24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/grayware_confidence_100% Sample 6153f429c0ce… — Score 96/100 — Hybrid Analysis","description":"Malicious verdict for sample 6153f429c0ce…. Malware family: Win/grayware_confidence_100%. Threat score 96/100. 3/28 AV engines flagged this file. 4 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca","keywords":["Malicious","Win/grayware_confidence_100%","malware analysis","sandbox report","threat intelligence","6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca"],"about":{"@type":"SoftwareApplication","name":"MediaDownloaderIron.exe","applicationCategory":["peexe","executable"],"identifier":"6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca","additionalType":"Malicious sample"},"threatScore":96,"malwareFamily":"Win/grayware_confidence_100%","antivirusDetections":{"malicious":3,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T936,Antivirus vendors marked dropped file "_shfoldr.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows"), Antivirus vendors marked dropped file "isxdl.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-UA2Q3.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-6V0O6.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-71LD2.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"), Antivirus vendors marked dropped file "is-G935V.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-RA634.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-P1LJ6.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-I9NCL.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-HSA3A.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-L88PT.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-I4PTF.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"), Antivirus vendors marked dropped file "is-J3NAV.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-M1ANC.tmp" as clean (type is "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"), Antivirus vendors marked dropped file "is-SFM2O.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"), Antivirus vendors marked dropped file "is-SGK5Q.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-PR97D.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows")26:T764,"_shfoldr.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows" "MediaDownloader.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Icon number=0 Archive ctime=Fri Oct 13 03:15:09 2017 mtime=Fri Oct 13 03:15:09 2017 atime=Wed Nov 25 17:10:10 2015 length=762368 window=hide" "isxdl.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "is-UA2Q3.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-6V0O6.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-71LD2.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "is-G935V.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-RA634.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-P1LJ6.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-I9NCL.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-HSA3A.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-L88PT.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-I4PTF.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "is-J3NAV.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "unins000.dat" has type "data" "is-M1ANC.tmp" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "is-SFM2O.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "is-SGK5Q.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-PR97D.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-U3SJ2.tmp" has type "data"27:T8df,"" touched file "C:\Windows\system32\en-US\KERNELBASE.dll.mui" "" touched file "C:\Windows\system32\netmsg.dll" "" touched file "C:\Windows\system32\en-US\netmsg.dll.mui" "" touched file "C:\Windows\Globalization\Sorting\sortdefault.nls" "6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp" touched file "C:\Windows\Fonts\staticcache.dat" "6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp" touched file "C:\Windows\system32\en-US\user32.dll.mui" "6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp" touched file "C:\Windows\Globalization\Sorting\sortdefault.nls" "6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp" touched file "C:\Windows\system32\en-US\MSCTF.dll.mui" "6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp" touched file "C:\Windows\system32\en-US\KERNELBASE.dll.mui" "6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp" touched