23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T4a1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware.Generic Sample 7bd2d0ffa8b4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7bd2d0ffa8b4…. Malware family: Malware.Generic. Threat score 100/100. 8/29 AV engines flagged this file. 8 malicious and 32 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7bd2d0ffa8b4d3ff0256c0fdb800d83eee85d8720fcfb91952b2373fc99889cd","keywords":["Malicious","Malware.Generic","malware analysis","sandbox report","threat intelligence","7bd2d0ffa8b4d3ff0256c0fdb800d83eee85d8720fcfb91952b2373fc99889cd"],"about":{"@type":"SoftwareApplication","name":"b83652050009e6134720d77594c57e0c.exe","applicationCategory":["peexe","executable"],"identifier":"7bd2d0ffa8b4d3ff0256c0fdb800d83eee85d8720fcfb91952b2373fc99889cd","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware.Generic","antivirusDetections":{"malicious":8,"total":29},"behavioralIndicators":{"malicious":8,"suspicious":32},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:Tea6,Found API call GetVersion@KERNEL32.DLL (Target: "b83652050009e6134720d77594c57e0c.exe"; Stream UID: "00014207-00002668-6780-1065-00409D34") which is directly followed by "cmp edx, 05h" and "jne 00409D53h". See related instructions: "... +0 call 00402584h ;GetVersion +5 mov edx, eax +7 and edx, 000000FFh +13 and eax, 0000FF00h +18 shr eax, 08h +21 cmp edx, 05h +24 jne 00409D53h" ... at 00014207-00002668-6780-1065-00409D34 Found API call GetVersion@KERNEL32.DLL (Target: "b83652050009e6134720d77594c57e0c.exe"; Stream UID: "00014207-00002668-6780-1069-00408648") which is directly followed by "cmp byte ptr [0054CB58h], 00h" and "je 004086C6h". See related instructions: "... +19 call 00402584h ;GetVersion +24 and eax, 000000FFh +29 cmp eax, 06h +32 setnb byte ptr [0054CB58h] +39 cmp byte ptr [0054CB58h], 00h +46 je 004086C6h" ... at 00014207-00002668-6780-1069-00408648 Found API call GetVersionExW@KERNEL32.DLL (Target: "b83652050009e6134720d77594c57e0c.exe"; Stream UID: "00014207-00002668-6780-2364-004E18A9") which is directly followed by "cmp dword ptr [esp+04h], 05h" and "jnbe 004E18E4h". See related instructions: "... +0 add byte ptr [eax], 00h +3 add byte ptr [eax+4C04FFFFh], al +9 outsd +10 outsd +11 imul ecx, dword ptr [ebp-3B7EFFC0h], ECh +20 inc edi +22 add al, 24h +24 adc al, 01h +26 add byte ptr [eax], al +28 push esp +29 call 0040B57Ch ;GetVersionExW +34 cmp dword ptr [esp+04h], 05h +39 jnbe 004E18E4h" ... at 00014207-00002668-6780-2364-004E18A9 Found API call GetVersion@KERNEL32.DLL (Target: "b83652050009e6134720d77594c57e0c.exe"; Stream UID: "00014207-00002668-6780-5728-0047879C") which is directly followed by "cmp al, 04h" and "jc 004789BCh". See related instructions: "... +152 call 00406FF0h +157 call 0040B574h ;GetVersion +162 cmp al, 04h +164 jc 004789BCh" ... at 00014207-00002668-6780-5728-0047879C Found API call GetVersion@KERNEL32.DLL (Target: "b83652050009e6134720d77594c57e0c.exe"; Stream UID: "00014207-00002668-6780-7388-0053DB30") which is directly followed by "cmp al, 04h" and "setnb byte ptr [0054F228h]". See related instructions: "... +26 call 0040B574h ;GetVersion +31 cmp al, 04h +33 setnb byte ptr [0054F228h]" ... at 00014207-00002668-6780-7388-0053DB30 Found API call GetSystemTimeAsFileTime@KERNEL32.dll (Target: "Scan.dll.555150319"; Stream UID: "13625-2171-10079DC0") which is directly followed by "cmp byte ptr [edx+0Dh], 00h" and "jne 10079EB4h". See related instructions: "... +166 lea eax, dword ptr [ebp-5Ch] +169 push eax +170 call dword ptr [1008E174h] ;GetSystemTimeAsFileTime +176 mov edx, dword ptr [ebp-4Ch] +179 xor eax, eax +181 or eax, dword ptr [ebp-5Ch] +184 mov ecx, dword ptr [ebp-58h] +187 mov dword ptr [edx+38h], eax +190 mov eax, dword ptr [ebp-48h] +193 mov dword ptr [edx+3Ch], ecx +196 mov ecx, dword ptr [edx+40h] +199 mov edi, dword ptr [eax+04h] +202 lea eax, dword ptr [edx+40h] +205 mov dword ptr [ebp-48h], eax +208 mov eax, ecx +210 mov esi, eax +212 mov edx, dword ptr [eax+04h] +215 cmp byte ptr [edx+0Dh], 00h +219 jne 10079EB4h" ... at 13625-2171-10079DC0 Found API call GetSystemTimeAsFileTime@KERNEL32.dll (Target: "Scan.dll.555150319"; Stream UID: "13625-3346-1007A1E0") which is directly followed by "cmp byte ptr [edi], bl" and "jne 1007A374h". See related instructions: "... +77 call 1001FCC0h +82 lea eax, dword ptr [esp+24h] +86 mov dword ptr [esp+60h], 00000000h +94 xor esi, esi +96 push eax +97 mov dword ptr [esp+24h], esi +101 call dword ptr [1008E174h] ;GetSystemTimeAsFileTime +107 mov ecx, dword ptr [esp+28h] +111 xor eax, eax +113 or eax, dword ptr [esp+24h] +117 xor bl, bl +119 mov dword ptr [esp+1Ch], eax +123 mov dword ptr [esp+18h], ecx +127 cmp byte ptr [edi], bl +129 jne 1007A374h" ... at 13625-3346-1007A1E025:Te1a,"paiF2AC.tmp" queries volume information of "C:\" at 00027405-00003224-0000010C-85469121 "paiF2AC.tmp" queries volume information of "%PROGRAMFILES%\Plumbytes Software\Plumbytes Anti-Malware\Plumbytes.exe" at 00027405-00003224-0000010C-85473007 "paiF2AC.tmp" queries volume information of "C:\" at 00027405-00003224-0000010C-85530617 "paiF2AC.tmp" queries volume information of "%PROGRAMFILES%\Plumbytes Software\Plumbytes Anti-Malware\Plumbytes.exe" at 00027405-00003224-0000010C-85530796 "Plumbytes.exe" queries volume information of "%WINDIR%\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll" at 00030734-00003324-0000010C-86036268 "Plumbytes.exe" queries volume information of "%PROGRAMFILES%\Plumbytes Software\Plumbytes Anti-Malware\Plumbytes.exe" at 00030734-00003324-0000010C-86044161 "Plumbytes.exe" queries volume information of "%PROGRAMFILES%\Plumbytes Software\Plumbytes Anti-Malware\log4net.dll" at 00030734-00003324-0000010C-86265069 "Plumbytes.exe" queries volume information of "%PROGRAMFILES%\Plumbytes Software\Plumbytes Anti-Malware\GalaSoft.MvvmLight.dll" at 00030734-00003324-0000010C-86438943 "Plumbytes.exe" queries volume information of "%PROGRAMFILES%\Plumbytes Software\Plumbytes Anti-Malware\Hardcodet.Wpf.TaskbarNotification.dll" at 00030734-00003324-0000010C-86448363 "Plumbytes.exe" queries volume information of "%PROGRAMFILES%\Plumbytes Software\Plumbytes Anti-Malware\Infralution.Localization.Wpf.dll" at 00030734-00003324-0000010C-86455065 "Plumbytes.exe" queries volume information of "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\WindowsFormsIntegration\v4.0_4.0.0.0__31bf3856ad364e35\WindowsFormsIntegration.dll" at 00030734-00003324-0000010C-86512251 "Plumbytes.exe" queries volume information of "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\WindowsFormsIntegration\v4.0_4.0.0.0__31bf3856ad364e35\WindowsFormsIntegration.dll" at 00030734-00003324-0000010C-86515457 "Plumbytes.exe" queries volume information of "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemCore\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemCore.dll" at 00030734-00003324-0000010C-86574543 "Plumbytes.exe" queries volume information of "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemCore\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemCore.dll" at 00030734-00003324-0000010C-86576588 "Plumbytes.exe" queries volume information of "%PROGRAMFILES%\Plumbytes Software\Plumbytes Anti-Malware\System.Windows.Interactivity.dll" at 00030734-00003324-0000010C-86621618 "Plumbytes.exe" queries volume information of "%PROGRAMFILES%\Plumbytes Software\Plumbytes Anti-Malware\GalaSoft.MvvmLight.Extras.dll" at 00030734-00003324-0000010C-86639660 "Plumbytes.exe" queries volume information of "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll" at 00030734-00003324-0000010C-86779575 "Plumbytes.exe" queries volume information of "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll" at 00030734-00003324-0000010C-86782097 "Plumbytes.exe" queries volume information of "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll" at 00030734-00003324-0000010C-86786993 "Plumbytes.exe" queries volume information of "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll" at 00030734-00003324-0000010C-8678906926:T7ad,"paiF2AC.tmp" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "paiF2AC.tmp" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "paiF2AC.tmp" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "paiF2AC.tmp" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "paiF2AC.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "paiF2AC.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "paiF2AC.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "paiF2AC.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "paiF2AC.tmp" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "paiF2AC.tmp" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "paiF2AC.tmp" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "paiF2AC.tmp" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "paiF2AC.