26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 756c4cb7f88e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 756c4cb7f88e…. Malware family: Trojan.Generic. Threat score 100/100. 26/28 AV engines flagged this file. 13 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/756c4cb7f88e0dd37f460037b9e43a59a1677234a5f491b26195a8950629d748","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","756c4cb7f88e0dd37f460037b9e43a59a1677234a5f491b26195a8950629d748"],"about":{"@type":"SoftwareApplication","name":"56h4g3b5yh.exe","applicationCategory":["peexe","executable"],"identifier":"756c4cb7f88e0dd37f460037b9e43a59a1677234a5f491b26195a8950629d748","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":26,"total":28},"behavioralIndicators":{"malicious":13,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T41d,"\Sessions\1\BaseNamedObjects\IESQMMUTEX_0_208" "\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "\Sessions\1\BaseNamedObjects\Local\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\{92b51f17-8d1b-35d1-ec93-e229fc3e6ce7}" "\Sessions\1\BaseNamedObjects\Global\92b51f178d1b35d1ec93e229fc3e6ce7" "\Sessions\1\BaseNamedObjects\RasPbFile"28:T901,"" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")29:T69d,"" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS")2a:T4cf,"" loaded module "NORMALIZ.DLL" at base 75A50000 "" loaded module "CRYPT32.DLL" at base 750D0000 "" loaded module "USERENV.DLL" at base 74690000 "" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77040000 "" loaded module "WINTRUST.DLL" at base 75240000 "" loaded module "WININET.DLL" at base 768D0000 "" loaded module "RASAPI32.DLL" at base 72A40000 "" loaded module "RTUTILS.DLL" at base 73600000 "" loaded module "PROFAPI.DLL" at base 75030000 "" loaded module "RASMAN.DLL" at base 72A20000 "" loaded module "SHLWAPI.DLL" at base 76B30000 "" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 77040000 "" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 77040000 "" loaded module "SENSAPI.DLL" at base 6E420000 "" loaded module "CRYPTBASE.DLL" at base 74F80000 "" loaded module "RPCRT4.DLL" at base 75410000 "" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 73550000 "" loaded module "IPHLPAPI.DLL" at base 746000002b:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=2c:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"756c4cb7f88e0dd37f460037b9e43a59a1677234a5f491b26195a8950629d748","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790827001346,"unified_at":"2026-10-01T03:56:41.346Z","metadata":{"hashes":{"sha256":"756c4cb7f88e0dd37f460037b9e43a59a1677234a5f491b26195a8950629d748","sha1":"239eee0fc7993bf752a71029820de432e9178766","md5":"912a16dfeb25668f0e6ee5d6ec6746d8","sha512":"1cc616c60174667bcf524cf8a94f3283fa053f97728483f254e9ec2b3ab6a6a335cd70bb76423468eaffa7330638f287fcbc670d8f315bca1728f640cb8170ed","ssdeep":"1536:JCLNkeQrHVYuZ9J8jFgjztQY7oE2hgkL6LERK40w0vYfNT5vNs9C0wIf:4keQrqujJ8KzXjGgk2ERK40w0vYvvM","ssdeep_chunks":["1536:JCLNkeQ","1536:CLNkeQr","1536:LNkeQrH","1536:NkeQrHV","1536:keQrHVY","1536:eQrHVYu","1536:QrHVYuZ","1536:rHVYuZ9","1536:HVYuZ9J","1536:VYuZ9J8","1536:YuZ9J8j","1536:uZ9J8jF","1536:Z9J8jFg","1536:9J8jFgj","1536:J8jFgjz","1536:8jFgjzt","1536:jFgjztQ","1536:FgjztQY","1536:gjztQY7","1536:jztQY7o","1536:ztQY7oE","1536:tQY7oE2","1536:QY7oE2h","1536:Y7oE2hg","1536:7oE2hgk","1536:oE2hgkL","1536:E2hgkL6","1536:2hgkL6L","1536:hgkL6LE","1536:gkL6LER","1536:kL6LERK","1536:L6LERK4","1536:6LERK40","1536:LERK40w","1536:ERK40w0","1536:RK40w0v","1536:K40w0vY","1536:40w0vYf","1536:0w0vYfN","1536:w0vYfNT","1536:0vYfNT5","1536:vYfNT5v","1536:YfNT5vN","1536:fNT5vNs","1536:NT5vNs9","1536:T5vNs9C","1536:5vNs9C0","1536:vNs9C0w","1536:Ns9C0wI","1536:s9C0wIf","3072:JCLNkeQ","3072:CLNkeQr","3072:LNkeQrH","3072:NkeQrHV","3072:keQrHVY","3072:eQrHVYu","3072:QrHVYuZ","3072:rHVYuZ9