file "C:\Windows\system32\netmsg.dll" "6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp" touched file "C:\Windows\system32\en-US\netmsg.dll.mui" "6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp" touched file "C:\Windows\system32\shfolder.dll" "6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp" touched file "C:\Windows\system32\imageres.dll" "6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp" touched file "C:\Windows\system32\en-US\imageres.dll.mui" "6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp" touched file "C:\Windows\system32\en-US\shell32.dll.mui" "6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp" touched file "C:\Windows\system32\en-US\SETUPAPI.dll.mui" "6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp" touched file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MediaDownloader" "6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp" touched file "C:\Users\qyalPh3\AppData\Local\Microsoft\Windows\Caches" "6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp" touched file "C:\Users\qyalPh3\AppData\Local\Microsoft\Windows\Caches\cversions.1.db"28:T606,"_shfoldr.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows" "isxdl.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "is-UA2Q3.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-6V0O6.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-71LD2.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "is-G935V.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-RA634.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-P1LJ6.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-I9NCL.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-HSA3A.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-L88PT.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-I4PTF.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "is-J3NAV.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-M1ANC.tmp" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "is-SFM2O.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "is-SGK5Q.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-PR97D.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"29:T40a,"_shfoldr.dll" claimed CRC 36336 while the actual is CRC 5935949 "isxdl.dll" claimed CRC 141701 while the actual is CRC 36336 "is-UA2Q3.tmp" claimed CRC 92998 while the actual is CRC 141701 "is-6V0O6.tmp" claimed CRC 151044 while the actual is CRC 92998 "is-71LD2.tmp" claimed CRC 42974 while the actual is CRC 151044 "is-G935V.tmp" claimed CRC 42304 while the actual is CRC 42974 "is-RA634.tmp" claimed CRC 53176 while the actual is CRC 42304 "is-P1LJ6.tmp" claimed CRC 434901 while the actual is CRC 53176 "is-I9NCL.tmp" claimed CRC 43495 while the actual is CRC 434901 "is-HSA3A.tmp" claimed CRC 152831 while the actual is CRC 43495 "is-L88PT.tmp" claimed CRC 84412 while the actual is CRC 152831 "is-I4PTF.tmp" claimed CRC 150298 while the actual is CRC 84412 "is-J3NAV.tmp" claimed CRC 48918 while the actual is CRC 150298 "is-SFM2O.tmp" claimed CRC 93377 while the actual is CRC 763852 "is-SGK5Q.tmp" claimed CRC 217989 while the actual is CRC 93377 "is-PR97D.tmp" claimed CRC 90856 while the actual is CRC 2179892a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4iI5gAAAAAAAAePjwAAB4iIiOZoAAAAAAAH+PgHAHiIiI5miIAAAAAAB4+PCHB4iIiGaI/wAAAAAAf4+AeHiIiIho///wAAAAAHj48Id4iIiAD/+IgAAAAAB/j4B4eIiIAAB3eIAAAAAAePjwh3d3dwAAiHdwAAAAAH+PgHh/+I7gCI+IgAAAAAB///CHf47md4iI+IAAAAAAf//weHfuZ3iIiI8AAAAAAH//8IeH5meIiIiICIiIAAB///CIiHZ3iIiIgAAAiHAAf//wiIgHd4iIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH9ERERERET4cAAAAAd3dwB/TohmZszE+HAAAAAAf//wf0/ohmZsxPhwAAAAAAd3dw9O/ohmZsT4cAAAAAAAAAB/T+/ohmZk+HAAAAAAAAAAf07+/ohmZPhwAAAAAAAAAH9I7+/ohmT4cAAAAAAAAAB/SI7+/ohk+HAAAAAAAAAAf0iI7+/ohPhwAAAAAAAAAH9ERERERET4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":96,"unified_at_epoch_ms":1790301143391,"unified_at":"2026-09-25T01:52:23.391Z","metadata":{"hashes":{"sha256":"6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca","sha1":"18d9d619f6e30bcddc1bee29d296f9567acafc7e","md5":"6143c6761d236cd3ea1eb34283715c01","sha512":"94842a2c6e4226e967e48c3b6dab4f8b0dac78ed4876bd9b25d11eda0188cf07599d5406f68a958171f095e3fe7b12835c7843a9312a6942f222709e33283029","ssdeep":"98304:MeIobpmQF/KTc2RoBU37Lm6pPZn5p08jBSIxuVTa9ojiWf1LE8:lbpjFSI2Roe37Lm0TpTlS6uVT/eW9Lt","ssdeep_chunks":["98304:MeIobpm","98304:eIobpmQ","98304:IobpmQF","