xtz!appdata!roaming!microsoft!windows!ietldcache!" "Local\_!MSFTHISTORY!_" "Local\c:!users!8zh8xtz!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\VSIMSILOADER_{EF37F6D9-69DA-11d2-86C5-00A0C9A8B90C}" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex"29:T418,"MPBEDemoSetup.msi" has type "Composite Document File V2 Document Little Endian O%WINDIR%\Version 5.2 MSI Installer Create Time/Date: Mon Jun 21 08:00:00 1999 Name of Creating Applicatio%WINDIR%\Installer Security: 1 Code page: 1252 Template: Intel;1033 Number of Pages: 200 Revision Number: {01024074-9286-4CEF-B39A-588A61137E0F} Title: MaxPoker Beginner Edition Demo Author: Poker Architects LLC Comments: MaxPoker Beginner Edition Demo Number of Words: 2 Last Saved Time/Date: Mon Jul 11 07:54:41 2005 Last Printed: Mon Jul 11 07:54:41 2005" "Setup.Exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "Setup.Ini" has type "ASCII text with CRLF line terminators" "frameiconcache.dat" has type "data" "CFGEE9A.tmp" has type "XML 1.0 document ASCII text with CRLF line terminators" "{79E47FD4-76FD-11E7-9C42-0A002745DB77}.dat" has type "Composite Document File V2 Document Cannot read section info" "RecoveryStore.{79E47FD3-76FD-11E7-9C42-0A002745DB77}.dat" has type "Composite Document File V2 Document Cannot read section info"2a:T1077,Heuristic match: "o(b'.Kp" Heuristic match: "Visual Studio .NET" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=9832[VSDNETURLMSG]VSDFXAvailableMSVBDPCADLLCheckFXDIRCA_CheckFX1.1.4322VSDSupportedRuntimesVSDNETCFGVsdLaunchConditionsVSDCA_VsdLaunchConditionsNOT" Pattern match: "http://%s:%d/%shttp://%s/%sTASKRead" Pattern match: "http://RESULTURL" Heuristic match: "PLYuEu]u]u]MEPju]+;}PYEPREf8.Yt" Pattern match: "http://www.PokerArchitects.com" Pattern match: "www.PokerArchitects.com}}}{\f37\fs20\insrsid858859" Pattern match: "p.bq/ll;';5;5na*k" Pattern match: "y.XeeE/|Kyy-*Fj&7y5JR`gj%_+" Heuristic match: "Z% `[`PqnSJ7U&>o}IU!-NDB)6t&Q!QpNd=h-|h/SMqte[^<7Wo].ru" Pattern match: "wB.Ov/PuI7@:dinr-levB" Pattern match: "x.ce/40\e%" Pattern match: "4M2.eDD/9y3c:zFhCp[}cEB5+jvk|@7.ck" Pattern match: "V.lY/{e]K" Pattern match: "G8Gu.OX/Z-yD}}b^Lm1EG" Heuristic match: "2R.k&YFLE$vTp[AO4k8`\Hts08Tx5SM%#HMECAykGm%%zf+,MbvXv2DgG)685!C;sLf-Y:\G&M/Z>>9i4>?sL$UEnI7:|'T>S~bDRL[!wf{EWv`K+Ev-[6_BBQ_+5'{l1~xiRi.ne" Heuristic match: "pcKF$;|-2dbD,oOxA)G^VI}M'\BCMA$d4T'6u3 JKeXs06tEz>W)*;292H.CK" Pattern match: "Ziv.XSt/:,.r=" Pattern match: "HnRO5.vtT/r$vPX" Pattern match: "EW.rnK/by8C" Pattern match: "Alg.kOe/w3&Z']/{J5p#\Y'7o-+-z7-W!oFgJx2m7/" Pattern match: "lOh.SpJ/N\" Pattern match: "o.VK/?u:vmUX" Heuristic match: "}}@el+glyO]qW4Uf_t$k~cuLy~]q-{M,ObkOv]pK;z44c^OxnQl6x{3ok8rH}s/J+F6lEZ{Q#*OXIcXSML8u&.mg" Heuristic match: "&j!umz.mg" Pattern match: "F.jle/'W" Pattern match: "sX2-.zH/&4ug`_pFm6" Pattern match: "M.rp/_Gj*w/f_k\:kw9!d%F*4NJg{tu]47EWw#k4_" Heuristic match: "~*,fUwnRD7:q}@k/aGLp+F7#iRY;M0)u7^-.xN" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=9832" Heuristic match: "8^Q55'+ FIj'+VT88?|Q=H^HLc*AzJQ~5RlCb]wW0;TT2:MZJzr>-U5luR1\0i.-bCqgO?WCWG%Wd\O^2v+VV,f];'AyyER%t:pazM!N.cV" Pattern match: "KAjX.Wd/ZfGx0q}gqqZ~ST7" Heuristic match: "Vy%Vh(gm\QLIO3aezta~O&-s1l'w.og9=eHO~g]3jS6<,N:{/?wOq_O@S?pT(+UD4l?H`Lrr:A#0~Nj(.|yw7_`(*MpNi/=xCB9g34*|]&q\%:.Rt):B(@Y#(a_$b/TsTp]85k$>@PQi0\5c,^bb(yqGgLj%L$f]Sn gu<;=CA&v/_}e}[X[_CP:v%!, 7}_'&rY.mA" Pattern match: "OTg.VqM/Vk]@Xb.Gs;qhM77" Pattern match: "52V.iIU/WX4=_" Pattern match: "y.Xhg/w`.7zV" Pattern match: "klg.GD/:pL}YgzG^I4q`5[X~:?6HRvnn11$YLRXU" Pattern match: "0AOxC.XynG/[no|x3~;N[yG_vwW/" Pattern match: "o.vx/yER?vm/" Pattern match: "68.Ih/+YR;5`jaIQr#gr" Pattern match: "oxZ.TOuF/!a=9YsmE1^vC1OP#q17Mf3NUG9+.,/SxS\" Pattern match: "h.lRwl/~?