","3072:HVYuZ9J","3072:VYuZ9J8","3072:YuZ9J8j","3072:uZ9J8jF","3072:Z9J8jFg","3072:9J8jFgj","3072:J8jFgjz","3072:8jFgjzt","3072:jFgjztQ","3072:FgjztQY","3072:gjztQY7","3072:jztQY7o","3072:ztQY7oE","3072:tQY7oE2","3072:QY7oE2h","3072:Y7oE2hg","3072:7oE2hgk","3072:oE2hgkL","3072:E2hgkL6","3072:2hgkL6L","3072:hgkL6LE","3072:gkL6LER","3072:kL6LERK","3072:L6LERK4","3072:6LERK40","3072:LERK40w","3072:ERK40w0","3072:RK40w0v","3072:K40w0vY","3072:40w0vYf","3072:0w0vYfN","3072:w0vYfNT","3072:0vYfNT5","3072:vYfNT5v","3072:YfNT5vN","3072:fNT5vNs","3072:NT5vNs9","3072:T5vNs9C","3072:5vNs9C0","3072:vNs9C0w","3072:Ns9C0wI","3072:s9C0wIf","1536:4keQrqu","1536:keQrquj","1536:eQrqujJ","1536:QrqujJ8","1536:rqujJ8K","1536:qujJ8Kz","1536:ujJ8KzX","1536:jJ8KzXj","1536:J8KzXjG","1536:8KzXjGg","1536:KzXjGgk","1536:zXjGgk2","1536:XjGgk2E","1536:jGgk2ER","1536:Ggk2ERK","1536:gk2ERK4","1536:k2ERK40","1536:2ERK40w","1536:40w0vYv","1536:0w0vYvv","1536:w0vYvvM"],"imphash":"e02e08cb0432bbb2f7ce10858c79a3ea"},"file_info":{"file_name":"56h4g3b5yh.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":151552,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499295644000,"last_seen":1623731711000,"last_multi_scan":1623731711000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":26,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":12,"suspicious_count":20,"malicious_count":13,"total":45},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Cridex.tneq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Dridex","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.434662","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.3106050","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Heur.089","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Dridex.ZCCH-3517","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.3106050 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Dridex.AA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!EB2CE0CF8909D871","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dridex","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004d86461 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.Cridex.el","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.yf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dridex.ebcudy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Backdoor.Drixed","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Threat-Generic://Suspicious-Confidence_83","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Dridex-RL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan.Cridex","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"malicious","threat_name":"TSPY_DRIDEX.THC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"malicious","threat_name":"TSPY_DRIDEX.THC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.CryptoLocky.R","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.TrojanPSW.Coins","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Dridex.Win32.520","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts server","description":"\"195.169.147.26:4843\"\n \"64.76.19.251:4243\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\CabD9E6.tmp\"\n \"\" created file \"%TEMP%\\TarD9E7.tmp\"\n \"\" created file \"%TEMP%\\CabDCF5.tmp\"\n \"\" created file \"%TEMP%\\TarDD06.tmp\"\n \"\" created file \"%TEMP%\\CabFF16.tmp\"\n \"\" created file \"%TEMP%\\TarFF26.