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "paiF2AC.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "paiF2AC.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "paiF2AC.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "paiF2AC.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "paiF2AC.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "paiF2AC.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "paiF2AC.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")27:T712,"paiF2AC.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "paiF2AC.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "paiF2AC.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "paiF2AC.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "paiF2AC.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "paiF2AC.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "paiF2AC.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "paiF2AC.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "paiF2AC.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "paiF2AC.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "paiF2AC.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "paiF2AC.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "paiF2AC.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "paiF2AC.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "paiF2AC.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "paiF2AC.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "paiF2AC.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")28:T9cb,Antivirus vendors marked dropped file "Scan.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "Plumbytes.resources.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"), Antivirus vendors marked dropped file "Infralution.Localization.Wpf.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"), Antivirus vendors marked dropped file "Newtonsoft.Json.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"), Antivirus vendors marked dropped file "Plumbytes.exe" as clean (type is "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"), Antivirus vendors marked dropped file "INetC.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "GalaSoft.MvvmLight.Extras.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"), Antivirus vendors marked dropped file "msvcr120.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "CmdProxy.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "System.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "Hardcodet.Wpf.TaskbarNotification.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"), Antivirus vendors marked dropped file "log4net.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"), Antivirus vendors marked dropped file "System.Windows.Interactivity.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"), Antivirus vendors marked dropped file "DotNetChecker.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "msvcp120.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "AmwService.exe" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "GalaSoft.MvvmLight.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows")29:T790,"uninstall.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "Scan.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Plumbytes.resources.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "Infralution.Localization.Wpf.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "Newtonsoft.Json.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "PCRE_16.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Plumbytes.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "INetC.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Plumbytes Anti-Malware.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Archive ctime=Tue Jul 19 19:45:20 2016 mtime=Tue Aug 29 15:25:07 2017 atime=Tue Jul 19 19:45:20 2016 length=2251536 window=hide" "GalaSoft.MvvmLight.Extras.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "msvcr120.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "CmdProxy.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Hardcodet.Wpf.TaskbarNotification.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "log4net.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "System.Windows.Interactivity.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "DotNetChecker.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "msvcp120.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"2a:T465,"" touched file "%WINDIR%\Fonts\staticcache.dat" "" touched file "%WINDIR%\system32\en-US\USER32.dll.mui" "" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "" touched file "%WINDIR%\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\comctl32.dll.mui" "" touched file "%WINDIR%\system32\en-US\MSCTF.dll.mui" "" touched file "%APPDATA%\Microsoft\Windows\Cookies" "" touched file "%APPDATA%\Microsoft\Windows\Cookies\index.dat" "" touched file "C:\Users\AnLDXfM\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat" "" touched file "C:\Users\AnLDXfM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\" "" touched file "C:\Users\AnLDXfM\AppData\Local\Microsoft\Windows\Temporary Internet Files\" "" touched file "C:\Users\AnLDXfM\AppData\Local\Microsoft\Windows\" "" touched file "C:\Users\AnLDXfM\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low"2b:T11cf,Pattern match: "http://sv.symcb.com/sv.crl0a" Pattern match: "https://d.symcb.com/cps0%" Pattern match: "https://d.symcb.com/rpa0" Pattern match: "http://sv.symcd.com0&" Pattern match: "http://sv.symcb.com/sv.crt0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "http://www.symauth.com/cps0*" Heuristic match: "$-2nm0/'.mD" Heuristic match: "plumbytes.com" Pattern match: "https://secure.comodo.com/CPS0" Pattern match: "crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl0" Pattern match: "crt.comodoca.com/COMODORSADomainValidationSecureServerCA.crt0$" Pattern match: "http://ocsp.comodoca.com0" Heuristic match: "*.plumbytes.com" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$" Pattern match: "crl.usertrust.com/AddTrustExternalCARoot.crl05" Pattern match: "http://ocsp.usertrust.com0" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.usertrust.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCECsuburZdTZsFIpu26N8jAc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.comodoca.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR64T7ooMQqLLQoy%2BemBUYZQOKh6QQUkK9qOpRaC9iQ6hJWc99DtDoo2ucCEGiBA6iUCnVpdF5tVy4ebbA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.comodoca.com" Heuristic match: "GET /COMODORSADomainValidationSecureServerCA.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.comodoca.com" Pattern match: "http://45.55.29.117/download/nsis/20160324_vA.exe" Pattern match: "http://www.plumbytes.com/eula/" Pattern match: "plumbytes.com/privacy/" Pattern match: "http://ns.adobe.com/xap/1.0/" Pattern match: "http://nsis.sf.net/NSIS_Error" Pattern match: "http://ns.adobe.com/photoshop/1.0/" Pattern match: "ns.adobe.com/xap/1.0/" Pattern match: "http://www.plumbytes.com/support/?language={0}&cuid={1" Pattern match: "plumbytes2.azurewebsites.net/keyActivate" Pattern match: "plumbytes2.azurewebsites.net/eventext" Pattern match: "azurewebsites.net/api/info/" Pattern match: "bsites.net/api/hosts/{0" Pattern match: "plumbytes2.azurewebsites.net/customer" Pattern match: "www.plumbytes.com/cart/?language={0}&cuid={1" Pattern match: "umbytes.com/support/?language={0}&cuid={1" Pattern match: "umbytes.com/uninstall/" Pattern match: "o.msecnd.net/binaries/" Heuristic match: ".info" Pattern match: "lmanager.anyout.ru/api/verify.json?key={0" Pattern match: "https://plumbytes2.azurewebsites.net/" Pattern match: "ytes2.azurewebsites.net/keyActivate" Pattern match: "umbytes2.azurewebsites.net/api/hosts/{0" Heuristic match: "J?fG&-Jaij.pr" Heuristic match: "*. .UY" Pattern match: "http://www.microsoft.com/typography/fonts/You" Pattern match: "http://www.plumbytes.com" Pattern match: "http://www.galasoft.ch" Pattern match: "w3.org/2000/xmlns/" Pattern match: "es.newtonking.com/projects/json" Pattern match: "nking.com/projects/json" Pattern match: "http://www.newtonsoft.com/jsonschema" Heuristic match: ">Json.NET is a popular high-performance JSON framework for .NET" Heuristic match: "Json.NET" Heuristic match: "T is a popular high-performance JSON framework for .NET" Heuristic match: "son.NET" Pattern match: "http://www.apache.org/licenses/" Pattern match: "http://www.apache.org/licenses/LICENSE-2.0" Pattern match: "http://logging.apache.org/log4net/release/faq.html#trouble-EventLog" Heuristic match: "levelEntry.Name" Pattern match: "https://svn.apache.org/repos/asf/logging/log4net/tags/1.2.13RC3" Heuristic match: "hardcodet.net" Pattern