23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T4ae,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Agentb Sample 4231f020816e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4231f020816e…. Malware family: Trojan.Agentb. Threat score 100/100. 25/28 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4231f020816eebfa0b51e252477f2769838abeb83728072185060253372a4dd0","keywords":["Malicious","Trojan.Agentb","malware analysis","sandbox report","threat intelligence","4231f020816eebfa0b51e252477f2769838abeb83728072185060253372a4dd0"],"about":{"@type":"SoftwareApplication","name":"codexgigas_f09bb42e6c39a9714ed8a4d4191cf19e40d1919b.exe","applicationCategory":["peexe","executable"],"identifier":"4231f020816eebfa0b51e252477f2769838abeb83728072185060253372a4dd0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Agentb","antivirusDetections":{"malicious":25,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T49c,"urlblockindex[1].bin" has type "data" "StikyNote.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "desktop.ini" has type "empty " "6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04" has type "data" "favicon[1].ico" has type "PNG image data 16 x 16 4-bit colormap non-interlaced" "50D6B15D9F2DCE1EDBB0C098625FBE47_281AC807DE0FEF15F2CA9911FE760A9B" has type "data" "RecoveryStore.{DC6D072F-2AA3-11E8-AA4A-0A0027B9126A}.dat" has type "Composite Document File V2 Document No summary info" "search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" has type "PNG image data 16 x 16 4-bit colormap non-interlaced" "favicon[3].ico" has type "PNG image data 16 x 16 4-bit colormap non-interlaced" "L8FV20BO.txt" has type "ASCII text" "search[1].json" has type "ASCII text with no line terminators" "{9C76F066-2AA4-11E8-AA4A-0A0027B9126A}.dat" has type "Composite Document File V2 Document No summary info" "6BADA8974A10C4BD62CC921D13E43B18_C9FB72B5AE80778A08024D8B0FDECC6F" has type "data" "40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" has type "data" "WFVZCRVD.txt" has type "ASCII text" "ZURGER02.txt" has type "ASCII text"25:T590,"" touched file "C:\Windows\AppPatch\sysmain.sdb" "" touched file "C:\Windows\SysWOW64\rundll32.exe" "" touched file "C:\Windows\SysWOW64\cmd.exe" "rundll32.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "rundll32.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "rundll32.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db" "iexplore.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "iexplore.exe" touched file "C:\Windows\System32\rsaenh.dll" "iexplore.exe" touched file "C:\Users\MSk7s3e\AppData\Local\Microsoft\Windows\Temporary Internet Files" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low" "iexplore.exe" touched file "C:\Users\MSk7s3e\AppData\Roaming\Microsoft\Windows\Cookies" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\Low" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History\Low" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized" "iexplore.exe" touched file "C:\Users\MSk7s3e\AppData\Roaming\Microsoft\Windows\PrivacIE" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\PrivacIE\Low"26:T275e,Pattern match: "http://www" Pattern match: "https://www" Pattern match: "https://validation.sls.microsoft.com/SLWGA/WatAdminTemplate.dll" Pattern match: "www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl0" Pattern match: "www.microsoft.com/pkiops/certs/MicSecSerCA2011_2011-10-18.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_`T" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "https://validation.sls.microsoft.com/SLWGA/slwga.asmx" Pattern match: "www.bing.com" Heuristic match: "*.vo.msecnd.net" Heuristic match: "*.adn.azureedge.net" Heuristic match: "*.ads2.msads.net" Heuristic match: "*.aspnetcdn.com" Heuristic match: "*.azurecomcdn.net" Heuristic match: "*.azureedge.net" Heuristic match: "*.azureedge-test.net" Heuristic match: "*.cdn.skype.com" Heuristic match: "*.cdn.skype.net" Heuristic match: "*.cmsresources.windowsphone.com" Heuristic match: "#*.cmsresources.windowsphone-int.com" Heuristic match: "*.dev.skype.com" Heuristic match: "*.fms.azureedge.net" Heuristic match: "*.microsoft-sbs-domains.com" Heuristic match: "*.secure.skypeassets.com" Heuristic match: "*.secure.skypeassets.net" Heuristic match: "*.wac.azureedge.net" Heuristic match: "*.wpc.azureedge.net" Heuristic match: "*.ec.azureedge.net" Heuristic match: "*.wpc.ec.azureedge.net" Heuristic match: "*.wac.ec.azureedge.net" Heuristic match: "*.adn.ec.azureedge.net" Heuristic match: "*.fms.ec.azureedge.net" Heuristic match: "cdnads.msads.net" Heuristic match: "cdn-resources.windowsphone.com" Heuristic match: "#cdn-resources-beta.windowsphone.com" Heuristic match: "ecnads1.msn.com" Heuristic match: "images-cms-pn.windowsphone-int.com" Heuristic match: "#images-cms-tst.windowsphone-int.com" Heuristic match: "montage.msn.com" Heuristic match: "%*.streaming.mediaservices.windows.net" Heuristic match: "*.origin.mediaservices.windows.net" Heuristic match: "download.sysinternals.com" Heuristic match: "amp.azure.net" Heuristic match: "rt.ms-studiosmedia.com" Heuristic match: "gtm.ms-studiosmedia.com" Heuristic match: "*.aisvc.visualstudio.com" Heuristic match: "*.cdn.powerbi.com" Heuristic match: "dist.asp.net" Heuristic match: "embed.powerbi.com" Heuristic match: "msitembed.powerbi.com" Heuristic match: "dxtembed.powerbi.com" Heuristic match: "*.cdn.powerappscdn.net" Heuristic match: "'downloads.subscriptionsint.tfsallin.net" Heuristic match: "download.my.visualstudio.com" Heuristic match: "cdn.vsassets.io" Heuristic match: "cdnppe.vsassets.io" Heuristic match: "datafactory.azure.com" Heuristic match: "*.cortanaanalytics.com" Heuristic match: "do.skype.com" Heuristic match: "prss.centralvalidation.com" Heuristic match: "*.gallerycdn.vsassets.io" Heuristic match: "*.gallerycdnppe.vsassets.io" Heuristic match: "global.asazure.windows.net" Pattern match: "www.videobreakdown.com" Pattern match: "www.breakdown.me" Heuristic match: "*.gallerycdntest.vsassets.io" Heuristic match: "agavecdn.o365weve-dev.com" Heuristic match: "agavecdn.o365weve-ppe.com" Heuristic match: "agavecdn.o365weve.com" Heuristic match: "download.visualstudio.com" Heuristic match: "*.Applicationinsights.net" Heuristic match: "*.Applicationinsights.io" Heuristic match: "*.sfbassets.com" Heuristic match: "*.sfbassets.net" Heuristic match: "download.mono-project.com" Heuristic match: "&*.streaming.media-test.windows-int.net" Heuristic match: "&*.origin.mediaservices.windows-int.net" Heuristic match: "rosoft-ppe.com" Pattern match: "www.videoindexer.ai" Heuristic match: "*.nuget.org" Heuristic match: "*.nugettest.org" Heuristic match: "cdn.botframework.com" Heuristic match: "*.streaming.media.azure.net" Heuristic match: "*.streaming.media.azure-test.net" Heuristic match: "cdn.cloudappsecurity.com" Pattern match: "mscrl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%205.crl" Pattern match: "crl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%205.crl0" Pattern match: "www.microsoft.com/pki/mscorp/Microsoft%20IT%20TLS%20CA%205.crt0" Pattern match: "http://ocsp.msocsp.com0" Pattern match: "http://www.microsoft.com/pki/mscorp/cps0" Pattern match: "http://ocsp.digicert.com0" Pattern match: "http://crl3.digicert.com/Omniroot2025.crl0=" Pattern match: "https://www.dig" Pattern match: "icert.com/CPS0" Pattern match: "www.bing.com0" Heuristic match: "dict.bing.com.cn" Heuristic match: "*.platform.bing.com" Heuristic match: "*.bing.com" Heuristic match: "*.windowssearch.com" Heuristic match: "*.origin.bing.com" Heuristic match: "*.mm.bing.net" Heuristic match: "pi.bing.com" Heuristic match: "ecn.dev.virtualearth.net" Heuristic match: "*.cn.bing.net" Heuristic match: "*.cn.bing.com" Heuristic match: "ssl-api.bing.com" Heuristic match: "ssl-api.bing.net" Heuristic match: "*.api.bing.net" Heuristic match: "*.bingapis.com" Heuristic match: "bingsandbox.com" Heuristic match: "insertmedia.bing.office.net" Heuristic match: "r.bat.bing.com" Heuristic match: "*.r.bat.bing.com" Heuristic match: "*.dict.bing.com.cn" Heuristic match: "*.dict.bing.com" Heuristic match: "*.ssl.bing.com" Heuristic match: "*.appex.bing.com" Heuristic match: "*.platform.cn.bing.com" Heuristic match: "wp.m.bing.com" Heuristic match: "*.m.bing.com" Heuristic match: "global.bing.com" Heuristic match: "windowssearch.com" Heuristic match: "search.msn.com" Heuristic match: "*.bingsandbox.com" Heuristic match: "*.api.tiles.ditu.live.com" Heuristic match: "*.ditu.live.com" Heuristic match: "*.t0.tiles.ditu.live.com" Heuristic match: "*.t1.tiles.ditu.live.com" Heuristic match: "*.t2.tiles.ditu.live.com" Heuristic match: "*.t3.tiles.ditu.live.com" Heuristic match: "*.tiles.ditu.live.com" Heuristic match: "3d.live.com" Heuristic match: "api.search.live.com" Heuristic match: "beta.search.live.com" Heuristic match: "cnweb.search.live.com" Heuristic match: "dev.live.com" Heuristic match: "ditu.live.com" Heuristic match: "farecast.live.com" Heuristic match: "image.live.com" Heuristic match: "images.live.com" Heuristic match: "local.live.com.au" Heuristic match: "localsearch.live.com" Heuristic match: "ls4d.search.live.com" Heuristic match: "mail.live.com" Heuristic match: "mapindia.live.com" Heuristic match: "local.live.com" Heuristic match: "maps.live.com" Heuristic match: "maps.live.com.au" Heuristic match: "mindia.live.com" Heuristic match: "news.live.com" Heuristic match: "origin.cnweb.search.live.com" Heuristic match: "preview.local.live.com" Heuristic match: "search.live.com" Heuristic match: "test.maps.live.com" Heuristic match: "video.live.com" Heuristic match: "videos.live.com" Heuristic match: "virtualearth.live.com" Heuristic match: "wap.live.com" Heuristic match: "webmaster.live.com" Heuristic match: "webmasters.live.com" Pattern match: "www.local.live.com.au" Pattern match: "www.maps.live.com.au0" Pattern match: "https://www.digicert.com/CPS0" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?cd89a1c1b0b85659 HTTP/1.1Connection: Keep-AliveAccept: */*If-Modified-Since: Thu, 20 Apr 2017 16:02:20 GMTIf-None-Match: 04e707defb9d21:0User-Agent: Microsoft-CryptoAPI/6.1Hos" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3c9b3fdedd592322 HTTP/1.1Connection: Keep-AliveAccept: */*If-Modified-Since: Thu, 20 Apr 2017 16:02:20 GMTIf-None-Match: 04e707defb9d21:0User-Agent: Microsoft-CryptoAPI/6.1Hos" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5c29dfe7245348a0 HTTP/1.1Connection: Keep-AliveAccept: */*If-Modified-Since: Thu, 20 Apr 2017 16:02:20 GMTIf-None-Match: 04e707defb9d21:0User-Agent: Microsoft-CryptoAPI/6.1Hos" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e21666111e837400 HTTP/1.1Connection: Keep-AliveAccept: */*If-Modified-Since: Thu, 20 Apr 2017 16:02:20 GMTIf-None-Match: 04e707defb9d21:0User-Agent: Microsoft-CryptoAPI/6.1Hos" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b985855e0b532f7c HTTP/1.1Connection: Keep-AliveAccept: */*If-Modified-Since: Thu, 20 Apr 2017 16:02:20 GMTIf-None-Match: 04e707defb9d21:0User-Agent: Microsoft-CryptoAPI/6.1Hos" Pattern match: "www.aka.ms" Heuristic match: "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQphfxhPb4vsBIPXkIOTJ7D1Z79fAQUCP4ln3TqhwTCvLuOqDhfM8bRbGUCEy0AAIDRU2YL2JJtYm8AAAAAgNE%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.msocsp.com" Pattern match: "www.msn.com" Pattern match: "mscrl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%204.crl" Pattern match: "crl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%204.crl0" Pattern match: "www.microsoft.com/pki/mscorp/Microsoft%20IT%20TLS%20CA%204.crt0" Heuristic match: "*.msn.com" Heuristic match: "*.services.msn.