98304:obpmQF/","98304:bpmQF/K","98304:pmQF/KT","98304:mQF/KTc","98304:QF/KTc2","98304:F/KTc2R","98304:/KTc2Ro","98304:KTc2RoB","98304:Tc2RoBU","98304:c2RoBU3","98304:2RoBU37","98304:RoBU37L","98304:oBU37Lm","98304:BU37Lm6","98304:U37Lm6p","98304:37Lm6pP","98304:7Lm6pPZ","98304:Lm6pPZn","98304:m6pPZn5","98304:6pPZn5p","98304:pPZn5p0","98304:PZn5p08","98304:Zn5p08j","98304:n5p08jB","98304:5p08jBS","98304:p08jBSI","98304:08jBSIx","98304:8jBSIxu","98304:jBSIxuV","98304:BSIxuVT","98304:SIxuVTa","98304:IxuVTa9","98304:xuVTa9o","98304:uVTa9oj","98304:VTa9oji","98304:Ta9ojiW","98304:a9ojiWf","98304:9ojiWf1","98304:ojiWf1L","98304:jiWf1LE","98304:iWf1LE8","196608:MeIobpm","196608:eIobpmQ","196608:IobpmQF","196608:obpmQF/","196608:bpmQF/K","196608:pmQF/KT","196608:mQF/KTc","196608:QF/KTc2","196608:F/KTc2R","196608:/KTc2Ro","196608:KTc2RoB","196608:Tc2RoBU","196608:c2RoBU3","196608:2RoBU37","196608:RoBU37L","196608:oBU37Lm","196608:BU37Lm6","196608:U37Lm6p","196608:37Lm6pP","196608:7Lm6pPZ","196608:Lm6pPZn","196608:m6pPZn5","196608:6pPZn5p","196608:pPZn5p0","196608:PZn5p08","196608:Zn5p08j","196608:n5p08jB","196608:5p08jBS","196608:p08jBSI","196608:08jBSIx","196608:8jBSIxu","196608:jBSIxuV","196608:BSIxuVT","196608:SIxuVTa","196608:IxuVTa9","196608:xuVTa9o","196608:uVTa9oj","196608:VTa9oji","196608:Ta9ojiW","196608:a9ojiWf","196608:9ojiWf1","196608:ojiWf1L","196608:jiWf1LE","196608:iWf1LE8","98304:lbpjFSI","98304:bpjFSI2","98304:pjFSI2R","98304:jFSI2Ro","98304:FSI2Roe","98304:SI2Roe3","98304:I2Roe37","98304:2Roe37L","98304:Roe37Lm","98304:oe37Lm0","98304:e37Lm0T","98304:37Lm0Tp","98304:7Lm0TpT","98304:Lm0TpTl","98304:m0TpTlS","98304:0TpTlS6","98304:TpTlS6u","98304:pTlS6uV","98304:TlS6uVT","98304:lS6uVT/","98304:S6uVT/e","98304:6uVT/eW","98304:uVT/eW9","98304:VT/eW9L","98304:T/eW9Lt"],"imphash":"884310b1928934402ea6fec1dbd3cf5e"},"file_info":{"file_name":"MediaDownloaderIron.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":5892175,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499287984000,"last_seen":1676863399000,"last_multi_scan":1676863399000}},"detections":{"summary":{"verdict":"malicious","score":96,"tags":["pua"]},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":19,"suspicious_count":11,"malicious_count":4,"total":34},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Application.Agent.BDI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/grayware_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/grayware_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.DLL at 00308796-00002340-23441-170-0040102C\n GetSystemTime@KERNEL32.DLL at 00308796-00002340-23441-235-004026C4\n GetSystemTime@KERNEL32.DLL at 00308796-00002340-28541-161-004026C4\n GetSystemTime@KERNEL32.DLL at 00308796-00002340-28541-116-0040102C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"56c637b5aac2edce2e7b23c7"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"OLEAUT32.DLL\" at base 77510000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"56c637b5aac2edce2e7b23c7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"56c637b5aac2edce2e7b23c7"},{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"MediaDownloaderIron.exe.bin\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"56c637b5aac2edce2e7b23c7"},{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00308796-00002340-23441-99-00405CF4\n GetVersionExA@KERNEL32.DLL at 00308796-00002340-28541-189-00405CF4","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"56c637b5aac2edce2e7b23c7"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00308796-00002340-23441-79-00409C34\n FindResourceA@KERNEL32.DLL at 00308796-00002340-28541-387-00409C34","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"56c637b5aac2edce2e7b23c7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"VirtualAlloc\n GetModuleHandleA\n GetCommandLineA\n WriteFile\n GetFileSize\n CreateFileA\n RegOpenKeyExA\n RegCloseKey\n OpenProcessToken\n VirtualProtect\n Sleep\n LockResource\n LoadLibraryA\n GetVersionExA\n GetProcAddress\n GetModuleFileNameA\n GetFileAttributesA\n FindResourceA\n DeleteFileA\n CreateProcessA\n CreateDirectoryA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"56c637b5aac2edce2e7b23c7"},{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"56c637b5aac2edce2e7b23c7"},{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"56c637b5aac2edce2e7b23c7"},{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/54 