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$27","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"informative","category":"General","name":"Reads System Certificates Settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA\", Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\109F1CAED645BB78B3EA2B94C0697C740733031C\", Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\D559A586669B08F46A30A133F8A9ED3D038E2EA8\", Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\", Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\A377D1B1C0538833035211F4083D00FECC414DAB\", Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6\", Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\7D7F4414CCEF168ADF6BF40753B5BECD78375931\", Key: \"BLOB\")","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\", Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c schtasks.exe /Create /F /TN \"User_Feed_Synchronization-{9712f853-b0ba-45bc-4a15-20f339cef2ee}\" /SC minute /MO 10 /TR \"rundll32.exe %LOCALAPPDATA%\\ow\\fdk23A.tmp qtwsIJePYeN\"\" on 2016-3-17.02:27:20.351","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c schtasks.exe /Create /F /TN \"User_Feed_Synchronization-{9712f853-b0ba-45bc-4a15-20f339cef2ee}\" /SC minute /MO 10 /TR \"rundll32.exe %LOCALAPPDATA%\\ow\\fdk23A.tmp qtwsIJePYeN\"\" (UID: 00021015-00003320)\n Spawned process \"taskhost.exe\" (UID: 00021023-00001384)\n Spawned process \"schtasks.exe\" with commandline \"/Create /F /TN \"User_Feed_Synchronization-{9712f853-b0ba-45bc-4a15-20f339cef2ee}\" /SC minute /MO 10 /TR \"rundll32.exe %LOCALAPPDATA%\\ow\\fdk23A.tmp qtwsIJePYeN\"\" (UID: 00021030-00003152)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df.21147492\" has type \"data\"\n \"64_76_19_251[1].txt.1047927208\" has type \"data\"\n \"TarD9E7.tmp.1121651124\" has type \"data\"\n \"TarDD06.tmp.1188760020\" has type \"data\"\n \"94308059B57B3142E455B38A6EB92015.2129031150\" has type \"data\"\n \"CabD9E6.tmp.2285527444\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"CabFF16.tmp.2285528340\" has type \"Microsoft Cabinet archive data, 49661 bytes, 1 file\"\n \"CabDCF5.tmp.2285528756\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"195_169_147_26[1].txt.2626534568\" has type \"data\"\n \"TarFF26.tmp.3067809108\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"ht34\n D7Y[ ot with unusual entropies 7.63666251975\n 7.613004913","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\", Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\"\n \"\" created file \"C:\\Windows\\system32\\rsaenh.dll\"\n \"\" created file \"C:\\Windows\\system32\\en-US\\KERNELBASE.dll.mui\"\n \"\" created file \"C:\\Windows\\system32\\en-US\\WINHTTP.dll.mui\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S9Y0GKU4\\195_169_147_26[1].txt\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QA0UPEJW\\195_169_147_26[1].txt\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S9Y0GKU4\\64_76_19_251[1].txt\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00014119-00001728-20689-107-00828316\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00014119-00001728-20689-108-008281B3\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00014119-00001728-20689-114-00824612\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00014119-00001728-25227-114-00824612\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00014119-00001728-25227-108-008281B3\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00014119-00001728-25227-107-00828316","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\56h4g3b5yh.exe\" marked \"%TEMP%\\CabD9E6.tmp\" for deletion\n \"C:\\56h4g3b5yh.exe\" marked \"%TEMP%\\TarD9E7.tmp\" for deletion\n \"C:\\56h4g3b5yh.exe\" marked \"%TEMP%\\CabDCF5.tmp\" for deletion\n \"C:\\56h4g3b5yh.exe\" marked \"%TEMP%\\TarDD06.tmp\" for deletion\n \"C:\\56h4g3b5yh.exe\" marked \"%TEMP%\\CabFF16.tmp\" for deletion\n \"C:\\56h4g3b5yh.exe\" marked \"%TEMP%\\TarFF26.tmp\" for deletion\n \"C:\\56h4g3b5yh.exe\" marked \"Z:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QA0UPEJW\\195_169_147_26[1].txt\" for deletion\n \"C:\\56h4g3b5yh.exe\" marked \"Z:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S9Y0GKU4\\195_169_147_26[1].txt\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\CabD9E6.tmp\" with delete access\n \"\" opened \"%TEMP%\\TarD9E7.tmp\" with delete access\n \"\" opened \"%TEMP%\\CabDCF5.tmp\" with delete access\n \"\" opened \"%TEMP%\\TarDD06.tmp\" with delete access\n \"\" opened \"%TEMP%\\CabFF16.tmp\" with delete access\n \"\" opened \"%TEMP%\\TarFF26.