26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T492,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 5d4bab44624c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5d4bab44624c…. Malware family: Trojan.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 12 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5d4bab44624c21b8f72ce4a7ffea99dd3a74c290d37cfdb1f5e761e7ced5bcb2","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","5d4bab44624c21b8f72ce4a7ffea99dd3a74c290d37cfdb1f5e761e7ced5bcb2"],"about":{"@type":"SoftwareApplication","name":"ovvbdu.zip","applicationCategory":["peexe","assembly","executable"],"identifier":"5d4bab44624c21b8f72ce4a7ffea99dd3a74c290d37cfdb1f5e761e7ced5bcb2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":18,"total":28},"behavioralIndicators":{"malicious":12,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T528,"" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\assembly\NativeImages_v2.0.50727_32\index23b.dat"28:T9c3,"" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\bluetooth.exe" (Handle: 728) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\bluetooth.exe" (Handle: 728) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\bluetooth.exe" (Handle: 728) "" wrote 32 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 728) "" wrote 52 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 728) "" wrote 4 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 728) "" wrote 32 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 860) "" wrote 52 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 860) "" wrote 4 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 860) "bluetooth.exe" wrote 1500 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" (Handle: 420) "bluetooth.exe" wrote 4 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" (Handle: 420) "bluetooth.exe" wrote 32 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" (Handle: 420) "bluetooth.exe" wrote 52 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" (Handle: 420) "bluetooth.exe" wrote 1024 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" (Handle: 420) "bluetooth.exe" wrote 580095 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" (Handle: 420) "bluetooth.exe" wrote 6655 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" (Handle: 420) "bluetooth.exe" wrote 15871 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" (Handle: 420) "bluetooth.exe" wrote 16895 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" (Handle: 420) "bluetooth.exe" wrote 511 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" (Handle: 420) "bluetooth.exe" wrote 35839 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" (Handle: 420)29:Ta6d,Found malicious artifacts related to "163.172.133.54" (ASN: , Owner: ): ... File SHA256: 4ae2056a3f4fcd86be655fa1b2e146637c41d33009feaf1ff137281412d604bb (AV positives: 12/68 scanned on 11/07/2017 16:37:03) File SHA256: 8bef45bdf7c16e9ca48bf858f68ae77a6ca52c627fcb35e68c391cc802070f6f (AV positives: 60/66 scanned on 10/23/2017 01:40:58) File SHA256: 918ed7f2eae745bd2b111c6bfc3f9ca67007cf30fb11c8d2cf727ac8805fc08f (Scanned on 07/20/2017 17:03:18) File SHA256: ae928c8f7693c2a670dfdd82ee1d41322dc1fa8027eaa4f5d2bee802f33b2144 (AV positives: 4/64 scanned on 07/19/2017 08:49:55) File SHA256: 8fa064189e15f5f665291f819a85f0d64da67a2f19d3cf596d9c6571d9cf47a9 (Scanned on 07/17/2017 07:03:30) File SHA256: c3634033748e7823889ac5f8bde73acd18528606e7e7eb0567b9091a6e720b0e (Scanned on 07/17/2017 06:40:20) File SHA256: 7bb140c524f06f6bd2548b0d6f14165b647f434b0c73a2b74b00f7c2aabf081f (Scanned on 06/17/2017 02:00:24) File SHA256: 0b77d0ef24974b3975e873d2c192b63300c1c1ccf22cf4a4cefcab206467a9af (Scanned on 06/14/2017 12:33:21) File SHA256: 0cc398f7378284fe1bee8a0eb7ec0a0a79ad1920157e51d1f3086eb8d722b899 (AV positives: 18/61 scanned on 06/01/2017 07:40:07) File SHA256: 76d3532431d2af82a5d999e9cbb9e3e968bfae675e184fa0a5210ffd1675ac15 (AV positives: 24/62 scanned on 05/31/2017 11:31:03) Found malicious artifacts related to "212.51.143.20" (ASN: , Owner: ): ... URL: https://212.51.143.20/ (AV positives: 1/68 scanned on 08/10/2016 06:55:04) File SHA256: 