Antivirus vendors marked sample as malicious (7% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"56c637b5aac2edce2e7b23c7"},{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 50347-717-1000C748","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".reloc\" is zero\n Raw size of \".bss\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 50347-1310-10015337","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\6153F429C0CEDC721846E60255834AE0F43829CC6A387B766DE6F301DAB54ECA.TMP\")\n \"6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\6153F429C0CEDC721846E60255834AE0F43829CC6A387B766DE6F301DAB54ECA.TMP\")\n \"6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{4F44DC3F-AE62-4AB1-114B-AA223C512F9B}_IS1\")\n \"6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{4F44DC3F-AE62-4AB1-114B-AA223C512F9B}_IS1\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"d:\\PROJECTS\\IRONSOURCE\\Media Player\\FlvPlayer.Core.Interops\\obj\\Release\\MediaDownloader.Core.Interops.pdb\"\n \"d:\\PROJECTS\\IRONSOURCE\\Media Player\\FlvPlayer.Wpf\\obj\\x86\\Release\\MediaDownloader.Wpf.pdb\"\n \"d:\\Bjornar\\SVN\\istool\\isxdl\\trunk\\source\\Release\\isxdl.pdb\"\n \"d:\\PROJECTS\\IRONSOURCE\\Media Player\\FlvPlayer\\obj\\x86\\Release\\MediaDownloader.pdb\"\n \"d:\\PROJECTS\\IRONSOURCE\\Media Player\\FlvPlayer.Core\\obj\\Release\\MediaDownloader.Core.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\is-OB0R3.tmp\\6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp\"\n \"6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp\" created file \"%TEMP%\\is-RESC1.tmp\\_isetup\\_shfoldr.dll\"\n \"6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp\" created file \"%TEMP%\\is-RESC1.tmp\\isxdl.dll\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"\n \"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n \"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$25","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 699C0000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp\" with commandline \"/SL5=\"$101A0\n5635986\n56832\nC:\\6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.exe\"\" (UID: 00014507-00003644)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$26","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"ButtonPlayYoutubeSample\" (Indicator: \"youtube\")\n \"b__1\" (Indicator: \"youtube\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.exe.bin\" was detected as \"Borland Delphi 4.0\"\n \"isxdl.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"is-71LD2.tmp\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"is-I4PTF.tmp\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"is-M1ANC.tmp\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"is-SFM2O.tmp\" was detected as \"Microsoft visual C# / Basic .NET\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 16 calls to GetProcAddress@KERNEL32.dll at 50347-678-1000920C","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rdata with unusual entropies 7.48456198912","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp\" called \"OpenService\" to access the \"ServicesActive\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"$28","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"11.11.29.0\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$29","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"malicious","category":"Installation/Persistance","name":"Scans for the windows taskbar (often used for explorer injection)","description":"\"6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":5,"id":"api-17","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 1500 bytes to a remote process \"%TEMP%\\is-OB0R3.tmp\\6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp\" (Handle: 164)\n \"\" wrote 4 bytes to a remote process \"%TEMP%\\is-OB0R3.tmp\\6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp\" (Handle: 164)\n \"\" wrote 32 bytes to a remote process \"%TEMP%\\is-OB0R3.tmp\\6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp\" (Handle: 164)\n \"\" wrote 52 bytes to a remote process \"%TEMP%\\is-OB0R3.tmp\\6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp\" (Handle: 164)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":78,"dropped_files_count":0,"extracted_files_count":22,"files_written_count":79,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["pua"],"sample_flags":["Sample