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QA0UPEJW\\195_169_147_26[1].txt\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S9Y0GKU4\\195_169_147_26[1].txt\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$28","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"56h4g3b5yh.exe.bin\" claimed CRC 187056 while the actual is CRC 189385","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"4053257758582677186a2677653c27770000000000bff9760000000056ccf976000000007ccaf97600000000376862756a2c2777d62d277700000000206962750000000029a6f97600000000a48d627500000000f70ef97600000000\" to virtual address \"0x773A1000\" (part of module \"NSI.DLL\")\n \"\" wrote bytes \"7739237779a82777be722777d62d27771de2227705a22777c868267757d12d77bee32277616f2777684125770050257700000000ad37f1768b2df176b641f17600000000\" to virtual address \"0x74DA1000\" (part of module \"WSHIP6.DLL\")\n \"\" wrote bytes \"92e6227779a82777be722777d62d27771de2227705a22777bee32277616f2777684125770050257700000000ad37f1768b2df176b641f17600000000\" to virtual address \"0x74881000\" (part of module \"WSHTCPIP.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"56h4g3b5yh.exe.bin\" claims program is from Thu Jan 1 01:08:17 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/56 Antivirus vendors marked sample as malicious (8% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated memory in \"%WINDIR%\\explorer.exe\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00020530-00001492)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"64.76.19.251\" (ASN: 3549, Owner: Level 3 Communications, Inc.): ...\nURL: http://64.76.19.251/ (AV positives: 6/67 scanned on 03/17/2016 08:22:57)\n URL: http://64.76.19.251/dridex/220/initial-c2/ (AV positives: 5/67 scanned on 03/12/2016 10:14:48)\n URL: https://64.76.19.251:4243/dridex/220/initial-c2/ (AV positives: 4/67 scanned on 03/12/2016 09:53:18)\n URL: http://64.76.19.251/dridex/220/initial-c2 (AV positives: 3/67 scanned on 03/10/2016 02:55:38)\n URL: https://64.76.19.251:4243/dridex/220/initial-c2 (AV positives: 3/67 scanned on 03/09/2016 15:19:52)\n File SHA256: 862d40b6cc62e18e6d72a00f1e1a7397b51a55b7a930e84a9f15613b7ea47440 (AV positives: 29/56 scanned on 03/10/2016 11:14:55)\n File SHA256: 297ed5f69a0342925670d4479750714430bf5c7752ac37542c4c626080644695 (AV positives: 3/56 scanned on 03/09/2016 09:21:12)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 195.169.147.26 on port 4843\n TCP traffic to 64.76.19.251 on port 4243","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"$29","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"56h4g3b5yh.exe.bin\" has an entrypoint in section \".text0\"","origin":"Static Parser","relevance":5,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00014119-00001728)\n Spawned process \"explorer.exe\" with commandline \"%WINDIR%\\Explorer.EXE\" (UID: 00020530-00001492)\n Spawned process \"cmd.exe\" with commandline \"/c schtasks.exe /Create /F /TN \"User_Feed_Synchronization-{9712f853-b0ba-45bc-4a15-20f339cef2ee}\" /SC minute /MO 10 /TR \"rundll32.exe %LOCALAPPDATA%\\ow\\fdk23A.tmp qtwsIJePYeN\"\" (UID: 00021015-00003320)\n Spawned process \"taskhost.exe\" (UID: 00021023-00001384)\n Spawned process \"schtasks.exe\" with commandline \"/Create /F /TN \"User_Feed_Synchronization-{9712f853-b0ba-45bc-4a15-20f339cef2ee}\" /SC minute /MO 10 /TR \"rundll32.exe %LOCALAPPDATA%\\ow\\fdk23A.tmp qtwsIJePYeN\"\" (UID: 00021030-00003152)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2a","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"InternetConnectW@wininet.dll\"\n \"IdnToAscii@Normaliz.dll\"\n \"HttpOpenRequestW@wininet.dll\"\n \"CertOpenStore@CRYPT32.dll\"\n \"GetUserProfileDirectoryW@USERENV.dll\"\n \"ConvertSidToStringSidW@sechost.dll\"\n \"WinVerifyTrust@wintrust.dll\"\n \"WTHelperProvDataFromStateData@wintrust.dll\"\n \"WTHelperGetProvSignerFromChain@wintrust.dll\"\n \"CertSelectCertificateChains@CRYPT32.dll\"\n \"CertFreeCertificateChainList@CRYPT32.dll\"\n \"InternetSetOptionW@wininet.dll\"\n \"InternetQueryOptionW@wininet.dll\"\n \"HttpSendRequestW@wininet.dll\"\n \"RasEnumEntriesW@RASAPI32.dll\"\n \"TraceRegisterExA@rtutils.dll\"\n \"TracePrintfExA@rtutils.dll\"\n \"RasConnectionNotificationW@RASAPI32.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameExW@SSPICLI.DLL at 00143015-00002656-76F4228D-149409\n LookupAccountNameLocalW@SECHOST.DLL at 00143015-00002656-76F4228D-160790","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"RasRpcGetVersion@RASMAN.DLL at 00143015-00002656-76F4228D-149005","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00143015-00002656-76F4228D-169030","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"RasPortListen@RASMAN.DLL at 00143015-00002656-76F4228D-148943","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"Wrote 382 instructions to foreign process \"taskhost.exe\" (UID: 00174984-00001412)\n Wrote 45 instructions to foreign process \"taskhost.exe\" (UID: 00174984-00001412)\n Wrote 204 instructions to foreign process \"taskhost.exe\" (UID: 00174984-00001412)\n Wrote 357 instructions to foreign process \"taskhost.exe\" (UID: 00174984-00001412)\n Wrote 281 instructions to foreign process \"taskhost.exe\" (UID: 00174984-00001412)","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 401408 bytes to a foreign process \"explorer.exe\" (PID: 00001624)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtSetSystemInformation@NTDLL.DLL at 00143015-00002656-76F4228D-151703\n NtQueryVirtualMemory@NTDLL.DLL at 00143015-00002656-76F4228D-169028","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Injects into explorer"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":69,"imported_dlls_count":216,"dropped_files_count":0,"extracted_files_count":17,"files_written_count":40,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"56ea7351aac2ed4a50fa84d4","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"QVM20.1.Malware","contacted_countries":["NLD","USA"],"submit_name":"56h4g3b5yh.exe","analysis_start_time":"2016-03-17T04:20:42+00:00","indicators_count":{"informative":9,"suspicious":27,"malicious":11},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"56ea7350aac2ed4a50fa84d2","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"QVM20.1.Malware","contacted_countries":["NLD"],"submit_name":"56h4g3b5yh.exe","analysis_start_time":"2016-03-17T04:27:28+00:00","indicators_count":{"informative":10,"suspicious":27,"malicious":16},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"195.169.147.26","port":4843,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"address":"64.76.19.251","port":4243,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}],"processes":[{"pid":2656,"ppid":0,"name":"56h4g3b5yh.exe","command_line":"","normalized_path":"","uid":"00143015-00002656","icon":"$2b"},{"pid":1624,"ppid":0,"name":"Explorer.EXE","command_line":"","normalized_path":"","uid":"00165437-00001624","icon":"$2c"},{"pid":3036,"ppid":0,"name":"cmd.exe","command_line":"/c schtasks.exe /Create /F /TN \"User_Feed_Synchronization-{8090caec-9037-bfbe-e29c-b2634bdd9ab6}\" /SC minute /MO 10 /TR \"rundll32.exe %LOCALAPPDATA%\\ow\\egsA6F4.tmp TjhRFz0h5WP2yuzFneP03p4L\"","normalized_path":"","uid":"00173906-00003036"},{"pid":3316,"ppid":0,"name":"schtasks.exe","command_line":"/Create /F /TN \"User_Feed_Synchronization-{8090caec-9037-bfbe-e29c-b2634bdd9ab6}\" /SC minute /MO 10 /TR \"rundll32.exe %LOCALAPPDATA%\\ow\\egsA6F4.tmp