+tp" Pattern match: "n.eri/=ZA" Heuristic match: ".>lB[%xFKXj-njiEWF:(c'8u:V!S6+xwycrjZQ'14n%=iiCo_jbBMd[/7x~&H'oA_R~[\7&2`g*Gf1FN/=F.VE" Pattern match: "s.fZ/y]aruB?^{SGH" Heuristic match: "[b#Z$N_3:]$|aNi[}S;v)tc-^kllrLv+hW33(C.8~[Rb?prlxfV,pJ>z6+QEIXfRKkU[z$m!iV96QXX*~BowoCJZ_g~{aJ>+qZyCON.th" Pattern match: "z6e6okUn.Jqgs/h{cZZ=\_9ZNpW$q||-dT" Heuristic match: "qw!psjo3/Lr(b5sC17fX{djf>#G8a Mcz)3A>inP~2O6vm.an" Pattern match: "b.an/OYOiQ32|" Pattern match: "X.gy/MKP}]Cz" Pattern match: "xbO.as/5&wk_BC4G#z?GD`36c.uWk3" Pattern match: "l.Yo/Oj='G" Pattern match: "QxGk.oO/w^g6$GSbfm1" Heuristic match: "4T!%;>pG=-2^oE6pJ;ZGgPp.GTrZW'dp'J(+mXO3K9>kU_=~EhDT &kIyC.uG" Heuristic match: "k_)x\MU/o\&=(TUB=<]\IReX76SR#R|sPWG2iP(9:mW3|X#Y-YuU{jgw!p{n#]<*.tF" Pattern match: "HExY.gPd/WMuWL-xes/JlVQ" Heuristic match: "|G#ZG^%W*}y&lJw_SCO|f-Q{'P>+|#x@y*{p =GbC8JhR$,Y0[5nAp36=nGuYc<'xn1%S+4D7y6\.TC"2b:T97b,"iexplore.exe" wrote bytes "e9e9f0f5f7" to virtual address "0x779CE9ED" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "6992816a" to virtual address "0x76D7D940" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "e9fc79c4fa" to virtual address "0x74CE7922" (part of module "COMCTL32.DLL") "iexplore.exe" wrote bytes "e937f2f5f7" to virtual address "0x779CE963" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "7739bc7779a8c077be72c077d62dc0771de2bb7705a2c077c868bf7757d1c677bee3bb77616fc0776841be770050be7700000000ad37a6768b2da676b641a67600000000" to virtual address "0x75751000" (part of module "WSHIP6.DLL") "iexplore.exe" wrote bytes "8b69806a" to virtual address "0x76D7D984" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "8491816a" to virtual address "0x76D7D948" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "92e6bb7779a8c077be72c077d62dc0771de2bb7705a2c077bee3bb77616fc0776841be770050be7700000000ad37a6768b2da676b641a67600000000" to virtual address "0x75201000" (part of module "WSHTCPIP.DLL") "iexplore.exe" wrote bytes "0c93816a" to virtual address "0x76DCDFCC" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "6992816a" to virtual address "0x76D7DEE4" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "8491816a" to virtual address "0x76DCDFC8" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "8491816a" to virtual address "0x76D7DEEC" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "e9395484f9" to virtual address "0x760E93FC" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "6992816a" to virtual address "0x76DCDFC0" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "e9efb9cefa" to virtual address "0x74C4388E" (part of module "COMCTL32.DLL") "iexplore.exe" wrote bytes "e99cf3f5f7" to virtual address "0x779CE869" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "d268806a" to virtual address "0x76D7D95C" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "1968806a" to virtual address "0x76D7D990" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "e9c20af7f7" to virtual address "0x779BD274" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "c4ca5e7680bb5e76aa6e5f769fbb5e7608bb5e7646ce5e7661385f76de2f5f76d0d95e760000000017796b764f916b767f6f6b76f4f76b7611f76b76f2836b76857e6b7600000000" to virtual address "0x73DE1000" (part of module "MSIMG32.DLL")2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAGiIiIiIiIiIiIiIiIAAAABv//////////////+AAAAAb///////////////gAAAAG///////////////4AAAABv//////////////+AAAAAb///////////////gAAAAG///////////////4AAAABv//////8Hh4dw//+AAAAAb///////CHh3AP//gAAAAG////////8AcP///4AAAABv//////AAAAAP//+AAAAAb///AAAHiIiIgP//gAAAAG//93d3d3d3d4D//4AAAABv//f7i4uLcPeA//+AAAAAb//3+Li4uHD3gP//gAAAAG//9/uLi49w94D//4AAAABv//f4uLi4cPeA//+AAAAAb//3+4uLi3D3gP//gAAAAG//9/////9w94D//4AAAABv//eLi4d3cPCA//+AAAAAb///eLhwAAAAgP//gAAAAG////d394iIiA///4AAAABv//////93d3f///+AAAAAb///////////////gAAAAG////////////YAAAAAAABv///////////2/4cAAAAAb///////////9vhwAAAAAG////////////aHAAAAAABv///////////2YAAAAAAAb///////////9gAAAAAAAGZmZmZmZmZmZmYAAAAADgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAA/gAAAf4AAAP+AAAH/gAAD/4AAB/w==2d:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAIiwAAAAAAAAAAAAAAAAAAiIu7M7sAAAAAAAAAAAAAD4iLM7uzMwAAAAAAAAAAAA+IszcAC7uzBmYAAAAAAAAPiLMwAAAHd2ZmZmYAAAAAD4izMAAEZmZu7mZmRAAAAA+IszAERGbu6IjuZmRAAAAIiLOwQEZu7oiI7uZmQEAACIizswRmbu6IiO7mZmQAAAiLu7NGZm7u5mZu5mZmAAAIi7uzRmZm5kAARuZmZkAAAIu7u3ZmbmAAAABuZmZgBgCLu7u2Zm5gAAAARmZEQAcACLuLt2ZmQAAAAAQAAAAHAAC7e7tmZkZmZmZmZEQACAAAi3i7dkZmZmZmZmZmZAcAAAM3i7dEZmZmZmZmZmQAAAAAN4u7ZEZmZmZmZmZkAAAAAAd4u3YARERmZmZmZAAAAAAEeIu3QAAAAGZmZmQEAAAAAGeIuzcAAAZmZmZkAAAAAABmeIu3ePiGZmZmYEAAAAAARmeIu2ZmZmZmZkQAAAAAAAZ2eIu3d3d3d3YAAAAAAAAAd3eIu4iId3dkYANwAAAAAAeIiIu4iIiGBgALMAAAAAAAR4j4u4iHQEAACzAAAAAAAABHeIe7cEAAAAAwAAAAAAAAAAAAi7MwAAADMAAAAAAAAAAAAAi7uzNzMzAAAAAAAAAAAAAACLu7O7MAAAAAAAAAAAAAAAAAAAAADH////gB///wAH//8BwR//A/AB/wPAAH8DAAAfAgAADwAAAAcAAAAHAAAAA4AA8AGAAfgBwAP8AeAAAAHgAAAB8AAAAfAAAAHwAAAB8AP4AfAB8AP4AAAD+AAAB/wAAA/+AAAM/wAAHP+AADz/4AD+//gA/P//8AD///wB/////w==2f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAIiwAAAAAAAAAAAAAAAAAAiIu7M7sAAAAAAAAAAAAAD4iLM7uzMwAAAAAAAAAAAA+IszcAC7uzBmYAAAAAAAAPiLMwAAAHd2ZmZmYAAAAAD4izMAAEZmZu7mZmRAAAAA+IszAERGbu6IjuZmRAAAAIiLOwQEZu7oiI7uZmQEAACIizswRmbu6IiO7mZmQAAAiLu7NGZm7u5mZu5mZmAAAIi7uzRmZm5kAARuZmZkAAAIu7u3ZmbmAAAABuZmZgBgCLu7u2Zm5gAAAARmZEQAcACLuLt2ZmQAAAAAQAAAAHAAC7e7tmZkZmZmZmZEQACAAAi3i7dkZmZmZmZmZmZAcAAAM3i7dEZmZmZmZmZmQAAAAAN4u7ZEZmZmZmZmZkAAAAAAd4u3YARERmZmZmZAAAAAAEeIu3QAAAAGZmZmQEAAAAAGeIuzcAAAZmZmZkAAAAAABmeIu3ePiGZmZmYEAAAAAARmeIu2ZmZmZmZkQAAAAAAAZ2eIu3d3d3d3YAAAAAAAAAd3eIu4iId3dkYANwAAAAAAeIiIu4iIiGBgALMAAAAAAAR4j4u4iHQEAACzAAAAAAAABHeIe7cEAAAAAwAAAAAAAAAAAAi7MwAAADMAAAAAAAAAAAAAi7uzNzMzAAAAAAAAAAAAAACLu7O7MAAAAAAAAAAAAAAAAAAAAADH////gB///wAH//8BwR//A/AB/wPAAH8DAAAfAgAADwAAAAcAAAAHAAAAA4AA8AGAAfgBwAP8AeAAAAHgAAAB8AAAAfAAAAHwAAAB8AP4AfAB8AP4AAAD+AAAB/wAAA/+AAAM/wAAHP+AADz/4AD+//gA/P//8AD///wB/////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"3baac51400e72c067c0533dd37d751d33b51c937ba441dcb57b51b3bfefa4e6d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":80,"unified_at_epoch_ms":1790271129074,"unified_at":"2026-09-24T17:32:09.074Z","metadata":{"hashes":{"sha256":"3baac51400e72c067c0533dd37d751d33b51c937ba441dcb57b51b3bfefa4e6d","sha1":"332886cb1ef1318d79424a6a997d187cfb332f8b","md5":"6603ef81d8d9d2f3270441b4aefd8348","sha512":"061668e96de51b0a47712b32e12064db6186a1e4e02afc1150a010cb4d5edb743566884b107ce267265a69b5210f0b0f1206cf27815972dc95be0cc46d8d81a3","ssdeep":"196608:dXdPNJSFUKjEC5iTxjpEPr+kXT/sozGcxAWeBVoR5oh:dXdP5UDi1SPrmoKcaFIR5U","ssdeep_chunks":["196608:dXdPNJS","196608:XdPNJSF","196608:dPNJSFU","196608:PNJSFUK","196608:NJSFUKj","196608:JSFUKjE","196608:SFUKjEC","196608:FUKjEC5","196608:UKjEC5i","196608:KjEC5iT","196608:jEC5iTx","196608:EC5iTxj","196608:C5iTxjp","196608:5iTxjpE","196608:iTxjpEP","196608:TxjpEPr","196608:xjpEPr+","196608:jpEPr+k","196608:pEPr+kX","196608:EPr+kXT","196608:Pr+kXT/","196608:r+kXT/s","196608:+kXT/so","196608:kXT/soz","196608:XT/sozG","196608:T/sozGc","196608:/sozGcx","196608:sozGcxA","196608:ozGcxAW","196608:zGcxAWe","196608:GcxAWeB","196608:cxAWeBV","196608:xAWeBVo","196608:AWeBVoR","196608:WeBVoR5","196608:eBVoR5o","196608:BVoR5oh","393216:dXdPNJS","393216:XdPNJSF","393216:dPNJSFU","393216:PNJSFUK","393216:NJSFUKj","393216:JSFUKjE","393216:SFUKjEC","393216:FUKjEC5","393216:UKjEC5i","393216:KjEC5iT","393216:jEC5iTx","393216:EC5iTxj","393216:C5iTxjp","393216:5iTxjpE","393216:iTxjpEP","393216:TxjpEPr","393216:xjpEPr+","393216:jpEPr+k","393216:pEPr+kX","393216:EPr+kXT","393216:Pr+kXT/","393216:r+kXT/s","393216:+kXT/so","393216:kXT/soz","393216:XT/sozG","393216:T/sozGc","393216:/sozGcx","393216:sozGcxA","393216:ozGcxAW","393216:zGcxAWe","393216:GcxAWeB","393216:cxAWeBV","393216:xAWeBVo","393216:AWeBVoR","393216:WeBVoR5","393216:eBVoR5o","393216:BVoR5oh","196608:dXdP5UD","196608:XdP5UDi","196608:dP5UDi1","196608:P5UDi1S","196608:5UDi1SP","196608:UDi1SPr","196608:Di1SPrm","196608:i1SPrmo","196608:1SPrmoK","196608:SPrmoKc","196608:PrmoKca","196608:rmoKcaF","196608:moKcaFI","196608:oKcaFIR","196608:KcaFIR5","196608:caFIR5U"],"imphash":"4c59c0b3420ca0877a0e6c8146bdb593"},"file_info":{"file_name":"MPBE_Demo_1_0_2.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":8821760,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1501593225000,"last_seen":1662732428000,"last_multi_scan":1662732428000}},"detections":{"summary":{"verdict":"suspicious","score":80,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":20,"suspicious_count":17,"malicious_count":1,"total":38},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00025530-00002948-36344-495-0040E2B0\n GetSystemTimeAsFileTime@KERNEL32.dll at 16962-583-0040E2B0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00013956-00002896-30027-2-00403366\n GetVersionExA@KERNEL32.DLL at 00025530-00002948-36344-47-00404CF2\n GetVersionExA@KERNEL32.DLL at 00025530-00002948-36344-1-0040B7AF\n GetVersionExA@KERNEL32.DLL at 00025530-00002948-36344-146-00404D30\n GetVersion@KERNEL32.DLL at 00025530-00002948-36344-437-0040A49B\n GetVersionExA@KERNEL32.DLL at 00025530-00002948-36344-358-004048B5\n GetVersionExA@KERNEL32.DLL at 00025530-00002948-36344-728-004165E5\n GetVersionExA@KERNEL32.DLL at 00025530-00002948-36344-135-00405794\n GetVersionExA@KERNEL32.dll at 16962-445-004048B5\n GetVersionExA@KERNEL32.dll at 16962-1-0040B7AF\n GetVersionExA@KERNEL32.dll at 16962-817-004165E5\n GetVersion@KERNEL32.dll at 16962-524-0040A49B","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetUserDefaultLCID@KERNEL32.DLL at 00025530-00002948-36344-717-0040A19E\n GetUserDefaultLCID@KERNEL32.dll at 16962-806-0040A19E","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$27","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"Setup.Exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"Setup.Exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"Setup.Exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"PATH\"; Value: \"00000000010000004800000043003A005C00500072006F006700720061006D002000460069006C00650073005C0049006E007400650072006E006500740020004500780070006C006F007200650072003B000000\")\n \"iexplore.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/64 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"msiloadr.pdb\"\n \"O`WBGiaI1.,O2.,OzM=!ZVZVZVZVZVZVZVZVUUUUUUTTUUUUU*O&%%%@??UUUUPUUUUUUUUUUJJVVVVddpp~~TUT(*!Q\"O&%%% @??>9/6VPO*JJVVVVddpp~~H\\VPzZVCRSDSZL>DBDPCA.pdb\\VyZVyZV\\VyZV\\VzZV zZV\\V(zZVLTn o:otoooUpppppp*q\" created file \"%TEMP%\\WZSE0.TMP\\Setup.Exe\"\n \"\" created file \"%TEMP%\\WZSE0.TMP\\Setup.Ini\"\n \"\" created file \"%TEMP%\\WZSE0.TMP\\MPBEDemoSetup.msi\"\n \"Setup.Exe\" created file \"%TEMP%\\CFGEE9A.