26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4bc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample 71f4450d411d… — Score 70/100 — Hybrid Analysis","description":"Malicious verdict for sample 71f4450d411d…. Malware family: Win/malicious_confidence_90%. Threat score 70/100. 2/28 AV engines flagged this file. 2 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/71f4450d411d8d721f18e75713a5663299b3d770ffef61177e45b48cf3896d32","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","71f4450d411d8d721f18e75713a5663299b3d770ffef61177e45b48cf3896d32"],"about":{"@type":"SoftwareApplication","name":"patched_cm.exe","applicationCategory":["peexe","executable"],"identifier":"71f4450d411d8d721f18e75713a5663299b3d770ffef61177e45b48cf3896d32","additionalType":"Malicious sample"},"threatScore":70,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":2,"total":28},"behavioralIndicators":{"malicious":2,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T7e9,"" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")28:T745,"" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")29:T6da,"" touched file "C:\Windows\System32\rsaenh.dll" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Users\Yq2FYYc\AppData\Local\Microsoft\Windows\Temporary Internet Files" "" touched file "C:\Users\Yq2FYYc\AppData\Roaming\Microsoft\Windows\Cookies" "" touched file "C:\Users\Yq2FYYc\AppData\Local\Microsoft\Windows\History" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\index.dat" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat" "" touched file "C:\Windows\System32\en-US\urlmon.dll.mui" "" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "" touched file "C:\Windows\System32\msxml3r.dll" "" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat" "" touched file "C:\Windows\System32\en-US\crypt32.dll.mui" "" touched file "C:\Windows\System32\en-US\winhttp.dll.mui" "" touched file "C:\Windows\System32\en-US\setupapi.dll.mui" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "" touched file "%APPDATA%\Microsoft\Windows\Cookies" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "" touched file "%APPDATA%\Microsoft\Windows\Cookies\index.dat"2a:T4b8,Heuristic match: "pastebin.com" Pattern match: "https://secure.comodo.com/CPS0" Pattern match: "crl.comodoca4.com/COMODORSADomainValidationSecureServerCA2.crl0" Pattern match: "crt.comodoca4.com/COMODORSADomainValidationSecureServerCA2.crt0%" Pattern match: "http://ocsp.comodoca4.com0D" Heuristic match: "ssl509084.cloudflaressl.com" Heuristic match: "*.pastebin.com" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0r" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0%" Pattern match: "http://ocsp.comodoca4.com0" Pattern match: "crl.usertrust.com/AddTrustExternalCARoot.crl05" Pattern match: "http://ocsp.usertrust.com0" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.usertrust.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.comodoca4.com" Heuristic match: "ocsp.comodoca4.com"2b:T901,"" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")2c:T6db,Found malicious artifacts related to "104.20.208.21" (ASN: , Owner: ): ... URL: http://pastebin.com/e24DzD7S (AV positives: 3/63 scanned on 11/03/2017 10:37:51) URL: http://pastebin.com/raw.php?i=nafez67d (AV positives: 1/64 scanned on 11/02/2017 06:02:12) URL: http://pastebin.com/download.php?i=JKqwsAs6 (AV positives: 1/63 scanned on 11/02/2017 05:12:48) URL: http://pastebin.com/0uYiQ1sY (AV positives: 1/64 scanned on 10/31/2017 15:57:55) URL: http://pastebin.com/raw/Yv2kkWEM (AV positives: 2/64 scanned on 10/31/2017 01:49:36) File SHA256: c41fa51da61d7f00e14a5f6ae78dd768d2125212399d4f0fa10d17ad9a2e796b (Scanned on 11/06/2017 02:23:27) File SHA256: af43f4ba371ae1e3d94f41b473764b1b23ced2466d0654e6b14e7a1a4413392b (AV positives: 24/67 scanned on 11/05/2017 21:12:58) File SHA256: 165d3ce09272df27d38b1d136de740215af66379a1687083ab3e274e140eb3eb (AV positives: 1/67 scanned on 11/05/2017 17:06:41) File SHA256: 2ae756013b1d1469ef8baeadcf701ebfbc8e5b0edef94392f8b77bc462037b8c (AV positives: 9/67 scanned on 11/05/2017 10:30:46) File SHA256: bf2d91594334f635761ea321012ea6eb8644fabb4a4d8d4bc8f7f688d256dcba (AV positives: 9/65 scanned on 11/05/2017 08:07:04) File SHA256: 0cf023f3ab5b0f3cd617d65835df27606896bb645477b85ce8fc5e1a989c3a31 (Scanned on 11/05/2017 09:07:31) File SHA256: 8962c1af27dcc2d8c2915c86377ac694f41a8b128d1013a886b5ad40fcdbb7b8 (Scanned on 11/05/2017 08:59:12) File SHA256: 