TjhRFz0h5WP2yuzFneP03p4L\"","normalized_path":"","uid":"00174968-00003316"},{"pid":1412,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00174984-00001412"},{"pid":1420,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00180437-00001420"}],"all_imported_dlls":["dhcpcsvc.dll","KernelBase.dll","msasn1.dll","winnsi.dll","bcrypt.dll","SensApi.dll","wship6.dll","credssp.dll","rasapi32.dll","rtutils.dll","setupapi.dll","msvcrt.dll","winhttp.dll","oleaut32.dll","secur32.dll","crypt32.dll","comctl32.dll","ntmarta.dll","rsaenh.dll","normaliz.dll","sechost.dll","kernel32.dll","wshqos.dll","WSHTCPIP.DLL","webio.dll","ole32.dll","Wldap32.dll","userenv.dll","winrnr.dll","advapi32.dll","lpk.dll","shlwapi.dll","sspicli.dll","dnsapi.dll","FWPUCLNT.DLL","user32.dll","rasman.dll","devrtl.dll","ntdll.dll","gdi32.dll","schannel.dll","cfgmgr32.dll","msctf.dll","shell32.dll","bcryptprimitives.dll","gpapi.dll","usp10.dll","wintrust.dll","mswsock.dll","NapiNSP.dll","cryptsp.dll","nlaapi.dll","ncrypt.dll","cabinet.dll","imm32.dll","rpcrt4.dll","iertutil.dll","profapi.dll","nsi.dll","rasadhlp.dll","dhcpcsvc6.dll","devobj.dll","wininet.dll","urlmon.dll","ws2_32.dll","IPHLPAPI.DLL","cryptbase.dll","pnrpnsp.dll","cryptnet.dll","CRYPT32.dll","ehSSO.dll","SyncCenter.dll","SspiCli.dll","wercplsupport.dll","SAMLIB.dll","sfc.dll","npmproxy.dll","GPAPI.dll","netutils.dll","EhStorShell.dll","EXPLORERFRAME.dll","Cabinet.dll","Actioncenter.dll","AVRT.dll","slc.dll","apphelp.dll","RpcRtRemote.dll","prnfldr.dll","ATL.DLL","CLBCatQ.DLL","ksuser.dll","GDI32.dll","shacct.dll","werconcpl.dll","uxtheme.dll","WINNSI.DLL","dxp.dll","SSPICLI.DLL","msls31.dll","Wlanapi.dll","dwmapi.dll","wevtapi.dll","WINMM.dll","QUtil.dll","MSCTF.dll","dhcpcsvc6.DLL","MSACM32.dll","schannel.DLL","wwanapi.dll","MSASN1.dll","FXSRESM.DLL","gdiplus.dll","wshtcpip.dll","PSAPI.DLL","NSI.dll","authui.dll","IMM32.dll","cscapi.dll","NLAapi.dll","dhcpcsvc.DLL","Syncreg.dll","CRYPTUI.dll","wer.dll","UxTheme.dll","AltTab.dll","hgcpl.dll","WLDAP32.dll","shdocvw.dll","es.dll","WINBRAND.dll","ADVAPI32.dll","dnsapi.DLL","WINSTA.dll","wshtcpip.DLL","DEVRTL.dll","netshell.dll","CRYPTBASE.dll","msiltcfg.dll","LINKINFO.dll","pnidui.dll","ktmw32.dll","IMM32.DLL","RPCRT4.dll","napinsp.dll","WINHTTP.dll","fwpuclnt.dll","POWRPROF.dll","Secur32.dll","actxprxy.dll","wwapi.dll","BatMeter.dll","UIAnimation.dll","FXSAPI.dll","WindowsCodecs.dll","wpdshserviceobj.dll","WinSCard.dll","wscinterop.dll","VERSION.dll","Normaliz.dll","USERENV.dll","imapi2.dll","OLEACC.dll","XmlLite.dll","CRYPTSP.dll","PROPSYS.dll","PortableDeviceApi.dll","framedynos.dll","WTSAPI32.dll","netprofm.dll","USP10.dll","USER32.dll","CFGMGR32.dll","iphlpapi.DLL","ws2_32.DLL","SndVolSSO.DLL","IconCodecService.dll","ntshrui.dll","tiptsf.dll","ieframe.dll","NetworkExplorer.dll","srchadmin.dll","stobject.dll","hcproviders.dll","DUser.dll","SXS.DLL","LPK.dll","SETUPAPI.dll","KERNELBASE.dll","sensapi.dll","fxsst.dll","AUDIOSES.DLL","DEVOBJ.dll","SHLWAPI.dll","WS2_32.dll","MsftEdit.dll","samcli.dll","gameux.dll","PortableDeviceTypes.dll","wkscli.dll","SHELL32.dll","midimap.dll","WSCAPI.dll","WININET.dll","ieproxy.dll","HID.DLL","taskschd.dll","msi.dll","srvcli.dll","WINTRUST.dll","OLEAUT32.dll","RASAPI32.dll","MMDevApi.dll","provsvc.dll","wlanutil.dll","DUI70.dll","QAgent.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df","sha256":"b3eda347e9f49dc3bdc885b4f22a32ad3ab4aa0804e3de4df72e8371815f606a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"name":"195_169_147_26[1].txt","sha256":"10dd7f0b9760b2e1e072fd66a5074e3861864011f75d3094adbe6f78383e1ae1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"64_76_19_251[1].txt","sha256":"802c757a8809ed2cfececce8c9f221b1d5fccec85deb74cff8d43cccc859231e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"name":"94308059B57B3142E455B38A6EB92015","sha256":"7baa189608dfc03424fb187409f1eb7210b4032db4ef53265deb3d2c21bb534a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"CabD9E6.