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAtqs7A%2Bsan2xGCSaqjN%2FrM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "query.prod.cms.msn.com" Pattern match: "mscrl.microsoft.com/pki/mscorp/crl/msitwww2.crl" Pattern match: "crl.microsoft.com/pki/mscorp/crl/msitwww2.crl0p" Pattern match: "www.microsoft.com/pki/mscorp/msitwww2.crt0" Pattern match: "http://www.microsoft.com/pki/mscorp/cps" Heuristic match: "cdn.query.prod.cms.msn.com" Heuristic match: ")cms-centralus-data-query-amp.cloudapp.net" Heuristic match: "&cms-eastus-data-query-amp.cloudapp.net" Pattern match: "http://cybertrust.omniroot.com/repository.cfm0" Pattern match: "http://ocsp.omniroot.com/baltimoreroot0" Pattern match: "cdp1.public-trust.com/CRL/Omniroot2025.crl0" Heuristic match: "GET /baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACBAcnqkc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.omniroot.com"27:Tb97,"" wrote bytes "c0df63771cf96277ccf862770d64647700000000c011297600000000fc3e297600000000e0132976000000009457517625e06377c6e0637700000000bc6a507600000000cf3129760000000093195176000000002c32297600000000" to virtual address "0x76EB1000" (part of module "NSI.DLL") "" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL") "rundll32.exe" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL") "cmd.exe" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL") "StikyNote.exe" wrote bytes "c0df63771cf96277ccf862770d64647700000000c011297600000000fc3e297600000000e0132976000000009457517625e06377c6e0637700000000bc6a507600000000cf3129760000000093195176000000002c32297600000000" to virtual address "0x76EB1000" (part of module "NSI.DLL") "StikyNote.exe" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "90d1eaf3fe070000f01dcc3f01000000101ecc3f01000000e036cc3f01000000501ecc3f010000000000000000000000" to virtual address "0x3FCC8000" "iexplore.exe" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "b0335a74" to virtual address "0x770E917C" (part of module "IERTUTIL.DLL") "iexplore.exe" wrote bytes "70485a74" to virtual address "0x770EB0C8" (part of module "IERTUTIL.DLL") "iexplore.exe" wrote bytes "a0475a74" to virtual address "0x770E9274" (part of module "IERTUTIL.DLL") "iexplore.exe" wrote bytes "80322601703226010032260160322601503226014032260130322601000000002cc97075c021260100000000901726015023260100182601601f260120362601000000004036260100000000" to virtual address "0x01268000" "iexplore.exe" wrote bytes "f0315a74" to virtual address "0x770EB0BC" (part of module "IERTUTIL.DLL") "iexplore.exe" wrote bytes "b0335a74" to virtual address "0x751C17CC" (part of module "ADVAPI32.DLL") "iexplore.exe" wrote bytes "b0335a74" to virtual address "0x012670C0" "iexplore.exe" wrote bytes "a0355a74" to virtual address "0x770EB0CC" (part of module "IERTUTIL.DLL") "iexplore.exe" wrote bytes "80495a74" to virtual address "0x770E92E8" (part of module "IERTUTIL.DLL") "reg.exe" wrote bytes "c0df63771cf96277ccf862770d64647700000000c011297600000000fc3e297600000000e0132976000000009457517625e06377c6e0637700000000bc6a507600000000cf3129760000000093195176000000002c32297600000000" to virtual address "0x76EB1000" (part of module "NSI.DLL") "reg.exe" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL")28:Tc11,"" wrote 1500 bytes to a remote process "C:\Windows\SysWOW64\rundll32.exe" (Handle: 296) "" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\rundll32.exe" (Handle: 296) "" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\rundll32.exe" (Handle: 296) "" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\rundll32.exe" (Handle: 296) "" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\rundll32.exe" (Handle: 296) "" wrote 4460 bytes to a remote process "C:\Windows\SysWOW64\rundll32.exe" (Handle: 296) "" wrote 145 bytes to a remote process "C:\Windows\SysWOW64\rundll32.exe" (Handle: 296) "" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\StikyNote.exe" (Handle: 312) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\StikyNote.exe" (Handle: 312) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\StikyNote.exe" (Handle: 312) "" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\StikyNote.exe" (Handle: 312) "StikyNote.exe" wrote 32 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 300) "StikyNote.exe" wrote 52 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 300) "StikyNote.exe" wrote 4 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 300) "StikyNote.exe" wrote 8 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 300) "StikyNote.exe" wrote 1024 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 300) "StikyNote.exe" wrote 283648 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 300) "StikyNote.exe" wrote 49152 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 300) "StikyNote.exe" wrote 12800 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 300) "StikyNote.exe" wrote 36352 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 300) "StikyNote.exe" wrote 13824 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 300) "iexplore.exe" wrote 32 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 864) "iexplore.exe" wrote 52 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 864) "iexplore.exe" wrote 8 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 864) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 124) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 124) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 124) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 