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$28","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"Setup.Exe\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00026287-00003200)\n Launches browser \"iexplore.exe\" (UID: 00026322-00003172)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"Setup.Exe\" (UID: 00025530-00002948) was launched with new environment variables: \"__COMPAT_LAYER=\"ElevateCreateProcess VistaSetup\"\"\n Process \"iexplore.exe\" (UID: 00026287-00003200) was launched with new environment variables: \"__PROCESS_HISTORY=\"%TEMP%\\WZSE0.TMP\\Setup.Exe\", PATH=\"C:\\Program Files\\Internet Explorer;\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Setup.Exe\" searching for class \"DDEMLMom\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Setup.Exe\" (UID: 00025530-00002948)\n Spawned process \"iexplore.exe\" with commandline \"-nohome\" (UID: 00026287-00003200)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3200 CREDAT:79873\" (UID: 00026322-00003172)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"Setup.Exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$29","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\AppPatch\\AcLayers.DLL\"\n \"\" touched file \"%WINDIR%\\AppPatch\\AcGenral.DLL\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui\"\n \"\" touched file \"%WINDIR%\\Fonts\\staticcache.dat\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui\"\n \"\" touched file \"%WINDIR%\\SYSTEM32\\en-US\\ntdll.dll.mui\"\n \"Setup.Exe\" touched file \"%WINDIR%\\AppPatch\\AcGenral.DLL\"\n \"Setup.Exe\" touched file \"%WINDIR%\\AppPatch\\AcLayers.DLL\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2a","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"Setup.Exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"3baac51400e72c067c0533dd37d751d33b51c937ba441dcb57b51b3bfefa4e6d.exe.bin\" was detected as \"Symantec visual Cafe v3.0\"\n \"Setup.Exe\" was detected as \"Microsoft visual C++ 7.0\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"_winzip_ with unusual entropies 7.99741652685","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LoadResource@KERNEL32.DLL at 00025530-00002948-36344-384-00408F91\n FindResourceA@KERNEL32.DLL at 00025530-00002948-36344-418-00409504\n FindResourceA@KERNEL32.DLL at 00025530-00002948-36344-782-0040B50C\n LoadResource@KERNEL32.dll at 16962-471-00408F91\n FindResourceA@KERNEL32.dll at 16962-505-00409504\n FindResourceA@KERNEL32.dll at 16962-889-0040B50C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"Setup.Exe\" read file \"%TEMP%\\WZSE0.TMP\\Setup.Ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"Setup.Exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains a remote desktop related string","description":"\"v%(WTCu'ZV}.}asa%=xK,\\yD$h{Y`r8a8!`i&T8j33^qvncd@w\" (Indicator for product: Generic VNC)","origin":"File/Memory","relevance":10,"id":"string-27","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"\"4b7rEQ9EPd-#X7s+-vs42q`Cmd=)\" (Indicator: \"cmd=\")","origin":"File/Memory","relevance":10,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"Setup.Exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"Setup.Exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"Setup.Exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\3baac51400e72c067c0533dd37d751d33b51c937ba441dcb57b51b3bfefa4e6d.exe\" marked \"%TEMP%\\WZSE0.TMP\\MPBEDE~1.MSI\" for deletion\n \"C:\\3baac51400e72c067c0533dd37d751d33b51c937ba441dcb57b51b3bfefa4e6d.exe\" marked \"%TEMP%\\WZSE0.TMP\\Setup.Exe\" for deletion\n \"C:\\3baac51400e72c067c0533dd37d751d33b51c937ba441dcb57b51b3bfefa4e6d.exe\" marked \"%TEMP%\\WZSE0.TMP\\Setup.Ini\" for deletion\n \"C:\\3baac51400e72c067c0533dd37d751d33b51c937ba441dcb57b51b3bfefa4e6d.exe\" marked \"%TEMP%\\WZSE0.TMP\" for deletion\n \"%TEMP%\\WZSE0.TMP\\Setup.Exe\" marked \"%TEMP%\\CFGEE9A.