243b06f7429590a9b8e1e38ec7246cdf882e87ff098ef6fe7037f6202e36ab02 (Scanned on 11/05/2017 06:55:24) File SHA256: c98bb246ff9b6d2ad07e52a0f69d6757b16e088e3a86767d2f4d4160222d6df2 (AV positives: 8/66 scanned on 11/04/2017 17:28:48) File SHA256: 78eb7b04f5199272fa585626e7237f35d9a3d8121dc9206286a8042e76d5e533 (Scanned on 11/04/2017 20:37:46)2d:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"71f4450d411d8d721f18e75713a5663299b3d770ffef61177e45b48cf3896d32","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":70,"unified_at_epoch_ms":1790296862496,"unified_at":"2026-09-25T00:41:02.496Z","metadata":{"hashes":{"sha256":"71f4450d411d8d721f18e75713a5663299b3d770ffef61177e45b48cf3896d32","sha1":"3a707c26a7412fa63e8ec283ac755013e7fe2c48","md5":"2239640409aadd64b1dd5e6d0aee19dd","sha512":"f1c51a0ae3d2cfde8a53b95d449fc29e80e9f6528b221b313778079331894a5d65ee5bdf6d9e453411c254f22e9390ef16515d233a956ce42e1f00e1bc4ca6a1","ssdeep":"3072:ReZlP4rLxjoM7xxeN2ahWI4m0GX+Tuddvrh41pT/:8cLxjoV2ahWIxkn","ssdeep_chunks":["3072:ReZlP4r","3072:eZlP4rL","3072:ZlP4rLx","3072:lP4rLxj","3072:P4rLxjo","3072:4rLxjoM","3072:rLxjoM7","3072:LxjoM7x","3072:xjoM7xx","3072:joM7xxe","3072:oM7xxeN","3072:M7xxeN2","3072:7xxeN2a","3072:xxeN2ah","3072:xeN2ahW","3072:eN2ahWI","3072:N2ahWI4","3072:2ahWI4m","3072:ahWI4m0","3072:hWI4m0G","3072:WI4m0GX","3072:I4m0GX+","3072:4m0GX+T","3072:m0GX+Tu","3072:0GX+Tud","3072:GX+Tudd","3072:X+Tuddv","3072:+Tuddvr","3072:Tuddvrh","3072:uddvrh4","3072:ddvrh41","3072:dvrh41p","3072:vrh41pT","3072:rh41pT/","6144:ReZlP4r","6144:eZlP4rL","6144:ZlP4rLx","6144:lP4rLxj","6144:P4rLxjo","6144:4rLxjoM","6144:rLxjoM7","6144:LxjoM7x","6144:xjoM7xx","6144:joM7xxe","6144:oM7xxeN","6144:M7xxeN2","6144:7xxeN2a","6144:xxeN2ah","6144:xeN2ahW","6144:eN2ahWI","6144:N2ahWI4","6144:2ahWI4m","6144:ahWI4m0","6144:hWI4m0G","6144:WI4m0GX","6144:I4m0GX+","6144:4m0GX+T","6144:m0GX+Tu","6144:0GX+Tud","6144:GX+Tudd","6144:X+Tuddv","6144:+Tuddvr","6144:Tuddvrh","6144:uddvrh4","6144:ddvrh41","6144:dvrh41p","6144:vrh41pT","6144:rh41pT/","3072:8cLxjoV","3072:cLxjoV2","3072:LxjoV2a","3072:xjoV2ah","3072:joV2ahW","3072:oV2ahWI","3072:V2ahWIx","3072:2ahWIxk","3072:ahWIxkn"],"imphash":"08923e0d39060cab5e5c63e748720b50"},"file_info":{"file_name":"patched_cm.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":179200,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1509938901000,"last_seen":1677385296000,"last_multi_scan":1677385296000}},"detections":{"summary":{"verdict":"malicious","score":70,"tags":null},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":15,"suspicious_count":13,"malicious_count":2,"total":30},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_90%","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 45116-973-00412E9D","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$27","origin":"Registry Access","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$28","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.comodoca4.com\"\n \"pastebin.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.20.208.21:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\Cab807D.tmp\"\n \"\" created file \"%TEMP%\\Tar807E.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208\"\n \"Local\\!IETld!Mutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"IESQMMUTEX_0_208\"\n \"Local\\_!MSFTHISTORY!_\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\c:!users!yq2fyyc!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\c:!users!yq2fyyc!appdata!roaming!microsoft!windows!ietldcache!\"\n \"Local\\c:!users!yq2fyyc!appdata!roaming!microsoft!windows!cookies!\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\WininetStartupMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\c:!users!yq2fyyc!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"RasPbFile\"\n \"Local\\WininetProxyRegistryMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!yq2fyyc!appdata!roaming!microsoft!windows!cookies!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!yq2fyyc!appdata!local!microsoft!windows!history!history.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.comodoca4.com\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c pause\" on 2017-11-6.04:18:59.071","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c pause\" (UID: 00016883-00002940)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Tar807E.tmp\" has type \"data\"\n \"5080DC7A65DB6A5960ECD874088F3328_C7B398B93BFA7397A840C520A0E096A2\" has type \"data\"\n \"Cab807D.tmp\" has type \"Microsoft Cabinet archive data 50939 bytes 1 file\"\n \"5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$29","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2a","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"71f4450d411d8d721f18e75713a5663299b3d770ffef61177e45b48cf3896d32.