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"name":"CabDCF5.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"name":"CabFF16.tmp","sha256":"0c14c3c231978d326fd3cda052987290867e67eb5b7eaebc52bf2696ea11f65a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"name":"TarD9E7.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"name":"TarDD06.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"name":"TarFF26.tmp","sha256":"d3f9f7ca9baf937199375fd8a7caa6904aeb25e7ae21b598c1c8bb1de57dceb2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"name":"Cab4982.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"Cab49F2.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"Cab603B.tmp","sha256":"0c14c3c231978d326fd3cda052987290867e67eb5b7eaebc52bf2696ea11f65a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"Tar4983.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"Tar49F3.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"Tar603C.tmp","sha256":"d3f9f7ca9baf937199375fd8a7caa6904aeb25e7ae21b598c1c8bb1de57dceb2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"User_Feed_Synchronization-{8090caec-9037-bfbe-e29c-b2634bdd9ab6}","sha256":"334fff34790ba9724978d94c3e40f836df8738ded38f5a889320b820148ba3f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"path":"%WINDIR%\\system32\\en-US\\WINHTTP.dll.mui","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S9Y0GKU4\\64_76_19_251[1].txt","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QA0UPEJW\\195_169_147_26[1].txt","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"%SAMPLEDIR%\\56h4g3b5yh.exe","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"C:\\","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"path":"%LOCALAPPDATA%\\ow\\egsA6F4.tmp","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"},{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\56H4G3B5YH_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{9F06C1CF-6065-AA05-FDB2-64C8C0E26656}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{9F06C1CF-6065-AA05-FDB2-64C8C0E26656}\\","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{FCCDD632-FF52-40C7-12B7-3F8F2DADB065}\\SHELLFOLDER\\1D1802F85BC72A5LZTW\\1D1802F85BC72A5LZTW","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\CCLEANER MONITORING\\CCLEANER MONITORING","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{92b51f17-8d1b-35d1-ec93-e229fc3e6ce7}","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\92b51f178d1b35d1ec93e229fc3e6ce7","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"56ea7351aac2ed4a50fa84d4"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{1e72aab8-98de-abb1-5f27-af93c8201698}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"Global\\1e72aab898deabb15f27af93c8201698","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{9baec5d2-d791-9ca9-06cf-d6cd54a30422}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{f8ee0840-a2a6-f7d4-dc19-b1e11a5618dd}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"Global\\60419496653af25207314931962f22cf","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{60419496-653a-f252-0731-4931962f22cf}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{6ecbf91f-bd8e-5e09-2136-6a6cda5eef8c}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{1b352aa1-07b9-60df-afc6-0690c4519d7c}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{2ba1d833-2a9d-0007-0546-bb311c0dd572}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{dc3ebeda-6791-4cdf-1267-70db94af9aa3}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{68d759cf-fa92-d2e6-0edb-74d00a859a9e}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{3b098954-e77b-6a1a-8752-6755c2b999e6}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