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\WZSE0.TMP\\MPBEDE~1.MSI\" with delete access\n \"\" opened \"%TEMP%\\WZSE0.TMP\\Setup.Exe\" with delete access\n \"\" opened \"%TEMP%\\WZSE0.TMP\\Setup.Ini\" with delete access\n \"\" opened \"%TEMP%\\WZSE0.TMP\" with delete access\n \"Setup.Exe\" opened \"%TEMP%\\CFGEE9A.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"iexplore.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"Setup.Exe\" claimed CRC 113286 while the actual is CRC 8874837","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetDriveTypeA\n GetModuleFileNameA\n LoadLibraryA\n WinExec\n GetFileSize\n CreateDirectoryA\n DeleteFileA\n GetCommandLineA\n GetProcAddress\n MapViewOfFile\n GetModuleHandleA\n FindFirstFileA\n CreateFileMappingA\n FindNextFileA\n CreateProcessA\n CreateFileA\n GetTickCount\n GetLastActivePopup\n RegDeleteKeyA\n RegOpenKeyA\n RegCloseKey\n RegDeleteValueA\n RegCreateKeyExA\n RegOpenKeyExA\n RegEnumKeyExA\n GetTempPathA\n GetTempPathW\n GetModuleFileNameW\n LoadLibraryExA\n UnhandledExceptionFilter\n LoadLibraryExW\n TerminateProcess\n VirtualProtect\n GetVersionExA\n GetStartupInfoA\n DeleteFileW\n GetTempFileNameW\n WriteFile\n GetTempFileNameA\n CreateFileW\n FindResourceW\n Sleep\n FindResourceA\n VirtualAlloc\n ShellExecuteA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2b","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"Setup.Exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"iexplore.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 1500 bytes to a remote process \"%TEMP%\\WZSE0.TMP\\Setup.Exe\" (Handle: 304)\n \"\" wrote 4 bytes to a remote process \"%TEMP%\\WZSE0.TMP\\Setup.Exe\" (Handle: 304)\n \"\" wrote 32 bytes to a remote process \"%TEMP%\\WZSE0.TMP\\Setup.Exe\" (Handle: 304)\n \"\" wrote 52 bytes to a remote process \"%TEMP%\\WZSE0.TMP\\Setup.Exe\" (Handle: 304)\n \"Setup.Exe\" wrote 1500 bytes to a remote process \"C:\\Program Files\\Internet Explorer\\iexplore.exe\" (Handle: 680)\n \"Setup.Exe\" wrote 4 bytes to a remote process \"C:\\Program Files\\Internet Explorer\\iexplore.exe\" (Handle: 680)\n \"Setup.Exe\" wrote 32 bytes to a remote process \"C:\\Program Files\\Internet Explorer\\iexplore.exe\" (Handle: 680)\n \"Setup.Exe\" wrote 52 bytes to a remote process \"C:\\Program Files\\Internet Explorer\\iexplore.exe\" (Handle: 680)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Contains a remote desktop related string"},{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Accesses potentially sensitive information from local browsers"}],"sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows installation date"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":24,"imported_dlls_count":96,"dropped_files_count":0,"extracted_files_count":7,"files_written_count":68,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"59807c307ca3e14ae730af93","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"suspicious","threat_score":80,"submit_name":"MPBE_Demo_1_0_2.exe","analysis_start_time":"2017-08-01T14:04:18+00:00","indicators_count":{"informative":20,"suspicious":27,"malicious":1},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}],"processes":[{"pid":2896,"ppid":0,"name":"3baac51400e72c067c0533dd37d751d33b51c937ba441dcb57b51b3bfefa4e6d.exe","command_line":"","sha256":"3baac51400e72c067c0533dd37d751d33b51c937ba441dcb57b51b3bfefa4e6d","normalized_path":"C:\\3