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"71f4450d411d8d721f18e75713a5663299b3d770ffef61177e45b48cf3896d32.exe.bin\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"HARDWARE\\ACPI\\DSDT\\VBOX__\" (Indicator: \"vbox\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"\" called \"OpenSCManager\" requesting access rights \"0XE0000000L\"","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"\" called \"OpenService\" to access the \"gpsvc\" service\n \"\" called \"OpenService\" to access the \"WinHttpAutoProxySvc\" service\n \"\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"\" called \"OpenService\" to access the \"rasman\" service\n \"\" called \"OpenService\" to access the \"RASMAN\" service\n \"\" called \"OpenService\" to access the \"CryptSvc\" service\n \"\" called \"OpenService\" to access the \"cryptsvc\" service\n \"\" called \"OpenService\" to access the \"\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"\" called \"ControlService\" and sent control code \"0X24\" to the service \"gpsvc\"\n \"\" called \"ControlService\" and sent control code \"0XFC\" to the service \"gpsvc\"\n \"\" called \"ControlService\" and sent control code \"0X400\" to the service \"CryptSvc\"\n \"\" called \"ControlService\" and sent control code \"0X24\" to the service \"cryptsvc\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 1516)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$2b","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n RegOpenKeyA\n CryptEncrypt\n UnhandledExceptionFilter\n GetThreadContext\n CheckRemoteDebuggerPresent\n WriteFile\n OutputDebugStringW\n WriteProcessMemory\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryExW\n TerminateProcess\n GetModuleHandleExW\n CreateToolhelp32Snapshot\n LoadLibraryW\n Process32Next\n Process32First\n GetStartupInfoW\n ReadProcessMemory\n GetProcAddress\n CreateFileW\n VirtualAllocEx\n GetCommandLineA\n GetTickCount64\n GetModuleHandleA\n GetModuleHandleW\n GetFileAttributesExW\n CreateProcessA\n CreateProcessW\n Sleep\n VirtualAlloc\n InternetGetConnectedState\n InternetOpenUrlA\n InternetCloseHandle\n InternetOpenA\n InternetReadFile","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","origin":"Registry Access","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2c","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]}],"incidents":[{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":30,"imported_dlls_count":77,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":32,"files_deleted_count":0,"registry_keys_created_count":8,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":8,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"59ffd4f47ca3e14a6e074bd5","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":70,"contacted_countries":["GBR","USA"],"submit_name":"patched_cm.exe","analysis_start_time":"2017-11-06T04:17:30+00:00","indicators_count":{"informative":15,"suspicious":15,"malicious":2},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.20.208.21","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]}],"dns_resolutions":[{"domain":"ocsp.comodoca4.com","address":"178.255.83.1","country":"United Kingdom","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Comodo Group, Inc.","registrar_creation_date":"2014-09-24T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"domain":"pastebin.com","address":"104.20.209.21","country":"United States","registrar_name":"ENOM, INC.","registrar_organization":"WHOISGUARD, INC.","registrar_name_servers":"SUE.NS.CLOUDFLARE.COM","registrar_creation_date":"2002-09-03T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]}],"http_requests":[{"host":"ocsp.comodoca4.com","host_ip":"178.255.83.1:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.comodoca4.com","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}],"processes":[{"pid":2664,"ppid":0,"name":"71f4450d411d8d721f18e75713a5663299b3d770ffef61177e45b48cf3896d32.exe","command_line":"","sha256":"71f4450d411d8d721f18e75713a5663299b3d770ffef61177e45b48cf3896d32","normalized_path":"C:\\71f4450d411d8d721f18e75713a5663299b3d770ffef61177e45b48cf3896d32.exe","uid":"00014811-00002664","icon":"$2d"},{"pid":2940,"ppid":2664,"name":"cmd.exe","command_line":"/c