{b2994959-72cd-abe0-978b-6db78d8819e9}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{efc4a03c-101a-04ed-0680-5f9774389b52}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{564b9fd3-7bb8-b606-2897-9bdac4db84f2}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{a5cd9bb2-d541-7250-d5f5-7a8eceec826a}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"Global\\dd24a80eb8cb953c7fb8552d85220446","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{dd24a80e-b8cb-953c-7fb8-552d85220446}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{9649f732-c16c-0e35-b834-cde4fca1a3eb}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{e0ecf065-4cc5-c8fd-8b8c-ad43147a61a4}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{8f4c3271-1090-f28b-f70a-bf68fcb0fdc0}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{1351486b-31c0-7f12-61cd-e932344d14ba}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{6fa6e0c1-391d-a671-e02a-67d0fe2c8df5}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{d41e059f-cd77-dd2b-b9de-f2ce85af37c7}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{560e03df-de95-5a7d-6540-44eeeb4a9566}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{59755791-d7f6-2904-0a34-6cf09c369df7}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{aecc62ae-5ac5-e7ea-ee35-b622bdf4dac8}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{5ce6c819-349d-a974-8cde-ae291f96137b}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{511f8ec8-669b-4235-0e84-fe5223acdc19}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{be52a3f3-b2ae-7aaa-0ce1-f721bab7280f}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{89c90839-3ee1-243e-658a-24de9efc93cf}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{7ddf4532-09ca-7737-224e-9236da9733ac}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{27eb9029-d0d9-1612-b064-0cfb4b47e9b4}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{5ff2211e-c9e0-5d76-fd38-4b907e0b3f4e}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{ec69f7b1-a880-2e62-d5a9-b9e9187ac5c2}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{2df333d0-ac16-7ba4-7835-225604b37968}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{7d7be014-d3d0-9267-0a08-977defbd4d61}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{96325697-156d-6600-1a9a-77e318c0c5ce}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{049db21a-14fa-2c8f-fb61-fd61f3f63937}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{6ca799f7-a06e-3833-aee1-3a8d6c9a3284}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{89d6125e-d1a4-666a-06c8-bb1e61f51c90}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]},{"name":"{34f4b23f-c06f-3035-d2d8-edfa6d4063b7}","sources":[{"report_type":"sandbox","report_id":"56ea7350aac2ed4a50fa84d2"}]}]}},"report_ids":{"sandbox_job_ids":["56ea7351aac2ed4a50fa84d4","56ea7350aac2ed4a50fa84d2"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 756c4cb7f88e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 756c4cb7f88e…. Malware family: Trojan.Generic. Threat score 100/100. 26/28 AV engines flagged this file. 13 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/756c4cb7f88e0dd37f460037b9e43a59a1677234a5f491b26195a8950629d748"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 756c4cb7f88e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 756c4cb7f88e…. Malware family: Trojan.Generic. Threat score 100/100. 26/28 AV engines flagged this file. 13 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/756c4cb7f88e0dd37f460037b9e43a59a1677234a5f491b26195a8950629d748"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 756c4cb7f88e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 756c4cb7f88e…. Malware family: Trojan.Generic. Threat score 100/100. 26/28 AV engines flagged this file. 13 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]