124)29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACIiIAAAAAAAAAAAAAAAACIj4iIgAAAAAAAAAAAAACIiPiI+IiAAAAAAAAAAAAIiIj/iIiIiAAAAAAAAAAACIiIiIiIh3gAAAAAAAAAAAiIiIiIiHd3AAAAB3cAAAAAiIiId3d3iIgAAHePd3hwAAB4d3d4iI+IgAB4eIh3eHAACHeIj4iHiIAAeIiIiId3iIiIiHd4iHiAAHiIh3eI/4h3d4iI//+IgAB4iIeIh3d4iIj/////eIAAeIiHh4iIiPj/+Hj//3iAAHiIiIeIiHj///iH94+IgAB4iIiHiPeI///3iIf4iIAAeHiIh4iIiPiHd/iI/4iAAHh4iIiIf/f4j/f/eP+IgAB4eIiIj//39////3j/iIgAc3iIiI//+If///+I/4iIAHJ4iIiP//iI////j/+IhwB0eIiIj///f///////iIcAh4//iIj//3///////4j3AACIj/+I//+P/////4iI+AAAAAiIiP/////4iIiIiPgAAAAACIj/+IiIiIiIiIj4AAAAAACIiIiIiIiIiIiI8AAAAAAAiIiIiIiIgAAAAAAAAAAAAIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////+D///+AP//+AA///AAH//wAB//8AAfx/gAB4A+AAOADwADgAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAOAAAABgAAAAYAAAAGAAAABgAAAAeAAAAH8AAAB/wAAAf+AAAP/gAP//4f//////////////////w==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"4231f020816eebfa0b51e252477f2769838abeb83728072185060253372a4dd0","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790343074362,"unified_at":"2026-09-25T13:31:14.362Z","metadata":{"hashes":{"sha256":"4231f020816eebfa0b51e252477f2769838abeb83728072185060253372a4dd0","sha1":"f09bb42e6c39a9714ed8a4d4191cf19e40d1919b","md5":"c37a6dbc1f747652af8a7e13a4bfaea5","sha512":"5ded56339f418f557ce16f12afbf34512ea273ce5286b71c40d4f8554c4339e4495db8956af8832c5cef9f7a4e6d023577b3929e63282b16f898de967664f8f9","ssdeep":"12288:BqYXje0DF9k64/QSywqP0T8oIN1AHDFhY25fC2WF9sO204P:BqYDF9k64/Q9j28okAHDHY25fC2WF9sP","ssdeep_chunks":["12288:BqYXje0","12288:qYXje0D","12288:YXje0DF","12288:Xje0DF9","12288:je0DF9k","12288:e0DF9k6","12288:0DF9k64","12288:DF9k64/","12288:F9k64/Q","12288:9k64/QS","12288:k64/QSy","12288:64/QSyw","12288:4/QSywq","12288:/QSywqP","12288:QSywqP0","12288:SywqP0T","12288:ywqP0T8","12288:wqP0T8o","12288:qP0T8oI","12288:P0T8oIN","12288:0T8oIN1","12288:T8oIN1A","12288:8oIN1AH","12288:oIN1AHD","12288:IN1AHDF","12288:N1AHDFh","12288:1AHDFhY","12288:AHDFhY2","12288:HDFhY25","12288:DFhY25f","12288:FhY25fC","12288:hY25fC2","12288:Y25fC2W","12288:25fC2WF","12288:5fC2WF9","12288:fC2WF9s","12288:C2WF9sO","12288:2WF9sO2","12288:WF9sO20","12288:F9sO204","12288:9sO204P","24576:BqYXje0","24576:qYXje0D","24576:YXje0DF","24576:Xje0DF9","24576:je0DF9k","24576:e0DF9k6","24576:0DF9k64","24576:DF9k64/","24576:F9k64/Q","24576:9k64/QS","24576:k64/QSy","24576:64/QSyw","24576:4/QSywq","24576:/QSywqP","24576:QSywqP0","24576:SywqP0T","24576:ywqP0T8","24576:wqP0T8o","24576:qP0T8oI","24576:P0T8oIN","24576:0T8oIN1","24576:T8oIN1A","24576:8oIN1AH","24576:oIN1AHD","24576:IN1AHDF","24576:N1AHDFh","24576:1AHDFhY","24576:AHDFhY2","24576:HDFhY25","24576:DFhY25f","24576:FhY25fC","24576:hY25fC2","24576:Y25fC2W","24576:25fC2WF","24576:5fC2WF9","24576:fC2WF9s","24576:C2WF9sO","24576:2WF9sO2","24576:WF9sO20","24576:F9sO204","24576:9sO204P","12288:BqYDF9k","12288:qYDF9k6","12288:YDF9k64","12288:9k64/Q9","12288:k64/Q9j","12288:64/Q9j2","12288:4/Q9j28","12288:/Q9j28o","12288:Q9j28ok","12288:9j28okA","12288:j28okAH","12288:28okAHD","12288:8okAHDH","12288:okAHDHY","12288:kAHDHY2","12288:AHDHY25","12288:HDHY25f","12288:DHY25fC","12288:HY25fC2","12288:C2WF9sP"],"imphash":"e598f7d62f78837365f795794c131eb7"},"file_info":{"file_name":"codexgigas_f09bb42e6c39a9714ed8a4d4191cf19e40d1919b.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":396973,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1521374957000,"last_seen":1676718864000,"last_multi_scan":1676718864000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["hombot","sivis","apt","shamoon"]},"stats":{"av":{"malicious_count":25,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":19,"suspicious_count":13,"malicious_count":5,"total":37},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agentb.trDU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Dynamer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Hombot.tzrgz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.324316","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Turnedup-6598671-1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Changeling.QUK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/S-0b05534f!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.324316 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/StoneDrill.C trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Backdoor/SNBot.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00560cde1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agentb.bpml","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericR-ISW!C37A6DBC1F74","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Changeling.dgpyeo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/BackDr-Y","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Agent.396973.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"BKDR_TURNEDUP.SM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"BKDR_TURNEDUP.SM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Banker.CGW","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Agentb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Inject.Win32.81036","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Agentb","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 32448-3445-0042B07F","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetUserDefaultLCID@KERNEL32.dll at 32448-3250-0042D11D\n EnumSystemLocalesA@KERNEL32.dll at 32448-3452-0042D5B9","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"rundll32.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"2.21.242.227:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"%USERPROFILE%\\Desktop\\homeWork\\13930308\\Bot_70_FIX HEADER_FIX_LONGURL 73_StableAndNewProtocol - login all\\Release\\Bot.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\setup.tmp\"\n \"\" created file \"%TEMP%\\StikyNote.exe\"\n \"\" created file \"%TEMP%\\StikyNote.tmp\"\n \"cmd.exe\" created file \"%TEMP%\\StikyNote.exe\"\n \"cmd.exe\" created file \"%TEMP%\\StikyNote.exe:Zone.Identifier\"\n \"StikyNote.exe\" created file \"%TEMP%\\setup.tmp\"\n \"iexplore.exe\" created file \"%TEMP%\\~DF4C5481D3D4E65A5E.TMP\"\n \"iexplore.exe\" created file \"%TEMP%\\~DFB789D0C7BA61F9E2.TMP\"\n \"iexplore.exe\" created file \"%TEMP%\\~DF7E2894245F35B0FC.TMP\"\n \"iexplore.exe\" created file \"%TEMP%\\JavaDeployReg.log\"\n \"iexplore.exe\" created file \"%TEMP%\\JavaDeployReg.log\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Win_Connection\"\n \"Win_Connection\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2936\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"urlblockindex[1].bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00014522-00002936)\n Launches browser \"iexplore.exe\" (UID: 