Crashed","Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"589a2329aac2ed876a2a6e8d","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":96,"malware_family":"PUP.Optional","submit_name":"YhpI8QbSUpQNX03Z44i0LwyMb9iIidQRwd4shAprY05daUVm2w_9Y0jJRLcJt9Ow50yyEUjjHShKjmgfiDNUXH5t9D72WdL8nkMPbB486AgkGczcLYvZYwJXfjXLXbvDxNvl5vY3LrQst1gljQ3X20KqDx8me06GEbSDR0xmG3qLvhmhrabemGqw50tfV4XdlCVqhemapxnG2yaD3mEHC_TLeQejpGwK8QZDyFWsRmnMyEInf8A2q_SsJvQ8biX","analysis_start_time":"2017-10-12T21:12:56+00:00","indicators_count":{"informative":17,"suspicious":13,"malicious":4},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"56c637b5aac2edce2e7b23c7","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":21,"malware_family":"Eorezo","submit_name":"MediaDownloaderIron.exe","analysis_start_time":"2016-02-18T15:29:43+00:00","indicators_count":{"informative":4,"suspicious":5,"malicious":2},"tags":["Sample Crashed"],"is_in_unified_schema":true},{"id":"5697aa410e316d192d510f83","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":63,"malware_family":"Adware.Eorezo","submit_name":"MediaDownloaderIron.exe","analysis_start_time":"2016-01-14T08:03:49+00:00","indicators_count":{"informative":13,"suspicious":16,"malicious":6},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}],"processes":[{"pid":3612,"ppid":0,"name":"6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.exe","command_line":"","sha256":"6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca","normalized_path":"C:\\6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.exe","uid":"00014376-00003612","icon":"$2a"},{"pid":3644,"ppid":3612,"name":"6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp","command_line":"/SL5=\"$101A0,5635986,56832,C:\\6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.exe\"","normalized_path":"%TEMP%\\is-OB0R3.tmp\\6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp","parent_uid":"00014376-00003612","uid":"00014507-00003644","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB7klEQVR42u2XzYrqMBiG5w5FdOeleBsiWLs8unfhHYg7F4J/iHjc+DszbRfaf/ue8yV0qh2DTeLs5oMXWmjyPGnyFfr29lu/lavpdIr9fo/T6YTD4VAw/PntdovhcIhSqQRlgdlshiRJoFJRFIHGk0SlUoGyQBAEbEISSZIrrldRYsRxFqrVaoXlconJZIJyuQxNATE4D08FNpu/2O127H48HqNWq0FZoMiqs0RsDK1+vV6za9u2MRgMUK1WISXg+75QQARPBebzObrdP//TRafTQa/XQ7/ff5WAGE4HkJLW8XhkMqPRiEloCsRCeArOEiIMw7tOWiwWOgLPV30LTwV4aJ4El8tFVUAHHrCQgOM4sgIee4XPX3kemoGpkyg0j+PYcgKelxeIlOBB4LNviaaAHDwT8F8hoAdPBeiDJCngsoGiFhOD7wXoMFMn2bYlL0ADi5zy/J7fwrlALC/gunkBNTh1k6ZAKA3nAt5XNATiAm0mXvmtgGUpCFALFjnlIjCFuom6yLI+dQSKwL+DeVwdgfBpiz2CcwH3K4oCFzawyCl/vPoXCejClQTov+B8PrP953AvJ+B+C20ZST9KGEb4+HiXE/iJKixQr9fRbDZhmm202zyGkV4bdzEMSuthWi0e0zTRaDTU/5R+uv4BptK4NzAQLaQAAAAASUVORK5CYII="}],"all_imported_dlls":["ole32.dll","uxtheme.dll","kernel32.dll","LPK.dll","IMM32.DLL","PSAPI.DLL","dwmapi.dll","CRYPTBASE.dll","msvcrt.dll","sechost.dll","comctl32.dll","RPCRT4.dll","USP10.dll","advapi32.dll","GDI32.dll","DEVOBJ.dll","SspiCli.dll","user32.dll","SETUPAPI.dll","CFGMGR32.dll","shell32.dll","KERNELBASE.dll","VERSION.dll","oleaut32.dll","MSCTF.dll","SHLWAPI.dll","ntdll.dll","netmsg.dll","profapi.dll","bcrypt.dll","dui70.dll","setupapi.dll","gdi32.dll","devrtl.dll","cryptbase.dll","ncrypt.dll","urlmon.dll","crypt32.dll","imageres.dll","sspicli.dll","ntmarta.dll","shfolder.dll","sfc_os.dll","linkinfo.dll","srvcli.dll","cscapi.dll","version.dll","sfc.dll","netutils.dll","Wldap32.dll","isxdl.dll","ExplorerFrame.dll","lpk.dll","mpr.dll","apphelp.dll","rpcss.dll","_shfoldr.dll","ntshrui.dll","rpcrt4.dll","usp10.dll","duser.dll","cfgmgr32.dll","shlwapi.dll","comdlg32.dll","wininet.dll","tiptsf.dll","KernelBase.dll","RstrtMgr.dll","devobj.dll","msctf.dll","slc.dll","imm32.dll","clbcatq.dll","msasn1.dll","bcryptprimitives.dll","riched20.dll","iertutil.dll","propsys.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"is-6V0O6.tmp","sha256":"136ff7a4d8ccb9cd48aeccc8442e0b61781aec79b21497954e4187b82fd6b904","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"is-G935V.tmp","sha256":"325b8cf0cdc7a31d487420a1083f7cc28ce3402ffc5b17015c497956b36dfc3d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"is-HSA3A.tmp","sha256":"94fc067378d6e3a4dddd78a3eb52574607270e01e689c4f53133251e07ccee2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"_shfoldr.dll","sha256":"9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"isxdl.dll","sha256":"b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"MediaDownloader.lnk","sha256":"512fc64d6882d3516622