94ff47f71487903314e3ba9f2b0521c32c4aa0ca99c7df0adca0a25d17eff6f6 (AV positives: 11/64 scanned on 11/14/2017 22:59:52) File SHA256: 51922f6839e844298c01f0f6430f86fef6294cd675628bdfdaff193ea90cdecb (AV positives: 12/68 scanned on 11/14/2017 17:26:58) File SHA256: acff4bb38e589ef410ad8bef41fca00bb116539fc2b2ae5f488bfc718cdc7426 (AV positives: 12/68 scanned on 11/11/2017 08:54:45) File SHA256: 4ae2056a3f4fcd86be655fa1b2e146637c41d33009feaf1ff137281412d604bb (AV positives: 12/68 scanned on 11/07/2017 16:37:01) File SHA256: 7b3c49cdc32e2eadfe6c6125c6b6108aea227f3596ac8b861d37d47e8c69d69e (AV positives: 51/68 scanned on 11/03/2017 16:57:44) File SHA256: 5dddd8a0dcf24c4885c54a801140633ac7c8e2a94d438eb28f0375cd325ecbc4 (Scanned on 08/06/2017 00:58:00) File SHA256: 3d49d9096b6d5d4476e3f8c13a02993d0e1740ac938bc83f6f532bca5f21c612 (Scanned on 08/03/2017 14:39:48) File SHA256: fb384d517910e2a85fc86679ee6ceb5797f05b6b5be90dd6ebf309deaeb48fff (Scanned on 08/03/2017 14:33:53) File SHA256: 2da964481f1ed737d7ea28f54e37e4ee1564dd4efc9220f64da52bc418d78501 (Scanned on 08/03/2017 14:29:27) File SHA256: 3dec3be94d3de8ce53ab3d7995054aaa5ad4f087fe994049eda4b3f06cb3a31f (Scanned on 08/03/2017 14:24:39)2a:Ta6d,Found malicious artifacts related to "163.172.133.54" (ASN: , Owner: ): ... File SHA256: 4ae2056a3f4fcd86be655fa1b2e146637c41d33009feaf1ff137281412d604bb (AV positives: 12/68 scanned on 11/07/2017 16:37:03) File SHA256: 8bef45bdf7c16e9ca48bf858f68ae77a6ca52c627fcb35e68c391cc802070f6f (AV positives: 60/66 scanned on 10/23/2017 01:40:58) File SHA256: 918ed7f2eae745bd2b111c6bfc3f9ca67007cf30fb11c8d2cf727ac8805fc08f (Scanned on 07/20/2017 17:03:18) File SHA256: ae928c8f7693c2a670dfdd82ee1d41322dc1fa8027eaa4f5d2bee802f33b2144 (AV positives: 4/64 scanned on 07/19/2017 08:49:55) File SHA256: 8fa064189e15f5f665291f819a85f0d64da67a2f19d3cf596d9c6571d9cf47a9 (Scanned on 07/17/2017 07:03:30) File SHA256: c3634033748e7823889ac5f8bde73acd18528606e7e7eb0567b9091a6e720b0e (Scanned on 07/17/2017 06:40:20) File SHA256: 7bb140c524f06f6bd2548b0d6f14165b647f434b0c73a2b74b00f7c2aabf081f (Scanned on 06/17/2017 02:00:24) File SHA256: 0b77d0ef24974b3975e873d2c192b63300c1c1ccf22cf4a4cefcab206467a9af (Scanned on 06/14/2017 12:33:21) File SHA256: 0cc398f7378284fe1bee8a0eb7ec0a0a79ad1920157e51d1f3086eb8d722b899 (AV positives: 18/61 scanned on 06/01/2017 07:40:07) File SHA256: 76d3532431d2af82a5d999e9cbb9e3e968bfae675e184fa0a5210ffd1675ac15 (AV positives: 24/62 scanned on 05/31/2017 11:31:03) Found malicious artifacts related to "212.51.143.20" (ASN: , Owner: ): ... URL: https://212.51.143.20/ (AV positives: 1/68 scanned on 08/10/2016 06:55:04) File SHA256: 94ff47f71487903314e3ba9f2b0521c32c4aa0ca99c7df0adca0a25d17eff6f6 (AV positives: 11/64 scanned on 11/14/2017 22:59:52) File SHA256: 51922f6839e844298c01f0f6430f86fef6294cd675628bdfdaff193ea90cdecb (AV positives: 12/68 scanned on 11/14/2017 17:26:58) File SHA256: acff4bb38e589ef410ad8bef41fca00bb116539fc2b2ae5f488bfc718cdc7426 (AV positives: 12/68 scanned on 11/11/2017 08:54:45) File SHA256: 4ae2056a3f4fcd86be655fa1b2e146637c41d33009feaf1ff137281412d604bb (AV positives: 12/68 scanned on 11/07/2017 16:37:01) File SHA256: 7b3c49cdc32e2eadfe6c6125c6b6108aea227f3596ac8b861d37d47e8c69d69e (AV positives: 51/68 scanned on 11/03/2017 16:57:44) File SHA256: 5dddd8a0dcf24c4885c54a801140633ac7c8e2a94d438eb28f0375cd325ecbc4 (Scanned on 08/06/2017 00:58:00) File SHA256: 3d49d9096b6d5d4476e3f8c13a02993d0e1740ac938bc83f6f532bca5f21c612 (Scanned on 08/03/2017 14:39:48) File SHA256: fb384d517910e2a85fc86679ee6ceb5797f05b6b5be90dd6ebf309deaeb48fff (Scanned on 08/03/2017 14:33:53) File SHA256: 2da964481f1ed737d7ea28f54e37e4ee1564dd4efc9220f64da52bc418d78501 (Scanned on 08/03/2017 14:29:27) File SHA256: 3dec3be94d3de8ce53ab3d7995054aaa5ad4f087fe994049eda4b3f06cb3a31f (Scanned on 08/03/2017 