00014598-00001912)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 00014598-00001912) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"iexplore.exe\" (UID: 00014598-00001912) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"\n Process \"cmd.exe\" (UID: 00015573-00004012) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"cmd.exe\" (UID: 00015573-00004012) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"%WINDIR%\\system32\\cmd.exe /c copy \"C:\\codexgigas_f09bb42e6c39a9714ed8a4d4191cf19e40d1919b.exe\" \"%TEMP%\\StikyNote.exe\"\" on 2018-3-18.12:58:53.550\n \"/c REG ADD HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v RESTART_STICKY_NOTESS /f /t REG_SZ /d \"%TEMP%\\StikyNote.exe\"\" on 2018-3-18.13:02:07.300","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"rundll32.exe\" (UID: 00013346-00003316)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /c copy \"C:\\codexgigas_f09bb42e6c39a9714ed8a4d4191cf19e40d1919b.exe\" \"%TEMP%\\StikyNote.exe\"\" (UID: 00013409-00003160)\n Spawned process \"StikyNote.exe\" (UID: 00013462-00000624)\n Spawned process \"iexplore.exe\" (UID: 00014522-00002936)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2936 CREDAT:275457 /prefetch:2\" (UID: 00014598-00001912)\n Spawned process \"cmd.exe\" with commandline \"/c REG ADD HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v RESTART_STICKY_NOTESS /f /t REG_SZ /d \"%TEMP%\\StikyNote.exe\"\" (UID: 00015573-00004012)\n Spawned process \"reg.exe\" with commandline \"REG ADD HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v RESTART_STICKY_NOTESS /f /t REG_SZ /d \"%TEMP%\\StikyNote.exe\"\" (UID: 00015586-00002432)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$24","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"informative","category":"Installation/Persistance","name":"Drops executable files","description":"\"StikyNote.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"informative","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"reg.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"reg.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"RESTART_STICKY_NOTESS\"; Value: \"%TEMP%\\StikyNote.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"iexplore.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$25","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$26","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"codexgigas_f09bb42e6c39a9714ed8a4d4191cf19e40d1919b.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"StikyNote.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"cmd.exe\" created file \"%TEMP%\\StikyNote.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"\" queried SystemProcessInformation at 00012480-00002924-00000033-48131323\n \"StikyNote.exe\" queried SystemProcessInformation at 00013462-00000624-00000033-52396487","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc\n .rsrc with unusual entropies 7.46309207702\n 7.46309207702","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"codexgigas_f09bb42e6c39a9714ed8a4d4191cf19e40d1919b.exe.bin\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%TEMP%\\setup.tmp\", Handle: 296)\n \"\" is creating a new process (Name: \"%TEMP%\\StikyNote.exe\", Handle: 308)\n \"\" is creating a new process (Name: \"\\REGISTRY\\USER\\S-1-5-21-686412048-2446563785-1323799475-1001\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\", Handle: 312)\n \"rundll32.exe\" is creating a new process (Name: \"\\REGISTRY\\MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0\", Handle: 596)\n \"StikyNote.exe\" is creating a new process (Name: \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\SESSION MANAGER\\Environment\", Handle: 300)\n \"iexplore.exe\" is creating a new process (Name: \"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\", Handle: 864), \"cmd.exe\" is creating a new process (Name: \"%WINDIR%\\SysWOW64\\reg.exe\"\n Handle: 124)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"ping 1.1.1.1 -n 10 -w 2000 > nul\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 32448-1576-0041AAC0\n CreateToolhelp32Snapshot@KERNEL32.dll at 32448-1573-0041A900","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instsant messenger related domain","description":"\"*.cdn.skype.com\" (Indicator: \"skype.com\"; File: \"network.pcap\")\n \"*.dev.skype.com\" (Indicator: \"skype.com\"; File: \"network.pcap\")\n \"do.skype.com\" (Indicator: \"skype.com\"; File: \"network.pcap\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"rundll32.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"codexgigas_f09bb42e6c39a9714ed8a4d4191cf19e40d1919b.exe.bin\" claimed CRC 443846 while the actual is CRC 444877\n \"StikyNote.exe\" claimed CRC 443846 while the actual is CRC 428358","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcessToken\n GetTempPathA\n GetTempPathW\n CopyFileW\n WriteProcessMemory\n GetModuleFileNameW\n CopyFileA\n GetModuleFileNameA\n UnhandledExceptionFilter\n CreateThread\n ExitThread\n TerminateProcess\n CreateToolhelp32Snapshot\n LoadLibraryW\n GetTickCount\n VirtualProtect\n LoadLibraryA\n GetFileSize\n OpenProcess\n DeleteFileA\n GetStartupInfoW\n DeleteFileW\n GetProcAddress\n CreateFileW\n IsDebuggerPresent\n CreateFileA\n VirtualAllocEx\n Process32NextW\n GetCommandLineA\n Process32FirstW\n GetModuleHandleA\n GetModuleHandleW\n CreateProcessA\n WriteFile\n Sleep\n ShellExecuteA\n socket\n recv\n send\n WSAStartup\n connect\n closesocket","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$27","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00012480-00002924)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /c copy \"C:\\codexgigas_f09bb42e6c39a9714ed8a4d4191cf19e40d1919b.exe\" \"%TEMP%\\StikyNote.exe\"\" (UID: 00013409-00003160)\n Spawned process \"StikyNote.exe\" (UID: 00013462-00000624)\n Spawned process \"cmd.exe\" with commandline \"/c REG ADD HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v RESTART_STICKY_NOTESS /f /t REG_SZ /d \"%TEMP%\\StikyNote.exe\"\" (UID: 00015573-00004012)\n Spawned process \"reg.exe\" with commandline \"REG ADD HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v RESTART_STICKY_NOTESS /f /t REG_SZ /d \"%TEMP%\\StikyNote.exe\"\" (UID: 00015586-00002432)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"49/64 Antivirus vendors marked sample as malicious (76% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"49/64 Antivirus vendors marked sample as malicious (76% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"49/64 Antivirus vendors marked spawned process \"StikyNote.exe\" (PID: 624) as malicious (classified as \"Gen:Variant.Zusy\" with 76% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$28","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"StoneDrill_main_sub\" classified file \"codexgigas_f09bb42e6c39a9714ed8a4d4191cf19e40d1919b.exe.bin\" as \"apt,shamoon\" based on indicators: \"b80800fe7fff308f44242068b40f0000ff1578704400b80800fe7fff308f4424248b4c24242b4c2420b86bca5f6bf7e1c1ea1680ea02881595714500\" (Author: Kaspersky Lab)\n YARA signature \"StoneDrill_main_sub\" classified file \"StikyNote.exe\" as \"apt,shamoon\" based on indicators: \"b80800fe7fff308f44242068b40f0000ff1578704400b80800fe7fff308f4424248b4c24242b4c2420b86bca5f6bf7e1c1ea1680ea02881595714500\" (Author: Kaspersky Lab)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]}]},"activity":{"stats":{"process_count":8,"spawned_processes_count":8,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":26,"imported_dlls_count":129,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":135,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":15,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":16,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["hombot","sivis","apt","shamoon"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5aae53bb7ca3e14d9d4dbd33","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Zusy","contacted_countries":["EU"],"submit_name":"codexgigas_f09bb42e6c39a9714ed8a4d4191cf19e40d1919b.exe","analysis_start_time":"2018-03-18T12:55:53+00:00","indicators_count":{"informative":19,"suspicious":16,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"2.21.242.227","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}],"processes":[{"pid":2924,"ppid":0,"name":"codexgigas_f09bb42e6c39a9714ed8a4d4191cf19e40d1919b.exe","command_line":"","sha256":"4231f020816eebfa0b51e252477f2769838abeb83728072185060253372a4dd0","normalized_path":"C:\\codexgigas_f09bb42e6c39a9714ed8a4d4191cf19e40d1919b.exe","uid":"00012480-00002924","icon":"$29"},{"pid":3316,"ppid":2924,"name":"rundll32.exe","command_line":"","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00012480-00002924","uid":"00013346-00003316"},{"pid":4012,"ppid":3316,"name":"cmd.exe","command_line":"/c REG ADD HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v RESTART_STICKY_NOTESS /f /t REG_SZ /d \"%TEMP%\\StikyNote.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00013346-00003316","uid":"00015573-00004012"},{"pid":2432,"ppid":4012,"name":"reg.exe","command_line":"REG ADD HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v RESTART_STICKY_NOTESS /f /t REG_SZ /d \"%TEMP%\\StikyNote.exe\"","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\SysWOW64\\reg.exe","parent_uid":"00015573-00004012","uid":"00015586-00002432"},{"pid":3160,"ppid":2924,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c copy \"C:\\codexgigas_f09bb42e6c39a9714ed8a4d4191cf19e40d1919b.exe\" \"%TEMP%\\StikyNote.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00012480-00002924","uid":"00013409-00003160"},{"pid":624,"ppid":2924,"name":"StikyNote.exe","command_line":"","sha256":"4231f020816eebfa0b51e252477f2769838abeb83728072185060253372a4dd0","normalized_path":"%TEMP%\\StikyNote.exe","parent_uid":"00012480-00002924","uid":"00013462-00000624"},{"pid":2936,"ppid":624,"name":"iexplore.exe","command_line":"","sha256":"58ac3fef55e35bffc0319f37434bda136ae506ec4a984dbb5fe1b7f24852a16e","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00013462-00000624","uid":"00014522-00002936"},{"pid":1912,"ppid":2936,"name":"iexplore.exe","command_line":"SCODEF:2936 CREDAT:275457 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe","parent_uid":"00014522-00002936","uid":"00014598-00001912"}],"all_imported_dlls":["nlaapi.dll","mlang.dll","winhttp.dll","AcLayers.dll","version.dll","webio.dll","mscoreei.dll","msvcr90.dll","ntdll.dll","ole32.dll","urlmon.dll","cryptnet.dll","msvcr100.dll","wininet.dll","netprofm.dll","ieproxy.dll","mscorwks.dll","d3d10warp.dll","apphelp.dll","propsys.dll","cryptsp.dll","oleacc.dll","ssv.dll","gdi32.dll","normaliz.dll","duser.dll","acwow64.dll","wkscli.dll","credssp.dll","URLREDIR.DLL","devobj.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","IEShims.dll","ncrypt.dll","gpapi.dll","sechost.dll","comctl32.dll","wship6.dll","jp2ssv.dll","msctf.dll","imagehlp.dll","secur32.dll","comdlg32.dll","netutils.dll","d3d11.dll","cryptbase.dll","mswsock.dll","bcrypt.dll","wintrust.dll","d2d1.dll","imm32.dll","profapi.dll","mpr.dll","FWPUCLNT.DLL","ws2_32.dll","lpk.dll","api-ms-win-downlevel-user32-l1-1-0.dll","mscoree.dll","winbrand.dll","sqmapi.dll","rsaenh.dll","oleaccrc.dll","IDStore.dll","Wldap32.dll","usp10.dll","shell32.dll","api-ms-win-downlevel-version-l1-1-0.dll","winnsi.dll","ExplorerFrame.dll","DWrite.dll","dui70.dll","kernel32.dll","msasn1.dll","WindowsCodecs.dll","jscript9.dll","sspicli.dll","nsi.dll","uxtheme.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","npmproxy.dll","srvcli.dll","dnsapi.dll","WSHTCPIP.DLL","xmllite.dll","dxgi.dll","deploy.dll","wow64win.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","ieui.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","msvcrt.dll","setupapi.dll","cfgmgr32.dll","ntmarta.dll","advapi32.dll","oleaut32.dll","ieframe.