454c88b4020cf84fc6e3c314b1c65ddf04fa50104782","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"is-4J4JA.tmp","sha256":"dc2812ed097a3725e8a72b6c113eb8e314ec2bd2184d16213ebf106e2d6782c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"is-4UMOH.tmp","sha256":"e228398eecb2760c040e4e17bccc36b687494ba764eec71660cfa5c8f8eaa7af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"is-7CASE.tmp","sha256":"9ad9ae8fbf8d907ea4ba7a6294afb1fd4eb469265fb272817747d391dff025dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"is-7PSRA.tmp","sha256":"3df285b09fe4e5559e6c1d13193e643ba8dbe71433f8305e357c56328a77b7a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"is-APMIA.tmp","sha256":"ba4bef86b396ba9ff62bd1c78f2dffe63b01d117015f6208515a46f12a23f871","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"is-P384P.tmp","sha256":"4985c46f6949f3db5c20933a89fb072ab101d00b0156bb9eff72944db621ae08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"is-9Q0RU.tmp","sha256":"e509b1e4fa53e803a48d21e56c631ab085a9a2886e4ad013109e346187b1ad4c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"is-CNQ3L.tmp","sha256":"3587556719d9246381cd7ba27271214178417951f731fa4d135fb8b815434b83","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"is-0343V.tmp","sha256":"e2f56e0b1b1fac0578fed46893c65d963a77998393e5e6c730fb4029bf0efb74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"is-35TKF.tmp","sha256":"da18b9f3fba9e80dc3355b001fb8c0847109f079cb97346166e88130504c210d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"is-AAM91.tmp","sha256":"fe9cd04adec1540c2b45983b7939e3dc640bc484e60cd2843bc3d5e605faded5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"is-DC84U.tmp","sha256":"e4ded69c2fbafd1f32c5743f31327ef4fa4476a9dc35d1db76d7f25a052e93a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"is-EITCT.tmp","sha256":"5e4a97f4301ef20f4903ec92889b48821da9d4cabda57dc037027a52c20b7ef1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"is-F2N9G.tmp","sha256":"8376119d63239e052786496090d9bbae216cf49e41f9f22d01cb5611d98888d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"is-FP2DD.tmp","sha256":"a3cf4dca4f571c90e792612d0cafbba2b995f47b375d5e598431e37a5d8df14e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"is-G5CMV.tmp","sha256":"9c934d1edbf8ea631b706cd5d7f61b358580f45f596bee502758290ed0d0fb3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]}],"files_written":[{"path":"%WINDIR%\\system32\\netmsg.dll","sources":[{"report_type":"sandbox","report_id":"56c637b5aac2edce2e7b23c7"},{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%SAMPLEDIR%\\MediaDownloaderIron.exe","sources":[{"report_type":"sandbox","report_id":"56c637b5aac2edce2e7b23c7"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"56c637b5aac2edce2e7b23c7"},{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"56c637b5aac2edce2e7b23c7"},{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%WINDIR%\\system32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"56c637b5aac2edce2e7b23c7"},{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%WINDIR%\\system32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%WINDIR%\\system32\\en-US\\netmsg.dll.mui","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%LOCALAPPDATA%\\Programs","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%LOCALAPPDATA%\\Programs\\Common","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"C:\\6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.exe","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%WINDIR%\\system32\\en-US\\imageres.dll.mui","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%WINDIR%\\system32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\axvlc.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter\\libdtstospdif_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_output\\libaout_directx_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter\\libcompressor_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter\\libugly_resampler_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter\\liba52tospdif_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter\\libmono_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter\\libnormvol_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter\\libtrivial_channel_mixer_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\video_output\\libvmem_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\MediaDownloader.Core.