match: "http://www.hardcodet.net/taskbar!Hardcodet.Wpf.TaskbarNotification" Pattern match: "http://plumbytes2.azurewebsites.net/api/vxi/" Pattern match: "http://plumbytes2.azurewebsites.net/api/vx2" Pattern match: "http://plumbytes2.azurewebsites.net/api/event/" Pattern match: "https://plumbytes2.azurewebsites.net/Logs.aspx" Pattern match: "plumbytes2.azurewebsites.net/api/vxi/" Pattern match: "ytes2.azurewebsites.net/api/vx2"2c:T4ba,"b83652050009e6134720d77594c57e0c.exe.bin" was detected as "UPX v1.25 (Delphi) Stub" "uninstall.exe" was detected as "Nullsoft PiMP Stub -> SFX" "Scan.dll" was detected as "Borland Delphi 3.0 (???)" "Plumbytes.resources.dll" was detected as "Microsoft visual C# / Basic .NET" "Infralution.Localization.Wpf.dll" was detected as "Microsoft visual C# / Basic .NET" "Newtonsoft.Json.dll" was detected as "Microsoft visual C# / Basic .NET" "PCRE_16.dll" was detected as "Borland Delphi 3.0 (???)" "Plumbytes.exe" was detected as "Microsoft visual C# v7.0 / Basic .NET" "GalaSoft.MvvmLight.Extras.dll" was detected as "Microsoft visual C# / Basic .NET" "msvcr120.dll" was detected as "Borland Delphi 3.0 (???)" "CmdProxy.dll" was detected as "Borland Delphi 3.0 (???)" "Hardcodet.Wpf.TaskbarNotification.dll" was detected as "Microsoft visual C# / Basic .NET" "log4net.dll" was detected as "Microsoft visual C# v7.0 / Basic .NET" "System.Windows.Interactivity.dll" was detected as "Microsoft visual C# / Basic .NET" "DotNetChecker.dll" was detected as "Borland Delphi 3.0 (???)" "msvcp120.dll" was detected as "Borland Delphi 3.0 (???)" "AmwService.exe" was detected as "VC8 -> Microsoft Corporation"2d:T678,"uninstall.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "Scan.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Plumbytes.resources.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "Infralution.Localization.Wpf.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "Newtonsoft.Json.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "PCRE_16.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Plumbytes.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "INetC.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "GalaSoft.MvvmLight.Extras.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "msvcr120.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "CmdProxy.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Hardcodet.Wpf.TaskbarNotification.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "log4net.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "System.Windows.Interactivity.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "DotNetChecker.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "msvcp120.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"2e:T8c5,"paiF2AC.tmp" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "paiF2AC.tmp" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "paiF2AC.tmp" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "paiF2AC.tmp" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "paiF2AC.tmp" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "paiF2AC.tmp" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "paiF2AC.tmp" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "paiF2AC.tmp" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "paiF2AC.tmp" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "paiF2AC.tmp" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "paiF2AC.tmp" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "paiF2AC.tmp" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "paiF2AC.tmp" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "paiF2AC.tmp" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "paiF2AC.tmp" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "paiF2AC.tmp" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "paiF2AC.tmp" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "paiF2AC.tmp" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "paiF2AC.tmp" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "paiF2AC.tmp" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")2f:T6c5,"" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000") "" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER") "" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE") "" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "paiF2AC.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000") "paiF2AC.tmp" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER") "paiF2AC.tmp" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE") "paiF2AC.tmp" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "paiF2AC.tmp" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "Plumbytes.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "Plumbytes.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")30:T65a,VirtualProtect GetProcAddress VirtualAlloc LoadLibraryA ShellExecuteW InternetOpenW RegCreateKeyExW RegCloseKey RegDeleteValueW RegEnumKeyW RegOpenKeyExW RegDeleteKeyW CopyFileW GetModuleFileNameW GetVersionExW GetFileAttributesW GetFileSize OpenProcess GetCommandLineW LoadLibraryExW CreateDirectoryW DeleteFileW GetTempFileNameW GetModuleHandleA CreateThread LoadLibraryW FindNextFileW GetTempPathW FindFirstFileW GetModuleHandleW WriteFile CreateFileW CreateProcessW Sleep GetTickCount FindWindowExW SetSecurityDescriptorDacl OpenProcessToken RegEnumKeyExW CreateProcessAsUserW CreateToolhelp32Snapshot IsDebuggerPresent LockResource ReadProcessMemory Process32FirstW Process32NextW GetFileSizeEx TerminateProcess FindResourceW GetModuleFileNameExW CreateFileA SleepEx HttpQueryInfoW InternetConnectW InternetWriteFile HttpSendRequestExW InternetCloseHandle InternetCrackUrlW InternetQueryOptionW HttpSendRequestW InternetReadFile FtpOpenFileW GetDriveTypeW UnhandledExceptionFilter GetTempPathA OutputDebugStringW OutputDebugStringA GetModuleFileNameA LoadLibraryExA ExitThread GetModuleHandleExW GetStartupInfoW FindFirstFileExA FindNextFileA FindFirstFileExW GetCommandLineA GetFileAttributesExW CreateProcessA StartServiceW StartServiceCtrlDispatcherW CreateServiceW DisconnectNamedPipe ConnectNamedPipe GetFileAttributesA GetVersionExA DeleteFileA CreateFileMappingW MapViewOfFile CreateFileMappingA GetWindowThreadProcessId RegOpenKeyExA FindResourceExW SetWindowsHookExW GetUpdateRect GetLastActivePopup CreateFileMoniker31:T89e,"rundll32.exe" wrote bytes "4053257758582677186a2677653c27770000000000bf6b750000000056cc6b75000000007cca6b750000000037683f756a2c2777d62d27770000000020693f750000000029a66b7500000000a48d3f7500000000f70e6b7500000000" to virtual address "0x77411000" (part of module "NSI.DLL") "paiF2AC.tmp" wrote bytes "92e6227779a82777be722777d62d27771de2227705a22777bee32277616f2777684125770050257700000000ad3738778b2d3877b641387700000000" to virtual address "0x74871000" (part of module "WSHTCPIP.DLL") "paiF2AC.tmp" wrote bytes "4053257758582677186a2677653c27770000000000bf6b750000000056cc6b75000000007cca6b750000000037683f756a2c2777d62d27770000000020693f750000000029a66b7500000000a48d3f7500000000f70e6b7500000000" to virtual address "0x77411000" (part of module "NSI.DLL") "paiF2AC.tmp" wrote bytes "7739237779a82777be722777d62d27771de2227705a22777c868267757d12d77bee32277616f2777684125770050257700000000ad3738778b2d3877b641387700000000" to virtual address "0x74DA1000" (part of module "WSHIP6.DLL") "paiF2AC.tmp" wrote bytes "0857b9750478c2750000000051c1bc769498bc76ee9cbc7675dcbe76273ebe76efb2c2760000000046ce6b75013d6c7538ed6c75cfcd6b7531236b75de2f6c75c4ca6b7580bb6b75aa6e6c759fbb6b7592bb6b7546ba6b750abf6b7500000000" to virtual address "0x73581000" (part of module "SHFOLDER.DLL") "Plumbytes.exe" wrote bytes "16e92524" to virtual address "0x6A9A2024" (part of module "CLR.DLL") "Plumbytes.exe" wrote bytes "db4da06f00000000" to virtual address "0x01132000" (part of module "PLUMBYTES.EXE") "Plumbytes.exe" wrote bytes "92e6227779a82777be722777d62d27771de2227705a22777bee32277616f2777684125770050257700000000ad3738778b2d3877b641387700000000" to virtual address "0x74871000" (part of module "WSHTCPIP.DLL") "Plumbytes.exe" wrote bytes "4053257758582677186a2677653c27770000000000bf6b750000000056cc6b75000000007cca6b750000000037683f756a2c2777d62d27770000000020693f750000000029a66b7500000000a48d3f7500000000f70e6b7500000000" to virtual address "0x77411000" (part of module "NSI.DLL") "Plumbytes.exe" wrote bytes "7739237779a82777be722777d62d27771de2227705a22777c868267757d12d77bee32277616f2777684125770050257700000000ad3738778b2d3877b641387700000000" to virtual address "0x74DA1000" (part of module "WSHIP6.DLL")32:T561,"" wrote 1500 bytes to a remote process "%WINDIR%\System32\rundll32.exe" (Handle: 648) "" wrote 4 bytes to a remote process "%WINDIR%\System32\rundll32.exe" (Handle: 648) "" wrote 32 bytes to a remote process "%WINDIR%\System32\rundll32.exe" (Handle: 