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","RpcRtRemote.dll","wow64.dll","rpcrt4.dll","clbcatq.dll","dwmapi.dll","rasadhlp.dll","bcryptprimitives.dll","SensApi.dll","mshtml.dll","user32.dll","iertutil.dll","msimtf.dll","netapi32.dll","crypt32.dll","msimg32.dll","schannel.dll","sxs.dll","GdiPlus.dll","IPHLPAPI.DLL","MSOHEV.DLL","shlwapi.dll","wsock32.dll","dhcpcsvc6.dll","wshqos.dll","userenv.dll","rpcss.dll","dhcpcsvc.dll","wow64cpu.dll","KernelBase.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"urlblockindex[1].bin","sha256":"775853600060162c4b4e5f883f9fd5a278e61c471b3ee1826396b6d129499aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"StikyNote.exe","sha256":"db1db650a4396286ce7d015b98fba4e5d9e85820c69d409186dd80bcc4113b81","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"L8FV20BO.txt","sha256":"7a23cba373c4ddc77ea69d435d9e9312d1bef47a5bf3d0997271584bd34f884c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"WFVZCRVD.txt","sha256":"d5871a0f78f32c05b4c3411f7c07ef9870717448e15391d2afb3309c1508f859","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"ZURGER02.txt","sha256":"97c6f6abe0f4a8d13f58c636369d8e3eef55b867ac69244ec40445de9c65f8df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"RecoveryStore.{DC6D072F-2AA3-11E8-AA4A-0A0027B9126A}.dat","sha256":"1be7de91491c9b4550f9aadf97634f805b1e7279c02a1b85325ea9008d6d2f28","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"{9C76F066-2AA4-11E8-AA4A-0A0027B9126A}.dat","sha256":"32de31b5d0b75c03c89923ea3de404807f67242e8d9dd232b9dcea98b3082df2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"{DC6D0731-2AA3-11E8-AA4A-0A0027B9126A}.dat","sha256":"4a403e7d66b81b9f86289148b1babf5aa77e78aab54fce8fdba055e0dd62b3da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"ver9E93.tmp","sha256":"8684403da59628039e9b4b0d245c5b7e1fac1242a087ded44eaf3b792e4a231e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"favicon[1].ico","sha256":"6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"favicon[3].ico","sha256":"6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"search[1].json","sha256":"45492c31786ea8122530a6bbb5f43f8c1ea25c8f502e02486eb8f0145a742029","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"suggestions[1].en-US","sha256":"c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"50D6B15D9F2DCE1EDBB0C098625FBE47_281AC807DE0FEF15F2CA9911FE760A9B","sha256":"adc8c409694c0513c7fc7a0f13530c7e9ed375b2847e22ed5a1c45413db7e851","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"34c3dc242f1b30c233c90a7bc6b9b16b336bd66a08dbcf0f2aafb5ee74799052","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sha256":"df7e1a40795174e9ded7d70fe6b9c335450820472634dbffa67b5d6c5fa6616f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_C9FB72B5AE80778A08024D8B0FDECC6F","sha256":"ddc35f471f53df72cff3cdcf62e4a7ea0de895ae62fc0310123869986a0bb47c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1","sha256":"cf24eebd3d98a0c7ec52e1dac5cb31eb93494371d63b355f271b3303f8a8f39a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico","sha256":"6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"StikyNote.tmp","sha256":"d162847af0378c04d71e229999de40a73ec04963ae6d8fa2a9568735eebba4c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]}],"files_written":[{"path":"C:\\codexgigas_f09bb42e6c39a9714ed8a4d4191cf19e40d1919b.exe","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"C:\\codexgigas_f09bb42e6c39a9714ed8a4d4191cf19e40d1919b.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%TEMP%\\StikyNote.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%TEMP%\\StikyNote.tmp","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\SysWOW64\\rundll32.exe","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\AppPatch\\acwow64.dll","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%TEMP%\\StikyNote.exe","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%TEMP%\\setup.tmp","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\UrlBlockManager\\urlblocklist.bin","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Low","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Low","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Low","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Low","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Tracking Protection","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\TabRoaming","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\PlayReady","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE\\Low","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException\\Low","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache\\Low","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache\\Low","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%TEMP%\\Low","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\en\\IEXPLORE.EXE.mui","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{DC6D072F-2AA3-11E8-AA4A-0A0027B9126A}.dat","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%TEMP%\\~DF4C5481D3D4E65A5E.TMP","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{DC6D0731-2AA3-11E8-AA4A-0A0027B9126A}.dat","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%TEMP%\\~DFB789D0C7BA61F9E2.TMP","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%PROGRAMFILES(X86)%\\MICROS~2\\Office14\\URLREDIR.DLL","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%PROGRAMFILES%\\(x86)\\Java\\jre1.8.0_151\\lib\\plugin.jar","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%PROGRAMFILES%\\(x86)\\Java\\jre1.8.0_151\\bin\\javaws.exe","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%TEMP%\\JavaDeployReg.log","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\SysWOW64\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\SysWOW64\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\imagestore\\js9ur7b\\imagestore.dat","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[2].ico","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\L9I86110.txt","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\AJM3J0V2.txt","