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\access_output\\libaccess_output_file_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter\\liba52tofloat32_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter\\libdolby_surround_decoder_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter\\libsamplerate_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_mixer\\libfixed32_mixer_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_mixer\\libfloat32_mixer_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\npvlc.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter\\libconverter_fixed_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter\\libscaletempo_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\MediaDownloader.Core.Interops.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\MediaDownloader.Wpf.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter\\libaudio_format_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter\\libchorus_flanger_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter\\libheadphone_channel_mixer_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter\\libkaraoke_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter\\libsimple_channel_mixer_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_output\\libwaveout_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\codec\\libavcodec_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter\\libaudiobargraph_a_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter\\libmpgatofixed32_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\video_filter\\libswscale_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\access\\libfilesystem_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter\\libequalizer_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter\\libparam_eq_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter\\libspatializer_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\libvlccore.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter\\libdtstofloat32_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter\\libspeex_resampler_plugin.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\libvlc.dll","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%TEMP%\\is-OB0R3.tmp\\6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca.tmp","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\access","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\access_output","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_filter","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_mixer","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\audio_output","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\codec","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\video_filter","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\Libraries\\plugins\\video_output","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\MediaDownloader","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\MediaDownloader.exe","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\MediaDownloader\\MediaDownloader.lnk","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"path":"%PROGRAMFILES%\\MediaDownloader\\unins000.dat","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"589a2329aac2ed876a2a6e8d"}]}]}},"report_ids":{"sandbox_job_ids":["589a2329aac2ed876a2a6e8d","5697aa410e316d192d510f83","56c637b5aac2edce2e7b23c7"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/grayware_confidence_100% Sample 6153f429c0ce… — Score 96/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6153f429c0ce…. Malware family: Win/grayware_confidence_100%. Threat score 96/100. 3/28 AV engines flagged this file. 4 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/grayware_confidence_100% Sample 6153f429c0ce… — Score 96/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6153f429c0ce…. Malware family: Win/grayware_confidence_100%. Threat score 96/100. 3/28 AV engines flagged this file. 4 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6153f429c0cedc721846e60255834ae0f43829cc6a387b766de6f301dab54eca"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/grayware_confidence_100% Sample 6153f429c0ce… — Score 96/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6153f429c0ce…. Malware family: Win/grayware_confidence_100%. Threat score 96/100. 3/28 AV engines flagged this file. 4 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]