pause","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014811-00002664","uid":"00016883-00002940","icon":"$2e"}],"all_imported_dlls":["msvcrt.dll","urlmon.dll","ntmarta.dll","mswsock.dll","clbcatq.dll","SensApi.dll","NapiNSP.dll","wship6.dll","setupapi.dll","crypt32.dll","winnsi.dll","rasapi32.dll","rasman.dll","gpapi.dll","dhcpcsvc6.dll","pnrpnsp.dll","WSHTCPIP.DLL","shlwapi.dll","nsi.dll","wintrust.dll","secur32.dll","bcryptprimitives.dll","wininet.dll","oleaut32.dll","cfgmgr32.dll","KernelBase.dll","advapi32.dll","rasadhlp.dll","npmproxy.dll","apphelp.dll","imm32.dll","cryptsp.dll","IPHLPAPI.DLL","ncrypt.dll","lpk.dll","rsaenh.dll","cryptbase.dll","profapi.dll","netprofm.dll","RpcRtRemote.dll","bcrypt.dll","devobj.dll","rpcrt4.dll","msctf.dll","schannel.dll","userenv.dll","ntdll.dll","gdi32.dll","sechost.dll","iertutil.dll","ws2_32.dll","rtutils.dll","nlaapi.dll","dnsapi.dll","winrnr.dll","dhcpcsvc.dll","msxml3.dll","devrtl.dll","Wldap32.dll","cabinet.dll","winbrand.dll","kernel32.dll","usp10.dll","comctl32.dll","sspicli.dll","shell32.dll","FWPUCLNT.DLL","version.dll","uxtheme.dll","credssp.dll","cryptnet.dll","winhttp.dll","webio.dll","user32.dll","ole32.dll","msasn1.dll","msxml3r.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"5080DC7A65DB6A5960ECD874088F3328_C7B398B93BFA7397A840C520A0E096A2","sha256":"8049e9024c61cc51df66be8b6ec1e5dce0b6d85d2e4cef5be6eeaed7fa592e98","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4","sha256":"65119b3833455c2480cd3045b26f62eaf055ed22c8ccf7e2629a2d4b025b7955","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"Cab807D.tmp","sha256":"c929701c67a05f90827563eedccf5eba8e65b2da970189a0371f28cd896708b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"Tar807E.tmp","sha256":"7e58975a4e1e86940f84e744709426939b85ae174dbbf020da3c893a54fd1da2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]}],"files_written":[{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%WINDIR%\\System32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_76125806E8CF735FD0B67DD73E892015","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\3B6E683A7A45CC59BF035C9BA8C7AB9D","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%WINDIR%\\System32\\en-US\\winhttp.dll.mui","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_4BEC010A0A187BC25AD2285001177F28","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC42971B7939A9CA55C44CFC893D7C1D","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_C7B398B93BFA7397A840C520A0E096A2","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_C7B398B93BFA7397A840C520A0E096A2","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"Local\\c:!users!yq2fyyc!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"Local\\c:!users!yq2fyyc!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"Local\\c:!users!yq2fyyc!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"Local\\c:!users!yq2fyyc!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!yq2fyyc!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!yq2fyyc!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!yq2fyyc!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!yq2fyyc!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59ffd4f47ca3e14a6e074bd5"}]}]}},"report_ids":{"sandbox_job_ids":["59ffd4f47ca3e14a6e074bd5"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_90% Sample 71f4450d411d… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 71f4450d411d…. Malware family: Win/malicious_confidence_90%. Threat score 70/100. 2/28 AV engines flagged this file. 2 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/71f4450d411d8d721f18e75713a5663299b3d770ffef61177e45b48cf3896d32"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_90% Sample 71f4450d411d… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 71f4450d411d…. Malware family: Win/malicious_confidence_90%. Threat score 70/100. 2/28 AV engines flagged this file. 2 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/71f4450d411d8d721f18e75713a5663299b3d770ffef61177e45b48cf3896d32"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_90% Sample 71f4450d411d… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 71f4450d411d…. Malware family: Win/malicious_confidence_90%. Threat score 70/100. 2/28 AV engines flagged this file. 2 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2f","11",{}]]