648) "" wrote 52 bytes to a remote process "%WINDIR%\System32\rundll32.exe" (Handle: 648) "" wrote 32 bytes to a remote process "%TEMP%\paiF2AC.tmp" (Handle: 344) "" wrote 52 bytes to a remote process "%TEMP%\paiF2AC.tmp" (Handle: 344) "" wrote 4 bytes to a remote process "%TEMP%\paiF2AC.tmp" (Handle: 344) "paiF2AC.tmp" wrote 32 bytes to a remote process "C:\Program Files\Plumbytes Software\Plumbytes Anti-Malware\Plumbytes.exe" (Handle: 1588) "paiF2AC.tmp" wrote 52 bytes to a remote process "C:\Program Files\Plumbytes Software\Plumbytes Anti-Malware\Plumbytes.exe" (Handle: 1588) "paiF2AC.tmp" wrote 4 bytes to a remote process "C:\Program Files\Plumbytes Software\Plumbytes Anti-Malware\Plumbytes.exe" (Handle: 1588) "Plumbytes.exe" wrote 32 bytes to a remote process "%WINDIR%\System32\wisptis.exe" (Handle: 1544) "Plumbytes.exe" wrote 52 bytes to a remote process "%WINDIR%\System32\wisptis.exe" (Handle: 1544) "Plumbytes.exe" wrote 4 bytes to a remote process "%WINDIR%\System32\wisptis.exe" (Handle: 1544)33:T60c,Found malicious artifacts related to "45.55.29.117" (ASN: , Owner: ): ... URL: http://plumbytes.com/logs.php?cuid=test20160420_option_a-tid_es_t000001_ask_ES0001_xoriginal_kwid_en02_es (AV positives: 1/65 scanned on 08/23/2017 15:35:57) URL: https://plumbytes.com/logs.php?cuid= Heuristic (AV positives: 1/65 scanned on 08/22/2017 15:01:52) URL: https://plumbytes.com/download/cuid/?tid=rwid_p00000 (AV positives: 1/65 scanned on 08/16/2017 11:47:57) URL: http://plumbytes.com/logs.php?cuid=usrid_2e800aa6-affiliatewire_komoto-asubid_usrid_2e800aa6-tid_de_t000228_reimage_DE0002_xtargeted_k001605283_de02_de (AV positives: 1/65 scanned on 08/15/2017 03:00:59) URL: http://plumbytes.com/logs.php?cuid=usrid_ff39c859-affiliatewire_komoto-asubid_usrid_ff39c859-testprcus201703b_tid_us_t000927_adchoices_US0001_xoriginal_k002018671_en05_en (AV positives: 1/65 scanned on 08/06/2017 05:10:38) File SHA256: dfdeacc415ae75c17bb384be8459887b2baececfe7c4b0b70a312b16e4ca1761 (AV positives: 4/63 scanned on 08/22/2017 14:47:35) File SHA256: 8407e30d5dfba1ce0fd697fdb035c7b6bd6e73945f5f40c52f8ded27d89416f9 (AV positives: 3/64 scanned on 08/16/2017 11:48:01) File SHA256: 2b3a847911e2259f544b5364fc8cd34c65b6666eaa98549939e305c323ab6e1b (AV positives: 3/59 scanned on 07/26/2017 10:46:33) File SHA256: f97ed19da4c5c82a16ac8cc42727f72d2f2f18b2bf3c5089e6872a3e11cd668c (AV positives: 5/62 scanned on 07/13/2017 11:39:37) File SHA256: fc9ca76ccab35dbb0165a5ba5e462a8a31d4aab673c1e352b927c3d8692a9aa7 (AV positives: 5/60 scanned on 07/06/2017 07:26:15)34:T60c,Found malicious artifacts related to "45.55.29.117" (ASN: , Owner: ): ... URL: http://plumbytes.com/logs.php?cuid=test20160420_option_a-tid_es_t000001_ask_ES0001_xoriginal_kwid_en02_es (AV positives: 1/65 scanned on 08/23/2017 15:35:57) URL: https://plumbytes.com/logs.php?cuid= Heuristic (AV positives: 1/65 scanned on 08/22/2017 15:01:52) URL: https://plumbytes.com/download/cuid/?tid=rwid_p00000 (AV positives: 1/65 scanned on 08/16/2017 11:47:57) URL: http://plumbytes.com/logs.php?cuid=usrid_2e800aa6-affiliatewire_komoto-asubid_usrid_2e800aa6-tid_de_t000228_reimage_DE0002_xtargeted_k001605283_de02_de (AV positives: 1/65 scanned on 08/15/2017 03:00:59) URL: http://plumbytes.com/logs.php?cuid=usrid_ff39c859-affiliatewire_komoto-asubid_usrid_ff39c859-testprcus201703b_tid_us_t000927_adchoices_US0001_xoriginal_k002018671_en05_en (AV positives: 1/65 scanned on 08/06/2017 05:10:38) File SHA256: dfdeacc415ae75c17bb384be8459887b2baececfe7c4b0b70a312b16e4ca1761 (AV positives: 4/63 scanned on 08/22/2017 14:47:35) File SHA256: 8407e30d5dfba1ce0fd697fdb035c7b6bd6e73945f5f40c52f8ded27d89416f9 (AV positives: 3/64 scanned on 08/16/2017 11:48:01) File SHA256: 2b3a847911e2259f544b5364fc8cd34c65b6666eaa98549939e305c323ab6e1b (AV positives: 3/59 scanned on 07/26/2017 10:46:33) File SHA256: f97ed19da4c5c82a16ac8cc42727f72d2f2f18b2bf3c5089e6872a3e11cd668c (AV positives: 5/62 scanned on 07/13/2017 11:39:37) File SHA256: fc9ca76ccab35dbb0165a5ba5e462a8a31d4aab673c1e352b927c3d8692a9aa7 (AV positives: 5/60 scanned on 07/06/2017 07:26:15)35:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAARmZmZmZmZmZmZmZmZAAABGZmZmZmZmZmZmZmZmZAAEZmZmZmZmZmZmZmZmZmZARmZmZmZmZmZmZmZmZmZmZGZmZmZmZmZ45mZmZmZmZmZmZmZmZmZoiO5mZmZmZmZmZmZmZmRmiIju7mZGZmZmZmZmZmZGaIiI7u7mZGZmZmZmZmZkRoiIiO7u7mRGZmZmZmZmZGiIiIju7u5mRmZmZmZmZkZ4iIiI7u7u5mRmZmZmZmZGiIiIiO7u7u5kZmZmZmZkZ4iIiP/u7u7uZkZmZmZmZGiIiI//ju7u7uZGZmZmZmZ4iIj///ju7u7mZmZmZmZGiIiP+Ij/ju7u5mRmZmZmRoiIj4iIj/ju7u5kZmZmZmeIiIiIiOj/ju7uZmZmZmZniIiIiIjuj/ju7mZmZmZmaIiIiIiI7uj/ju5mZmZmZmiIiIiIiO7uiI7u5mZmZmZoiIiIiIju7u7u7uZmZmZmaIiIiIiI7u7u7u7mZmZmZmiIiIiIiO7u7u7u5mZmZmZnd4iIiIju7u7uZmZmZmZmZmZmeIiI7u5mZmZmZmZmZmZmZmZoiO5mZmZmZmZmZmZmZmZmZmjmZmZmZmZmZkZmZmZmZmZmZmZmZmZmZmQEZmZmZmZmZmZmZmZmZmZAAEZmZmZmZmZmZmZmZmZkAAAEZmZmZmZmZmZmZmZmQADgAAAHwAAAA4AAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAHAAAAD4AAABw==36:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAIiIiIh3d3d3d3d3gAAAAACIiIiIiIiIiIiIiIAAAAAAj//4iIiIiIiIiIiAAAAAAI///4iIiIiIiIiIgAAAAACP///4iIiIiIiIiIAAAAAAj/////iIiIiIiIiAAAAAAI//////iIiIiIiIgAAAAACP//////iIiIiIiIAAAAAAj///////+IiIiIiAAAAAAI/////////4iIiIgAAAAACP////////+IiIiIAAAAAAj//////////4iIiAAAAAAI////////////iIgAAAAACP////////////iIAAAAAAj/////////////iAAAAAAI/////////////4gAAAAACP////////////+IAAAAAAj/////////////iAAAAAAI/////////////4gAAAAACP////////////+IAAAAAAj/////////////iAAAAAAI/////////////4gAAAAACP////////////+IAAAAAAj///////////iIiAQAAAAI//////////+OZmdEAAAAD///////////iO52RAAAAA///////////4jnZEYAAAAP//////////+IdkZAAAAAD///////////iERkAAAAAAiIiIiIiIiIiIgAAAAADwAAAD8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAD8AAAA/AAAAfwAAAP8AAB/w==37:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZ45mZmZmZmZmZmZmZmZmZoiO5mZmZmZmZmZmZmZmZmiIju7mZmZmZmZmZmZmZmaIiI7u7mZmZmZmZmZmZmZoiIiO7u7mZmZmZmZmZmZGiIiIju7u5mRmZmZmZmZkZ4iIiI7u7u5mZmZmZmZmZGiIiIiO7u7u5kZmZmZmZkZ4iIiP/u7u7uZmZmZmZmZGiIiI//ju7u7uZGZmZmZmZ4iIj///ju7u7mZmZmZmZGiIiP+Ij/ju7u5mZmZmZmRoiIj/iIj/ju7u5mZmZmZmeIiIiIiOj/ju7uZmZmZmZniIiIiIjuj/ju7mZmZmZmaIiIiIiI7uj/ju5mZmZmZmiIiIiIiO7uiI7u5mZmZmZoiIiIiIju7u7u7uZmZmZmaIiIiIiI7u7u7u7mZmZmZmiIiIiIiO7u7u7u5mZmZmZnd4iIiIju7u7uZmZmZmZmZmZmeIiI7u7mZmZmZmZmZmZmZmZoiO5mZmZmZmZmZmZmZmZmZnjmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmbAAAADgAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAABwAAAAw==38:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZ45mZmZmZmZmZmZmZmZmZoiO5mZmZmZmZmZmZmZmZmiIju7mZmZmZmZmZmZmZmaIiI7u7mZmZmZmZmZmZmZoiIiO7u7mZmZmZmZmZmZGiIiIju7u5mRmZmZmZmZkZ4iIiI7u7u5mZmZmZmZmZGiIiIiO7u7u5kZmZmZmZkZ4iIiP/u7u7uZmZmZmZmZGiIiI//ju7u7uZGZmZmZmZ4iIj///ju7u7mZmZmZmZGiIiP+Ij/ju7u5mZmZmZmRoiIj/iIj/ju7u5mZmZmZmeIiIiIiOj/ju7uZmZmZmZniIiIiIjuj/ju7mZmZmZmaIiIiIiI7uj/ju5mZmZmZmiIiIiIiO7uiI7u5mZmZmZoiIiIiIju7u7u7uZmZmZmaIiIiIiI7u7u7u7mZmZmZmiIiIiIiO7u7u7u5mZmZmZnd4iIiIju7u7uZmZmZmZmZmZmeIiI7u7mZmZmZmZmZmZmZmZoiO5mZmZmZmZmZmZmZmZmZnjmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmbAAAADgAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAABwAAAAw==39:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"7bd2d0ffa8b4d3ff0256c0fdb800d83eee85d8720fcfb91952b2373fc99889cd","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790331733456,"unified_at":"2026-09-25T10:22:13.456Z","metadata":{"hashes":{"sha256":"7bd2d0ffa8b4d3ff0256c0fdb800d83eee85d8720fcfb91952b2373fc99889cd","sha1":"47bc1a771b921f86c6431a92025f5dda22cddb2d","md5":"b83652050009e6134720d77594c57e0c","sha512":"d49bbf899a575ac4815850c1e7b5e89ff1330a4b106d23a74b0da177129ed7d33ae0c0d4078782cf158569ef320a327cca97ab692a3d8f28f04c85862824261f","ssdeep":"12288:uzhcC9Ib0aodJ5X75Tv9Xb+wCcJazpBm9xqQiqKnbNn4UOPTL:GhFdH5VTtJazqKbNnDOPTL","ssdeep_chunks":["12288:uzhcC9I","12288:zhcC9Ib","12288:hcC9Ib0","12288:cC9Ib0a","12288:C9Ib0ao","12288:9Ib0aod","12288:Ib0aodJ","12288:b0aodJ5","12288:0aodJ5X","12288:aodJ5X7","12288:odJ5X75","12288:dJ5X75T","12288:J5X75Tv","12288:5X75Tv9","12288:X75Tv9X","12288:75Tv9Xb","12288:5Tv9Xb+","12288:Tv9Xb+w","12288:v9Xb+wC","12288:9Xb+wCc","12288:Xb+wCcJ","12288:b+wCcJa","12288:+wCcJaz","12288:wCcJazp","12288:CcJazpB","12288:cJazpBm","12288:JazpBm9","12288:azpBm9x","12288:zpBm9xq","12288:pBm9xqQ","12288:Bm9xqQi","12288:m9xqQiq","12288:9xqQiqK","12288:xqQiqKn","12288:qQiqKnb","12288:QiqKnbN","12288:iqKnbNn","12288:qKnbNn4","12288:KnbNn4U","12288:nbNn4UO","12288:bNn4UOP","12288:Nn4UOPT","12288:n4UOPTL","24576:uzhcC9I","24576:zhcC9Ib","24576:hcC9Ib0","24576:cC9Ib0a","24576:C9Ib0ao","24576:9Ib0aod","24576:Ib0aodJ","24576:b0aodJ5","24576:0aodJ5X","24576:aodJ5X7","24576:odJ5X75","24576:dJ5X75T","24576:J5X75Tv","24576:5X75Tv9","24576:X75Tv9X","24576:75Tv9Xb","24576:5Tv9Xb+","24576:Tv9Xb+w","24576:v9Xb+wC","24576:9Xb+wCc","24576:Xb+wCcJ","24576:b+wCcJa","24576:+wCcJaz","24576:wCcJazp","24576:CcJazpB","24576:cJazpBm","24576:JazpBm9","24576:azpBm9x","24576:zpBm9xq","24576:pBm9xqQ","24576:Bm9xqQi","24576:m9xqQiq","24576:9xqQiqK","24576:xqQiqKn","24576:qQiqKnb","24576:QiqKnbN","24576:iqKnbNn","24576:qKnbNn4","24576:KnbNn4U","24576:nbNn4UO","24576:bNn4UOP","24576:Nn4UOPT","24576:n4UOPTL","12288:GhFdH5V","12288:hFdH5VT","12288:FdH5VTt","12288:dH5VTtJ","12288:H5VTtJa","12288:5VTtJaz","12288:VTtJazq","12288:TtJazqK","12288:tJazqKb","12288:JazqKbN","12288:azqKbNn","12288:zqKbNnD","12288:qKbNnDO","12288:KbNnDOP","12288:bNnDOPT","12288:NnDOPTL"],"imphash":"5e74bffc44f77e405b030c45f2f501a0"},"file_info":{"file_name":"b83652050009e6134720d77594c57e0c.