baac51400e72c067c0533dd37d751d33b51c937ba441dcb57b51b3bfefa4e6d.exe","uid":"00013956-00002896","icon":"$2c"},{"pid":2948,"ppid":2896,"name":"Setup.Exe","command_line":"","sha256":"0be608d3f0aed6441b40082b80cca6a4cc84eaf635fc72b189cc54cffb70f9b0","normalized_path":"%TEMP%\\WZSE0.TMP\\Setup.Exe","parent_uid":"00013956-00002896","uid":"00025530-00002948","icon":"$2d"},{"pid":3200,"ppid":2948,"name":"iexplore.exe","command_line":"-nohome","sha256":"e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00025530-00002948","uid":"00026287-00003200","icon":"$2e"},{"pid":3172,"ppid":3200,"name":"iexplore.exe","command_line":"SCODEF:3200 CREDAT:79873","sha256":"e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00026287-00003200","uid":"00026322-00003172","icon":"$2f"}],"all_imported_dlls":["RpcRtRemote.dll","userenv.dll","profapi.dll","wininet.dll","mscoree.dll","comctl32.dll","sqmapi.dll","rasapi32.dll","rtutils.dll","cfgmgr32.dll","msctf.dll","winnsi.dll","sfc.dll","ntdll.dll","lpk.dll","mswsock.dll","msimg32.dll","mlang.dll","url.dll","imm32.dll","mscoreei.dll","nlaapi.dll","IEShims.dll","sspicli.dll","oleaut32.dll","propsys.dll","rasadhlp.dll","pnrpnsp.dll","dhcpcsvc.dll","duser.dll","msvcrt.dll","msasn1.dll","oleacc.dll","ws2_32.dll","SensApi.dll","FWPUCLNT.DLL","ieproxy.dll","dhcpcsvc6.dll","kernel32.dll","KernelBase.dll","user32.dll","ole32.dll","IPHLPAPI.DLL","ExplorerFrame.dll","normaliz.dll","apphelp.dll","rpcrt4.dll","version.dll","cryptbase.dll","winrnr.dll","xmllite.dll","shell32.dll","sfc_os.dll","devobj.dll","msxml3.dll","rasman.dll","linkinfo.dll","AcGenral.dll","clbcatq.dll","shlwapi.dll","mpr.dll","dwmapi.dll","oleaccrc.dll","NapiNSP.dll","ieui.dll","npmproxy.dll","AcLayers.dll","msacm32.dll","Wldap32.dll","WSHTCPIP.DLL","ONBTTN~1.DLL","sechost.dll","urlmon.dll","netprofm.dll","dui70.dll","usp10.dll","winmm.dll","samcli.dll","iertutil.dll","ntmarta.dll","rsaenh.dll","setupapi.dll","crypt32.dll","ieframe.dll","psapi.dll","dnsapi.dll","comdlg32.dll","wship6.dll","ONBttnIE.dll","gdi32.dll","uxtheme.dll","advapi32.dll","rpcss.dll","msxml3r.dll","nsi.dll","cryptsp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Setup.Exe","sha256":"0be608d3f0aed6441b40082b80cca6a4cc84eaf635fc72b189cc54cffb70f9b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"RecoveryStore.{79E47FD3-76FD-11E7-9C42-0A002745DB77}.dat","sha256":"be1483c78aa7839ed59afd61ed2e7a2100ecea45dc947bd598005a7f1262847f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"{79E47FD4-76FD-11E7-9C42-0A002745DB77}.dat","sha256":"e16b69fcdaa757e9fd334551bcfa1946501a312602e1c688648b6aa0e3fbda81","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"frameiconcache.dat","sha256":"46296e409a5ace78116babc5e7a12332d9dd3c81bcd535ce931dcaa38b4f5751","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"CFGEE9A.tmp","sha256":"96e3eb961a9d765621e1062808d02ccacb5d80c78516dc3137a461e6065c2a34","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"MPBEDemoSetup.msi","sha256":"8571e65ddec805840bcba2fe6f30462c369b7a854b1386054eca6fd79410ad47","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"Setup.Ini","sha256":"2f4c1171bbb632d4d7cb679fca37a7d4acc01925fe0f989cd5ac6eb8bb56f32b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]}],"files_written":[{"path":"C:\\3baac51400e72c067c0533dd37d751d33b51c937ba441dcb57b51b3bfefa4e6d.exe","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%TEMP%\\WZSE0.TMP\\MPBEDemoSetup.msi","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%WINDIR%\\SYSTEM32\\en-US\\ntdll.dll.mui","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%WINDIR%\\System32\