14:24:39)2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAP//////////////AAAAAA////////////////AAAAAP///////////////wAAAAD///////////////8AAAAA//+Ij///////////AAAAAP//eHj//////////wAAAAD//3+I//////////8AAAAA//+Hh4//////iP//AAAAAP//+Hd/////h3f//wAAAAD////4d4j/93iHj/8AAAAA/////4eHd3d3iP//AAAAAP/////4j4eP/////wAAAAD/////+H94//////8AAAAA//////93j///////AAAAAP//////h////////wAAAAD//////3f///////8AAAAA//////h3j///////AAAAAP/////4iI///////wAAAAD/////+IiP//////8AAAAA//////iHj///////AAAAAP//////iP///////wAAAAD///////////////8AAAAA////////////////AAAAAP///////////////wAAAAD///////////////8AAAAA///////////4iIiAAAAAAP//////////+IiIAAAAAAD///////////iIgAAAAAAA///////////4iAAAAAAAAP//////////+IAAAAAAAAD///////////gAAAAAAAAAD//////////wAAAAAAD4AAAf8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAH/AAAD/wAAB/8AAA//AAAf/wAAP/+AAH/w==2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAP//////////////AAAAAA////////////////AAAAAP///////////////wAAAAD///////////////8AAAAA//+Ij///////////AAAAAP//eHj//////////wAAAAD//3+I//////////8AAAAA//+Hh4//////iP//AAAAAP//+Hd/////h3f//wAAAAD////4d4j/93iHj/8AAAAA/////4eHd3d3iP//AAAAAP/////4j4eP/////wAAAAD/////+H94//////8AAAAA//////93j///////AAAAAP//////h////////wAAAAD//////3f///////8AAAAA//////h3j///////AAAAAP/////4iI///////wAAAAD/////+IiP//////8AAAAA//////iHj///////AAAAAP//////iP///////wAAAAD///////////////8AAAAA////////////////AAAAAP///////////////wAAAAD///////////////8AAAAA///////////4iIiAAAAAAP//////////+IiIAAAAAAD///////////iIgAAAAAAA///////////4iAAAAAAAAP//////////+IAAAAAAAAD///////////gAAAAAAAAAD//////////wAAAAAAD4AAAf8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAH/AAAD/wAAB/8AAA//AAAf/wAAP/+AAH/w==2d:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2e:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2f:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"5d4bab44624c21b8f72ce4a7ffea99dd3a74c290d37cfdb1f5e761e7ced5bcb2","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790268081038,"unified_at":"2026-09-24T16:41:21.038Z","metadata":{"hashes":{"sha256":"5d4bab44624c21b8f72ce4a7ffea99dd3a74c290d37cfdb1f5e761e7ced5bcb2","sha1":"4954967adde613ccddea07b1b40efd5cde5fe7cb","md5":"0ba978069c7f5c4b012f37a21ce56b45","sha512":"9c650bfafb8851e7b133fc57ed27c920d164192931c11a625855480b2dbe892a80bcf23c4cc0ab52921b4140dc05bed54d9b15ea0c620349df3a6d1a297d61df","ssdeep":"24576:yeMuC+WRcGZO/SArJEioxh+pUk9ESSbiQ1:DCvwHrJETh+p79ESSb3","ssdeep_chunks":["24576:yeMuC+W","24576:eMuC+WR","24576:MuC+WRc","24576:uC+WRcG","24576:C+WRcGZ","24576:+WRcGZO","24576:WRcGZO/","24576:RcGZO/S","24576:cGZO/SA","24576:GZO/SAr","24576:ZO/SArJ","24576:O/SArJE","24576:/SArJEi","24576:SArJEio","24576:ArJEiox","24576:rJEioxh","24576:JEioxh+","24576:Eioxh+p","24576:ioxh+pU","24576:oxh+pUk","24576:xh+pUk9","24576:h+pUk9E","24576:+pUk9ES","24576:pUk9ESS","24576:Uk9ESSb","24576:k9ESSbi","24576:9ESSbiQ","24576:ESSbiQ1","49152:yeMuC+W","49152:eMuC+WR","49152:MuC+WRc","49152:uC+WRcG","49152:C+WRcGZ","49152:+WRcGZO","49152:WRcGZO/","49152:RcGZO/S","49152:cGZO/SA","49152:GZO/SAr","49152:ZO/SArJ","49152:O/SArJE","49152:/SArJEi","49152:SArJEio","49152:ArJEiox","49152:rJEioxh","49152:JEioxh+","49152:Eioxh+p","49152:ioxh+pU","49152:oxh+pUk","49152:xh+pUk9","49152:h+pUk9E","49152:+pUk9ES","49152:pUk9ESS","49152:Uk9ESSb","49152:k9ESSbi","49152:9ESSbiQ","49152:ESSbiQ1","24576:DCvwHrJ","24576:CvwHrJE","24576:vwHrJET","24576:wHrJETh","24576:HrJETh+","24576:rJETh+p","24576:JETh+p7","24576:ETh+p79","24576:Th+p79E","24576:h+p79ES","24576:+p79ESS","24576:p79ESSb","24576:79ESSb3"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"ovvbdu.zip","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1169408,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1510778795000,"last_seen":1676804644000,"last_multi_scan":1676804644000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":9,"suspicious_count":13,"malicious_count":12,"total":34},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Fareit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/Win32.DarkKomet","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1202149","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKDZ.39897","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Dropper.Lokibot-9899536-1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Injector.KW.