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":582416,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1503995390000,"last_seen":1657724362000,"last_multi_scan":1657724362000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":8,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":34,"suspicious_count":32,"malicious_count":8,"total":74},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"malicious","threat_name":"Unavailable (production)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/grayware_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/SafeBytes.A potentially unwanted application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_95","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"malicious","threat_name":"Unavailable (production)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Trojan.Delf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 44920-2709-1002C7DB","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"UPX0\" is zero\n Raw size of \".ndata\" is zero\n Raw size of \".data\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00014207-00002668-6780-4246-00415948\n GetLocalTime@KERNEL32.DLL at 00014207-00002668-6780-7244-004158F8\n GetLocalTime@KERNEL32.dll at 44920-1576-10088734\n GetSystemTimeAsFileTime@KERNEL32.dll at 44920-1592-10087B69\n GetLocalTime@KERNEL32.dll at 44920-1596-100877B4\n GetLocalTime@KERNEL32.dll at 44920-1598-100876E6\n GetLocalTime@KERNEL32.dll at 44920-1578-1008864B\n GetLocalTime@KERNEL32.dll at 44920-1564-100888D9\n GetSystemTimeAsFileTime@KERNEL32.dll at 44920-2774-10017C1F\n GetSystemTimeAsFileTime@KERNEL32.dll at 44920-4991-1002C662\n GetSystemTimeAsFileTime@KERNEL32.dll at 13625-2171-10079DC0\n GetSystemTimeAsFileTime@KERNEL32.dll at 13625-2607-10053080\n GetSystemTimeAsFileTime@KERNEL32.dll at 13625-3346-1007A1E0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00014207-00002668-6780-6394-004C2DE0\n GetTimeZoneInformation@KERNEL32.dll at 44920-1592-10087B69","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00014207-00002668-6780-1065-00409D34\n GetVersion@KERNEL32.DLL at 00014207-00002668-6780-1069-00408648\n GetVersionExW@KERNEL32.DLL at 00014207-00002668-6780-2364-004E18A9\n GetVersion@KERNEL32.DLL at 00014207-00002668-6780-5728-0047879C\n GetVersionExW@KERNEL32.DLL at 00014207-00002668-6780-10364-0040C1E0\n GetVersionExW@KERNEL32.DLL at 00014207-00002668-6780-7373-00418EC8\n GetVersion@KERNEL32.DLL at 00014207-00002668-6780-7388-0053DB30\n GetVersionExW@KERNEL32.DLL at 00027405-00003224-33206-58-004063AC\n GetVersion@KERNEL32.DLL at 00027405-00003224-33206-15-00406805","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetUserDefaultUILanguage@KERNEL32.DLL at 00014207-00002668-6780-1191-00409408\n GetUserDefaultUILanguage@KERNEL32.DLL at 00014207-00002668-6780-1192-004093AC\n GetUserDefaultLCID@KERNEL32.dll at 13625-2737-1003FDE0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00014207-00002668-6780-4895-00413774\n GetDiskFreeSpaceW@KERNEL32.DLL at 00027405-00003224-33206-86-004044A5\n GetDiskFreeSpaceA@KERNEL32.dll at 44920-1985-1007E17F\n GetDiskFreeSpaceExW@KERNEL32.dll at 55928-501-1002E612","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$24","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$25","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"paiF2AC.tmp\" queries volume information of \"C:\\\" at 00027405-00003224-0000010C-85469121\n \"paiF2AC.tmp\" queries volume information of \"C:\\\" at 00027405-00003224-0000010C-85530617","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"paiF2AC.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\PAIF2AC.TMP\")\n \"paiF2AC.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\PAIF2AC.TMP\")\n \"Plumbytes.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WISPTIS.EXE\")\n \"Plumbytes.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WISPTIS.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/41 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$26","origin":"Registry Access","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$27","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"plumbytes.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"92.122.122.160:80\"\n \"45.55.29.117:80\"\n \"45.55.29.117:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\Drive\\Projects\\PBA\\trunk\\GUI\\AntiMalware\\obj\\Release\\Plumbytes.pdb\"\n \"msvcr120.i386.pdb\"\n \"c:\\MvvmLight\\Source\\GalaSoft.MvvmLight\\GalaSoft.MvvmLight.Extras (NET4)\\obj\\Release\\GalaSoft.MvvmLight.Extras.pdb\"\n \"X:\\DEV\\AV2\\01_CODE\\AMW\\ReleaseXP-Win32-v120_xp\\CmdProxy.pdb\"\n \"msvcp120.i386.pdb\"\n \"c:\\Development\\Releases\\Json\\Working\\Newtonsoft.Json\\Src\\Newtonsoft.Json\\obj\\Release\\Net40\\Newtonsoft.Json.pdb\"\n \"e:\\Repositories\\Open Source\\evolve.net\\WPF\\NotifyIcon\\Source\\NotifyIconWpf\\obj\\Release\\Hardcodet.Wpf.TaskbarNotification.pdb\"\n \"D:\\Projects\\NSISDotNetChecker\\plugin\\Release\\DotNetChecker.pdb\"\n \"X:\\DEV\\AV2\\01_CODE\\AMW\\ReleaseXP-Win32-v120_xp\\PCRE_16.pdb\"\n \"e:\\ExpressionRTM\\Sparkle\\SDK\\BlendWPFSDK\\Build\\Intermediate\\Release\\Libraries\\System.Windows.Interactivity\\Win32\\Release\\System.Windows.Interactivity.pdb\"\n \"X:\\DEV\\AV2\\01_CODE\\AMW\\ReleaseXP-Win32-v120_xp\\Scan.pdb\"\n \"C:\\Development\\PBAntimalware\\trunk\\GUI\\Infralution.Localization.Wpf\\obj\\Debug\\Infralution.Localization.Wpf.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\paiF2AC.tmp\"\n \"paiF2AC.tmp\" created file \"%TEMP%\\nso3A2F.tmp\\System.dll\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Plumbytes_Installer\"\n \"Local\\c:!users!anldxfm!appdata!local!microsoft!windows!history!history.ie5!\"\n \"IESQMMUTEX_0_208\"\n \"Local\\c:!users!anldxfm!appdata!roaming!microsoft!windows!cookies!\"\n \"IESQMMUTEX_0_191\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\c:!users!anldxfm!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\_!MSFTHISTORY!_\"\n \"RasPbFile\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\WininetStartupMutex\"\n \"Plumbytes_Installer\"\n \"Local\\WininetConnectionMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208\"\n \"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_191\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!anldxfm!appdata!roaming!microsoft!windows!cookies!\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$28","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /download/nsis/20160324_vA.exe HTTP/1.1\nUser-Agent: Plumbytes Installer Version/1.10\nHost: 45.55.29.117\nCache-Control: no-cache\"\n \"GET /download/nsis/20160324_vA.exe HTTP/1.1\nUser-Agent: Plumbytes Installer Version/1.10\nHost: 45.55.29.117\"\n \"GET /download/nsis/20160324_vA.exe HTTP/1.1\nUser-Agent: Plumbytes Installer Version/1.10\nAccept: */*\nConnection: keep-alive\nRange: bytes=0-\nHost: 45.55.29.117\nCache-Control: no-cache\"\n \"GET /logs.php?cuid=affiliatewire_pcrisk-asubid_pcrisk_com HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: plumbytes.com\nConnection: Keep-Alive\nCache-Control: no-cache\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"Plumbytes.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 6A2F0000\n \"Plumbytes.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll\" at 67DF0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"paiF2AC.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Plumbytes.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"rundll32.exe\" with commandline \"\"%WINDIR%\\system32\\wininet.dll\",DispatchAPICall 1\" (UID: 00025673-00002968)\n Spawned process \"paiF2AC.tmp\" with commandline \"/S\" (UID: 00027405-00003224)\n Spawned process \"Plumbytes.exe\" (UID: 00030734-00003324)\n Spawned process \"wisptis.exe\" with commandline \"/ManualLaunch;\" (UID: 00031408-00000976)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US\" (SHA1: 4E:82:36:5E:7E:B5:96:6D:76:47:CB:57:CC:EC:DC:32:C2:F9:D5:04; see report for more information)\n The input sample is signed with a certificate issued by \"CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU=\"c 2006 VeriSign\n Inc. - For authorized use only\", OU=VeriSign Trust Network, O=\"VeriSign\n Inc.