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%WINDIR%\\AppPatch\\AcGenral.DLL","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en-US\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"C:\\Users\\8ZH8XtZ","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%WINDIR%\\system32\\en-US\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\frameiconcache.dat","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\ONBttnIE.dll","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\ONBTTN~1.DLL","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%TEMP%\\~DF22882741917B4EFF.TMP","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{79E47FD4-76FD-11E7-9C42-0A002745DB77}.dat","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%TEMP%\\~DF475DC791A9707275.TMP","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%USERPROFILE%\\Favorites\\Links","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%WINDIR%\\system32\\en-US\\IEFRAME.dll.mui","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{79E47FD3-76FD-11E7-9C42-0A002745DB77}.dat","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Suggested Sites.url","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Suggested Sites.url:favicon","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Web Slice Gallery.url","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\4shared.com.url","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\5pk.com.url","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\7k7k.com.url","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\17kuxun.com.url","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\27.cn.url","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%WINDIR%\\system32\\url.dll","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!8zh8xtz!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!8zh8xtz!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!8zh8xtz!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!8zh8xtz!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"Local\\c:!users!8zh8xtz!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"VSIMSILOADER_{EF37F6D9-69DA-11d2-86C5-00A0C9A8B90C}","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"Local\\c:!users!8zh8xtz!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"Local\\c:!users!8zh8xtz!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"Local\\c:!users!8zh8xtz!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\VSIMSILOADER_{EF37F6D9-69DA-11d2-86C5-00A0C9A8B90C}","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ConnHashTable<3200>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59807c307ca3e14ae730af93"}]}]}},"report_ids":{"sandbox_job_ids":["59807c307ca3e14ae730af93"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Suspicious Sample 3baac51400e7… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 3baac51400e7…. Threat score 80/100. 0/26 AV engines flagged this file. 1 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3baac51400e72c067c0533dd37d751d33b51c937ba441dcb57b51b3bfefa4e6d"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample 3baac51400e7… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 3baac51400e7…. Threat score 80/100. 0/26 AV engines flagged this file. 1 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3baac51400e72c067c0533dd37d751d33b51c937ba441dcb57b51b3bfefa4e6d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample 3baac51400e7… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 3baac51400e7…. Threat score 80/100. 0/26 AV engines flagged this file. 1 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]