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKDZ.39897 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.KFJ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!B15F157627B47B5D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00512d781 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.DarkKomet.hqbt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FNRD!0BA978069C7F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.DarkKomet.ergsfp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Kryptik-AA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Crypt.Win32.77874","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\BLUETOOTH.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\BLUETOOTH.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"163.172.133.54:443\"\n \"212.51.143.20:443\"\n \"213.183.58.30:1604\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 6A050000\n \"bluetooth.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\d40b99d82652dbbc000d378a824ae296\\mscorlib.ni.dll\" at 68F80000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"bluetooth.exe\" (UID: 00017406-00002556)\n Spawned process \"schtasks.exe\" with commandline \"/create /SC MINUTE /TN Application /TR %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\bluetooth.exe\" (UID: 00019418-00002716)\n Spawned process \"schtasks.exe\" with commandline \"/create /SC MINUTE /TN Application /TR %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\bluetooth.exe\" (UID: 00019425-00000932)\n Spawned process \"AppLaunch.exe\" (UID: 00022075-00002972)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"desktop.ini\" has type \"empty\"\n \"2017-11-15-4.dc\" has type \"ASCII text with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"www.sysprep.org\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"scan_doc.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Possibly checks for the presence of an Antivirus engine","description":"\"F-Secure KEY\" (Indicator: \"f-secure\")","origin":"File/Memory","relevance":3,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.97366639682","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"bluetooth.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"AppLaunch.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"bluetooth.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"\" sleeping for \"1566804069\" milliseconds\n \"bluetooth.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\bluetooth.exe\", Handle: 728)\n \"\" is creating a new process (Name: \"%WINDIR%\\System32\\schtasks.exe\", Handle: 728)\n \"\" is creating a new process (Name: \"%WINDIR%\\System32\\schtasks.exe\", Handle: 860)\n \"bluetooth.exe\" is creating a new process (Name: \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe\", Handle: 420)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.42.101.9\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"AppLaunch.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"db4d766e00000000\" to virtual address \"0x00102000\" (part of module \"SCAN_DOC.EXE\")\n \"\" wrote bytes \"0857d0750478d9750000000051c1ab769498ab76ee9cab7675dcad76273ead76efb2b1760000000046ce3c77013d3d7738ed3d77cfcd3c7731233c77de2f3d77c4ca3c7780bb3c77aa6e3d779fbb3c7792bb3c7746ba3c770abf3c7700000000\" to virtual address \"0x65EF1000\" (part of module \"SHFOLDER.DLL\")\n \"\" wrote bytes \"6656382f\" to virtual address \"0x67AC1FDC\" (part of module \"MSCORWKS.DLL\")\n \"bluetooth.exe\" wrote bytes \"db4d766e00000000\" to virtual address \"0x00C62000\" (part of module \"BLUETOOTH.EXE\")\n \"bluetooth.exe\" wrote bytes \"0857d0750478d9750000000051c1ab769498ab76ee9cab7675dcad76273ead76efb2b1760000000046ce3c77013d3d7738ed3d77cfcd3c7731233c77de2f3d77c4ca3c7780bb3c77aa6e3d779fbb3c7792bb3c7746ba3c770abf3c7700000000\" to virtual address \"0x65EF1000\" (part of module \"SHFOLDER.DLL\")\n \"bluetooth.exe\" wrote bytes \"8455e71d\" to virtual address \"0x67AC1FDC\" (part of module \"MSCORWKS.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"AppLaunch.