\", C=US\" (SHA1: 00:77:90:F6:56:1D:AD:89:B0:BC:D8:55:85:76:24:95:E3:58:F8:A5; see report for more information)","origin":"Certificate Data","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"paiF2AC.tmp\" connecting to \"\\ThemeApiPort\"\n \"Plumbytes.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$29","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2a","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2b","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"i&{z+v+\"","origin":"Network Traffic","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"paiF2AC.tmp\" opened \"\\Device\\KsecDD\"\n \"Plumbytes.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"$2c","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"Plumbytes.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"UPX1 with unusual entropies 7.9285152389","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"b83652050009e6134720d77594c57e0c.exe.bin\" has a section named \"UPX0\"\n \"b83652050009e6134720d77594c57e0c.exe.bin\" has a section named \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"msvcr120.dll.2067320049\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to enumerate services","description":"EnumServicesStatusExW@ADVAPI32.dll at 13625-2477-10053F30","origin":"Hybrid Analysis Technology","relevance":7,"id":"stream-27","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"ECT * FROM Win32_BaseBoard\" (Indicator: \"win32_baseboard\"; File: \"Plumbytes.exe.1318313916\")\n \"CT * FROM Win32_CDROMDrive\" (Indicator: \"win32_cdromdrive\"; File: \"Plumbytes.exe.1318313916\")\n \"ect * from Win32_ComputerSystem\" (Indicator: \"win32_computersystem\"; File: \"Plumbytes.exe.1318313916\")\n \"SELECT ProcessId, ExecutablePath FROM Win32_Process WHERE ProcessId =\" (Indicator: \"win32_process\"; File: \"Infralution.Localization.Wpf.dll.1086519701\")","origin":"File/Memory","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"paiF2AC.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Plumbytes.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"wisptis.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"paiF2AC.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"Plumbytes.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"wisptis.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET INFO SUSPICIOUS Dotted Quad Host MZ Response\" (SID: 2021076, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00014207-00002668-6780-4884-0040D104\n FindResourceW@KERNEL32.DLL at 00014207-00002668-6780-5113-00438CC8\n FindResourceW@KERNEL32.DLL at 00014207-00002668-6780-5101-00433D14\n FreeResource@KERNEL32.DLL at 00014207-00002668-6780-7453-0040B422\n FreeResource@KERNEL32.DLL at 00014207-00002668-6780-11348-00438D34","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"paiF2AC.tmp\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"Plumbytes.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"$2d","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\TOOLBAR\")\n \"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\TOOLBAR\\WEBBROWSER\")\n \"paiF2AC.tmp\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"paiF2AC.tmp\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"PLUMBYTES ANTI-MALWARE\"; Value: \"\"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\plumbytes.exe\" /tray\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.1.2\"\n Heuristic match: \"GET /download/nsis/20160324_vA.exe HTTP/1.1\nUser-Agent: Plumbytes Installer Version/1.10\nHost: 45.55.29.117\nCache-Control: no-cache\n\ns\"\n Heuristic match: \"GET /download/nsis/20160324_vA.exe HTTP/1.1\nUser-Agent: Plumbytes Installer Version/1.10\nHost: 45.55.29.117\n\nt\"\n Heuristic match: \"GET /download/nsis/20160324_vA.exe HTTP/1.1\nUser-Agent: Plumbytes Installer Version/1.10\nAccept: */*\nConnection: keep-alive\nRange: bytes=0-\nHost: 45.55.29.117\nCache-Control: no-cache\n\nu\"\n \"255.255.255.255\"\n \"127.0.0.1\"\n Heuristic match: \"http://45.55.29.117/download/nsis/20160324_vA.exe\"\n \"7.0.0.1\"\n \"45.55.29.117\"\n \"1.0.1.9\"\n \"1.2.13.0\"\n \"1.0.5.0\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): NSIS_Inetc (Mozilla)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.DLL at 00014207-00002668-6780-6621-004DE4F0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"SELECT * FROM Win32_UserAccount\" (Indicator: \"win32_useraccount\")","origin":"File/Memory","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"paiF2AC.tmp\" had access to \"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00014207-00002668-6780-3388-00473A84\n OpenClipboard@USER32.DLL at 00027405-00003224-33206-91-004050CD","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetKeyboardState@USER32.DLL at 00014207-00002668-6780-5878-0048F104\n GetKeyboardState@USER32.DLL at 00014207-00002668-6780-5933-004935E0\n GetAsyncKeyState@USER32.DLL at 00027405-00003224-33206-86-004044A5","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\b83652050009e6134720d77594c57e0c.exe\" marked \"%TEMP%\\nsp38F7.tmp\" for deletion\n \"%TEMP%\\paiF2AC.tmp\" marked \"%TEMP%\\nso3A2F.tmp\" for deletion\n \"%TEMP%\\paiF2AC.tmp\" marked \"%TEMP%\\Cab86B5.tmp\" for deletion\n \"%TEMP%\\paiF2AC.tmp\" marked \"%TEMP%\\Tar86B6.tmp\" for deletion\n \"%TEMP%\\paiF2AC.tmp\" marked \"%TEMP%\\nsq3A80.tmp\" for deletion\n \"%TEMP%\\paiF2AC.tmp\" marked \"%TEMP%\\nso3A2F.tmp\\DotNetChecker.dll\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\nsp38F7.tmp\" with delete access\n \"paiF2AC.tmp\" opened \"%TEMP%\\nso3A2F.tmp\" with delete access\n \"paiF2AC.tmp\" opened \"%TEMP%\\Cab86B5.tmp\" with delete access\n \"paiF2AC.tmp\" opened \"%TEMP%\\Tar86B6.tmp\" with delete access\n \"paiF2AC.tmp\" opened \"%TEMP%\\nsq3A80.tmp\" with delete access\n \"paiF2AC.tmp\" opened \"%TEMP%\\nso3A2F.tmp\\DotNetChecker.dll\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetSecurityDescriptorDacl@ADVAPI32.dll at 13625-2622-1001FCC0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$2e","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"$2f","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"paiF2AC.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"Plumbytes.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"b83652050009e6134720d77594c57e0c.exe.bin\" claimed CRC 634189 while the actual is CRC 624051\n \"uninstall.exe\" claimed CRC 20350081 while the actual is CRC 241461\n \"Infralution.Localization.Wpf.dll\" claimed CRC 90665 while the actual is CRC 64649\n \"Newtonsoft.Json.dll\" claimed CRC 520018 while the actual is CRC 90665\n \"Plumbytes.exe\" claimed CRC 2288473 while the actual is CRC 353908\n \"GalaSoft.MvvmLight.Extras.dll\" claimed CRC 39223 while the actual is CRC 35660\n \"msvcr120.dll\" claimed CRC 1028896 while the actual is CRC 39223\n \"log4net.dll\" claimed CRC 331943 while the actual is CRC 102369\n \"System.Windows.Interactivity.dll\" claimed CRC 68742 while the actual is CRC 331943\n \"msvcp120.dll\" claimed CRC 489709 while the actual is CRC 125490\n \"AmwService.exe\" claimed CRC 162347 while the actual is CRC 39837\n \"GalaSoft.MvvmLight.dll\" claimed CRC 84288 while the actual is CRC 162347\n \"nsProcess.dll\" claimed CRC 55001 while the actual is CRC 157586\n \"mfc120u.dll\" claimed CRC 4509553 while the actual is CRC 55001","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"b83652050009e6134720d77594c57e0c.exe.bin\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$30","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$31","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"paiF2AC.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"Plumbytes.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"Plumbytes.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/65 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"3/84 Antivirus vendors marked dropped file \"uninstall.exe\" as malicious (classified as \"PUP.Optional\" with 3% detection rate)\n 1/57 Antivirus vendors marked dropped file \"PCRE_16.dll\" as malicious (classified as \"W32.eHeur\" with 1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Scans for the windows taskbar (often used for explorer injection)","description":"\"Plumbytes.