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\24I82KXY.txt","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_49FC544F04082FD9F64F9EFB226AF8B5","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\82CB34DD3343FE727DF8890D352E0D8F","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\VersionManager\\ver9E93.tmp","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\urlblockindex[1].bin","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[1].ico","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[3].ico","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[1].png","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[2].png","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[3].png","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[4].png","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[5].png","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[6].png","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[7].png","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[8].png","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[9].png","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[10].png","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon71PRJ02Z.png","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\faviconO8VQVBXQ.png","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe.config","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\SysWOW64","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\SysWOW64\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\SysWOW64\\reg.exe","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\reg.exe.mui","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%WINDIR%\\SysWOW64\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{9C76F066-2AA4-11E8-AA4A-0A0027B9126A}.dat","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%TEMP%\\~DF7E2894245F35B0FC.TMP","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ZURGER02.txt","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\WFVZCRVD.txt","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\L8FV20BO.txt","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\suggestions[1].en-US","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.2","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.1","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\50D6B15D9F2DCE1EDBB0C098625FBE47_10F47D053B284EB5F3ED5550578B001D","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8FE2C641C99CFA6687FA8D31B7D528A1","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D3BD78A30B98D17C317EDD4FFE850A0","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\50D6B15D9F2DCE1EDBB0C098625FBE47_281AC807DE0FEF15F2CA9911FE760A9B","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\50D6B15D9F2DCE1EDBB0C098625FBE47_281AC807DE0FEF15F2CA9911FE760A9B","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\N89NDR7U.txt","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_77EB97F2E95D4980FAA5A3E040A0FF80","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_C9FB72B5AE80778A08024D8B0FDECC6F","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_C9FB72B5AE80778A08024D8B0FDECC6F","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_5EBE6DB976D2A24B70511DE6385541FC","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\1DAF2884EC4DFA96BA4A58D4DBC9C406","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\search[1].json","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{13C4E657-95AE-4E99-9C74-268A24CDB988}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\0A-00-27-00-00-00\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\RECOVERY\\ADMINACTIVE\\{00000000-0000-0000-0000-000000000000}\\{00000000-0000-0000-0000-000000000000}","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SQM\\FREEZEUPLOADS\\HIGHTIME\\HIGHTIME","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SQM\\FREEZEUPLOADS\\LOWTIME\\LOWTIME","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Win_Connection","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"Win_Connection","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"IsoScope_b78_IE_EarlyTabStart_0x870_Mutex","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"IsoScope_b78_ConnHashTable<2936>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"EUPPSYNCLOCK","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"IsoScope_b78_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2936","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\EUPPSYNCLOCK","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_b78_IE_EarlyTabStart_0x870_Mutex","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_b78_ConnHashTable<2936>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_b78_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_b78_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_b78_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_b78_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5aae53bb7ca3e14d9d4dbd33"}]}]}},"report_ids":{"sandbox_job_ids":["5aae53bb7ca3e14d9d4dbd33"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Trojan.Agentb Sample 4231f020816e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4231f020816e…. Malware family: Trojan.Agentb. Threat score 100/100. 25/28 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4231f020816eebfa0b51e252477f2769838abeb83728072185060253372a4dd0"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Agentb Sample 4231f020816e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4231f020816e…. Malware family: Trojan.Agentb. Threat score 100/100. 25/28 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4231f020816eebfa0b51e252477f2769838abeb83728072185060253372a4dd0"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Agentb Sample 4231f020816e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4231f020816e…. Malware family: Trojan.Agentb. Threat score 100/100. 25/28 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]