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"50/64 Antivirus vendors marked sample as malicious (78% detection rate)\n 18/39 Antivirus vendors marked sample as malicious (46% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"50/64 Antivirus vendors marked sample as malicious (78% detection rate)\n 18/39 Antivirus vendors marked sample as malicious (46% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"56/86 Antivirus vendors marked spawned process \"bluetooth.exe\" (PID: 2556) as malicious (classified as \"Trojan.Generic\" with 65% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"malicious","category":"Installation/Persistance","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"/create /SC MINUTE /TN Application /TR %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\bluetooth.exe\" (UID: 00019418-00002716)\n Process \"schtasks.exe\" with commandline \"/create /SC MINUTE /TN Application /TR %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\bluetooth.exe\" (UID: 00019425-00000932)","origin":"Monitored Target","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"malicious","category":"Installation/Persistance","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"bluetooth.exe\" set thread context in remote process \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe\" (PID 00000b9c)","origin":"API Call","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$28","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$29","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$2a","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"malicious","category":"Network Related","name":"Sends network traffic on a port typically used by trojan horses","description":"\"Traffic to 213.183.58.30 on port 1604","origin":"Network Traffic","relevance":9,"id":"network-12","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 213.183.58.30 on port 1604","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Creates a mutant that is known to appear in malware","description":"\"DC_MUTEX-\" in \"DarkComet\"","origin":"Created Mutant","relevance":7,"id":"mutant-1","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00014740-00003392)\n Spawned process \"bluetooth.exe\" (UID: 00017406-00002556)\n Spawned process \"schtasks.exe\" with commandline \"/create /SC MINUTE /TN Application /TR %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\bluetooth.exe\" (UID: 00019418-00002716)\n Spawned process \"schtasks.exe\" with commandline \"/create /SC MINUTE /TN Application /TR %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\bluetooth.exe\" (UID: 00019425-00000932)\n Spawned process \"AppLaunch.exe\" (UID: 00022075-00002972)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Uses network protocols on unusual ports"},{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":9,"imported_dlls_count":84,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":49,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5a0ca6227ca3e1676f3c81c6","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["CHE","GBR","LTU"],"submit_name":"ovvbdu.zip","analysis_start_time":"2017-11-15T21:37:14+00:00","indicators_count":{"informative":9,"suspicious":13,"malicious":13},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"163.172.133.54","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"address":"212.51.143.20","port":443,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"address":"213.183.58.30","port":1604,"protocol":"TCP","country":"Lithuania","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}],"processes":[{"pid":3392,"ppid":0,"name":"scan_doc.exe","command_line":"","sha256":"5d4bab44624c21b8f72ce4a7ffea99dd3a74c290d37cfdb1f5e761e7ced5bcb2","normalized_path":"C:\\scan_doc.exe","uid":"00014740-00003392","icon":"$2b"},{"pid":2556,"ppid":3392,"name":"bluetooth.exe","command_line":"","sha256":"5d4bab44624c21b8f72ce4a7ffea99dd3a74c290d37cfdb1f5e761e7ced5bcb2","normalized_path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\bluetooth.exe","parent_uid":"00014740-00003392","uid":"00017406-00002556","icon":"$2c"},{"pid":2972,"ppid":2556,"name":"AppLaunch.exe","command_line":"","sha256":"da5c2d3e6b5e937db77e725e1c4be5d1a7c32b9da24d2a93cb86736087c466d0","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe","parent_uid":"00017406-00002556","uid":"00022075-00002972","icon":"$2d"},{"pid":2716,"ppid":3392,"name":"schtasks.exe","command_line":"/create /SC MINUTE /TN Application /TR %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\bluetooth.exe","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00014740-00003392","uid":"00019418-00002716","icon":"$2e"},{"pid":932,"ppid":3392,"name":"schtasks.exe","command_line":"/create /SC MINUTE /TN Application /TR %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\bluetooth.exe","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00014740-00003392","uid":"00019425-00000932","icon":"$2f"}],"all_imported_dlls":["user32.dll","cryptbase.dll","GdiPlus.dll","System.Core.ni.dll","mswsock.dll","shlwapi.dll","WindowsCodecs.dll","winmm.dll","msvfw32.dll","msvcr80.dll","srvcli.dll","System.dll","cfgmgr32.dll","wsock32.dll","avicap32.dll","msctf.dll","psapi.dll","shfolder.dll","propsys.dll","ws2_32.dll","crypt32.dll","usp10.dll","imm32.dll","mscorwks.dll","urlmon.dll","AcLayers.dll","Culture.dll","System.configuration.dll","msasn1.dll","System.Windows.Forms.dll","advapi32.dll","ole32.dll","profapi.dll","mscorlib.dll","KernelBase.dll","mscorjit.dll","clbcatq.dll","sspicli.dll","bcrypt.dll","nsi.dll","wkscli.dll","rpcrt4.dll","uxtheme.dll","iertutil.dll","System.ni.dll","System.Drawing.ni.dll","mpr.dll","mscorrc.dll","Wldap32.dll","System.Configuration.ni.dll","dwmapi.dll","ntdll.dll","System.Drawing.dll","rsaenh.dll","System.XML.dll","comctl32.dll","WSHTCPIP.DLL","mscoree.dll","gdi32.dll","lpk.dll","rpcss.dll","cryptsp.dll","devobj.dll","apphelp.dll","RpcRtRemote.dll","ntmarta.dll","mscorlib.ni.dll","System.Windows.Forms.ni.dll","System.Xml.ni.dll","msacm32.dll","setupapi.dll","kernel32.dll","version.dll","oleaut32.dll","wininet.dll","userenv.dll","ktmw32.dll","System.Core.dll","msvcrt.dll","mscoreei.dll","netapi32.dll","sechost.dll","shell32.dll","netutils.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"2017-11-15-4.dc","sha256":"859305c2f5ce0f8d7cb8f8958bbd94c2848305423b47bd8f87052f40f0d6a041","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]}],"files_written":[{"path":"C:\\scan_doc.exe.config","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index23b.dat","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Configuration\\2.0.0.0__b03f5f7f11d50a3a\\System.configuration.dll","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Xml\\2.0.0.0__b77a5c561934e089\\System.XML.dll","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"C:\\scan_doc.exe","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\bluetooth.exe.config","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index23c.dat","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\System32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\System32\\en-US\\schtasks.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\bluetooth.exe","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\System32\\en-US\\msvfw32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\System32\\en-US\\avicap32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%APPDATA%\\dclogs","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"path":"%APPDATA%\\dclogs\\2017-11-15-4.dc","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DC_MUTEX-JL4QHYB","sources":[{"report_type":"sandbox","report_id":"5a0ca6227ca3e1676f3c81c6"}]}]}},"report_ids":{"sandbox_job_ids":["5a0ca6227ca3e1676f3c81c6"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 5d4bab44624c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 5d4bab44624c…. Malware family: Trojan.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 12 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/5d4bab44624c21b8f72ce4a7ffea99dd3a74c290d37cfdb1f5e761e7ced5bcb2"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 5d4bab44624c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 5d4bab44624c…. Malware family: Trojan.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 12 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/5d4bab44624c21b8f72ce4a7ffea99dd3a74c290d37cfdb1f5e761e7ced5bcb2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 5d4bab44624c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 5d4bab44624c…. Malware family: Trojan.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 12 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]