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":5,"id":"api-17","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$32","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: Plumbytes Installer Version/1.10\n NSIS_Inetc (Mozilla)","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$33","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$34","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00027405-00003224-33206-1-00403883","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Spyware","details_count":3,"details":[{"detail":"Accesses potentially sensitive information from local browsers"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"}],"sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":53,"imported_dlls_count":157,"dropped_files_count":0,"extracted_files_count":29,"files_written_count":147,"files_deleted_count":0,"registry_keys_created_count":25,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":25,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":1,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"59a523a486fe16cf2d0e6cd4","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"PUP.Optional","contacted_countries":["EU","USA"],"submit_name":"b83652050009e6134720d77594c57e0c.exe","analysis_start_time":"2017-08-29T09:18:04+00:00","indicators_count":{"informative":34,"suspicious":47,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"92.122.122.160","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"address":"45.55.29.117","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"address":"45.55.29.117","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]}],"dns_resolutions":[{"domain":"plumbytes.com","address":"45.55.29.117","country":"United States","registrar_name":"LAUNCHPAD.COM, INC.","registrar_name_servers":"NS6247.HOSTGATOR.COM","registrar_creation_date":"2014-01-15T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]}],"http_requests":[{"host":"45.55.29.117","host_ip":"45.55.29.117:80","url":"/download/nsis/20160324_vA.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /download/nsis/20160324_vA.exe HTTP/1.1\nUser-Agent: Plumbytes Installer Version/1.10\nHost: 45.55.29.117\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"host":"plumbytes.com","host_ip":"45.55.29.117:80","url":"/logs.php?cuid=affiliatewire_pcrisk-asubid_pcrisk_com","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /logs.php?cuid=affiliatewire_pcrisk-asubid_pcrisk_com HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: plumbytes.com\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}],"processes":[{"pid":2668,"ppid":0,"name":"b83652050009e6134720d77594c57e0c.exe","command_line":"","sha256":"7bd2d0ffa8b4d3ff0256c0fdb800d83eee85d8720fcfb91952b2373fc99889cd","normalized_path":"C:\\b83652050009e6134720d77594c57e0c.exe","uid":"00014207-00002668","icon":"$35"},{"pid":2968,"ppid":2668,"name":"rundll32.exe","command_line":"\"%WINDIR%\\system32\\wininet.dll\",DispatchAPICall 1","sha256":"5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014207-00002668","uid":"00025673-00002968","icon":"$36"},{"pid":3224,"ppid":2668,"name":"paiF2AC.tmp","command_line":"/S","sha256":"f75735379f48e03198d347caeb7777cca79fa458d3bfdc6cfa927d2b84067713","normalized_path":"%TEMP%\\paiF2AC.tmp","parent_uid":"00014207-00002668","uid":"00027405-00003224","icon":"$37"},{"pid":3324,"ppid":3224,"name":"Plumbytes.exe","command_line":"","sha256":"fda377fb824d608318b71f2b0e3160d38c11b830c5c9b9eba318eddc74718319","normalized_path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\Plumbytes.exe","parent_uid":"00027405-00003224","uid":"00030734-00003324","icon":"$38"},{"pid":976,"ppid":3324,"name":"wisptis.exe","command_line":"/ManualLaunch;","sha256":"1bfc52175addcb6834b638f1d026cbae6d90c3bbfab6e8a06d9273c182ca18e3","normalized_path":"%WINDIR%\\System32\\wisptis.exe","parent_uid":"00030734-00003324","uid":"00031408-00000976","icon":"$39"}],"all_imported_dlls":["comctl32.dll","version.dll","DWrite.dll","PresentationFramework.Aero.ni.dll","cryptbase.dll","dwmapi.dll","apphelp.dll","System.Windows.Interactivity.dll","NapiNSP.dll","dhcpcsvc.dll","icm32.dll","sechost.dll","clbcatq.dll","sspicli.dll","imagehlp.dll","propsys.dll","msxml3.dll","bcryptprimitives.dll","devrtl.dll","gpapi.dll","cscapi.dll","netutils.dll","PresentationFramework-SystemCore.dll","wtsapi32.dll","Tabbtn.dll","clr.dll","nlssorting.dll","winsta.dll","winhttp.dll","cabinet.dll","ntdll.dll","nsProcess.dll","WSHTCPIP.DLL","advapi32.dll","user32.dll","d3d8thk.dll","UIAutomationCore.dll","uxtheme.dll","cfgmgr32.dll","devobj.dll","wintrust.dll","Hardcodet.Wpf.TaskbarNotification.dll","PresentationFramework-SystemXml.dll","WMINet_Utils.dll","usp10.dll","msctf.dll","dnsapi.dll","wship6.dll","winrnr.dll","AcLayers.dll","mscoree.dll","log4net.dll","pnrpnsp.dll","GalaSoft.MvvmLight.Extras.dll","imm32.dll","gdi32.dll","wshqos.dll","setupapi.dll","DotNetChecker.dll","PresentationCore.ni.dll","winmm.dll","oleaut32.dll","nlaapi.dll","rasadhlp.dll","msctfui.dll","KernelBase.dll","normaliz.dll","dhcpcsvc6.dll","ntshrui.dll","System.ni.dll","System.Xml.ni.dll","mscms.dll","mscorrc.dll","oleaccrc.dll","TabbtnEx.dll","rtutils.dll","rpcrt4.dll","ncrypt.dll","PresentationFramework.ni.dll","CmdProxy.dll","msvcr120.dll","psapi.dll","System.Management.ni.dll","hid.dll","kernel32.dll","ole32.dll","PresentationNative_v0400.dll","GalaSoft.MvvmLight.dll","WindowsCodecsExt.dll","ntmarta.dll","mswsock.dll","netprofm.dll","UIAutomationTypes.dll","PenIMC.dll","tpcps.dll","iertutil.dll","shlwapi.dll","rasapi32.dll","INetC.dll","secur32.dll","cryptnet.dll","slc.dll","msimg32.dll","wininet.dll","Wldap32.dll","credssp.dll","linkinfo.dll","oleacc.dll","urlmon.dll","userenv.dll","mscoreei.dll","clrjit.dll","powrprof.dll","msvcp120.dll","GdiPlus.dll","ws2_32.dll","FWPUCLNT.DLL","System.Xaml.ni.dll","rpcss.dll","shell32.dll","crypt32.dll","IPHLPAPI.DLL","bcrypt.dll","winnsi.dll","SensApi.dll","mpr.dll","shfolder.dll","System.dll","mscorlib.dll","mscorlib.ni.dll","WindowsFormsIntegration.dll","RpcRtRemote.dll","webio.dll","msvcr120_clr0400.dll","System.Windows.Forms.ni.dll","lpk.dll","nsi.dll","cryptsp.dll","rsaenh.dll","npmproxy.dll","msxml3r.dll","srvcli.dll","WindowsBase.ni.dll","msasn1.dll","System.Configuration.ni.dll","WindowsCodecs.dll","Infralution.Localization.Wpf.dll","System.Drawing.ni.dll","tzres.dll","d3d9.dll","msvcrt.dll","schannel.dll","System.Core.ni.dll","profapi.dll","rasman.dll","wpfgfx_v0400.dll","Magnification.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"PCRE_16.dll","sha256":"3397871392c769e5431d9b81477c81b3f39cbd03b9f198e42571ff7119f00aa5","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"uninstall.exe","sha256":"850540f8084b4abefc8c855946195327f0d4153e37083e29caca1a732388aa5a","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"AmwService.exe","sha256":"be483a2673f8ab906d6ecf462cf941cf0506cbf7b3a90ec538bb56ebdf8c9bd0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"CmdProxy.dll","sha256":"2e0aa3f71bbd7e233a365c02e0923507758d61f268615dd254813b47c8cdb8d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"DB.dll","sha256":"da7d310b296d4471fd85f9c992edd5fb66f9e93258b0f430bf7d6b0d91210fa3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"GalaSoft.MvvmLight.Extras.dll","sha256":"5241539f3a76771196d20e40560bf4278a444459d8b4a555b36d9cfa9c01c0a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"GalaSoft.MvvmLight.dll","sha256":"f0c58bf2d5296554dc6fab35067e49b899d5be0078d0359664b987cee31e65f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Hardcodet.Wpf.TaskbarNotification.dll","sha256":"5bc02d16af29da4c39227e8fe1a44869b57e76196c1432ad01e797965a250e33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Infralution.Localization.Wpf.dll","sha256":"ce55fd0bc7aed811c92380fb15f1c72910dbecf10b758e5159bc537108c8f462","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Newtonsoft.Json.dll","sha256":"35c94923250929d5ee2c4fff30fdec672526838f926d23c3a4e6ce0f2cc6f42e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Plumbytes.exe","sha256":"fda377fb824d608318b71f2b0e3160d38c11b830c5c9b9eba318eddc74718319","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Scan.dll","sha256":"32a30b03450a7b9207b23d68bc552797b7a60000702e52260dbe1b058b33f748","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"System.Windows.Interactivity.dll","sha256":"4aace8c8a330ae8429cd8cc1b6804076d3a9ffd633470f91fd36bdd25bb57876","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"log4net.dll","sha256":"ce6ee4fdc783a5bf905f240178ac96eaeb7ede22ffe06a06ba179cd1a0442bd3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"msvcp120.dll","sha256":"87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"msvcr120.dll","sha256":"86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"DotNetChecker.dll","sha256":"83bcd897afd352aa441b651457b648b0a761fa6b96f347079a7cbe99e8b3399a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"INetC.dll","sha256":"c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"System.dll","sha256":"7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Plumbytes Anti-Malware.lnk","sha256":"bcc0edd4faab2fa87180c09c2332546c8adeb158809f5b688d4d323dc0aef19d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Uninstall.lnk","sha256":"f22e75a7924eebbef29c6ae25ff6ce3e0d9c948a0ada7976b5b87a73e47c85e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"1BB09BEEC155258835C193A7AA85AA5B_9E8B8D037528CC697C0E191F75DF840F","sha256":"1eae592b5739669dc2b5c5740b3e40675d1d62e5c91dad0ac2ed6a7f42a7d86a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220","sha256":"8aaf92f09267b866d6fbbe7b665cd2ca3dd85c5240d6291784bd9b6a92126817","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4","sha256":"4aaddaf7339c2df54dabd2b3bfc53f9355e1f14b2b99513030e51985afb37205","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"F0060A9F9287878B15AB61E0E47645E5","sha256":"82c1624504113c22f194f8dbcf14059c5bc1d9417f69ee063f313907f0132dcf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Zlib.dll","sha256":"e077fba0eeb59b839118d1ccbc712a01df30ec9b3bff030f886efe8809bc77fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"mfc120u.dll","sha256":"c2d0e285e2333a9c620be04a5747881af0d5615da32226886e659ff31a9761cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Plumbytes.resources.dll","sha256":"09e254ce42b843c391b7786ce408225c7f59c45ba15a0179766276448c0ef4a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"nsProcess.dll","sha256":"30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]}],"files_written":[{"path":"%WINDIR%\\system32\\en-US\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\WinSxS\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\comctl32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"C:\\b83652050009e6134720d77594c57e0c.exe","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\20160324_vA[1].exe","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\BPL0BFI3\\20160324_vA[1].exe","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\system32\\rundll32.exe","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\system32\\en-US\\rundll32.exe.mui","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Low\\index.dat","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%TEMP%\\paiF2AC.tmp","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%TEMP%\\nso3A2F.tmp","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%TEMP%\\nsq3A80.tmp","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\system32\\en-US\\CRYPT32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_76125806E8CF735FD0B67DD73E892015","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\3B6E683A7A45CC59BF035C9BA8C7AB9D","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\system32\\en-US\\WINHTTP.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_1790C2BABAA04BAF417FFE9589C10997","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC42971B7939A9CA55C44CFC893D7C1D","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_34B8E22AFC743FBE826037F2647215F3","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_9E8B8D037528CC697C0E191F75DF840F","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_9E8B8D037528CC697C0E191F75DF840F","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%TEMP%\\paiF2AC.tmp.config","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\Newtonsoft.Json.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\AmwService.exe","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\DB.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\mfc120u.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\msvcp120.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\msvcr120.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\PCRE_16.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\Scan.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\Zlib.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\de\\Plumbytes.resources.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\es-ES\\Plumbytes.resources.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\fr\\Plumbytes.resources.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\it\\Plumbytes.resources.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\nl\\Plumbytes.resources.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\pt-BR\\Plumbytes.resources.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\vx.db3","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\F0060A9F9287878B15AB61E0E47645E5","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F0060A9F9287878B15AB61E0E47645E5","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%USERPROFILE%\\Desktop\\Plumbytes Anti-Malware.lnk","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"C:\\Users\\AnLDXfM","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Plumbytes Anti-Malware","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Plumbytes Anti-Malware\\Plumbytes Anti-Malware.lnk","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Plumbytes Anti-Malware\\Uninstall.lnk","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\uninstall.exe","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\Plumbytes.exe.config","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\Plumbytes.exe","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Presentatio5ae0f00f#\\6fb6d9ec7412b54799cb3fb10d0e0c29\\PresentationFramework.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\WindowsBase\\a95541c6e46a635c044747300f8e7e8a\\WindowsBase.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\250e8e6af918e7ca66787117bc8633e3\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\PresentationCore\\dfe067e9fa869fcfa7aec8a7c0dfce58\\PresentationCore.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xaml\\ba916c4d64bb74edc62c5e8b8c081ade\\System.Xaml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\75790ba48ebfa82fae7da9a114bc9886\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\SortDefault.nlp","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\log4net.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\7152ca3b4e8d992fb4be5317321c2ee5\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\870a651e78e8d414b516df1ecae18884\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\GalaSoft.MvvmLight.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\Hardcodet.Wpf.TaskbarNotification.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\Infralution.Localization.Wpf.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\24db7e31c7ba5b0e824e2f521c0914bc\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\WindowsForm0b574481#\\8ea4f2a14f034a52843ddf37991c9f6d\\WindowsFormsIntegration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\WindowsFormsIntegration\\v4.0_4.0.0.0__31bf3856ad364e35\\WindowsFormsIntegration.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\system32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Presentatio84a6349c#\\6c0984e58c9ef168f060775aa8a7a198\\PresentationFramework-SystemCore.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\PresentationFramework-SystemCore\\v4.0_4.0.0.0__b77a5c561934e089\\PresentationFramework-SystemCore.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Presentatio1c9175f8#\\652647ac21f3003678c99dc67558c634\\PresentationFramework.Aero.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\System.Windows.Interactivity.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%PROGRAMFILES%\\Plumbytes Software\\Plumbytes Anti-Malware\\GalaSoft.MvvmLight.Extras.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\system32\\spool\\drivers\\color\\sRGB Color Space Profile.icm","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Presentatio49d6fefe#\\dcf2b1a7011858156e5b759de2e5e598\\PresentationFramework-SystemXml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\PresentationFramework-SystemXml\\v4.0_4.0.0.0__b77a5c561934e089\\PresentationFramework-SystemXml.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\UIAutomationTypes\\fedb1433422296012c8ce48902458bf1\\UIAutomationTypes.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\UIAutomationTypes\\v4.0_4.0.0.0__31bf3856ad364e35\\UIAutomationTypes.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\{698D0BA5-6E4B-44BD-9F9A-AA32F2E98D9A}","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\{698D0BA5-6E4B-44BD-9F9A-AA32F2E98D9A}\\ScanLogs.xml","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\system32\\en-US\\PROPSYS.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\8990487b8c05ada1e1febe7dcb6c0410\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\SYSTEM32\\wisptis.exe","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\a28d99c0b82e7decf411fb2587cce83f\\System.Management.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\SYSTEM32\\en-US\\WISPTIS.EXE.mui","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\SYSTEM32\\WISPTIS.EXE","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\SYSTEM32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\system32\\en-US\\tabbtn.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUI.TTF","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"%WINDIR%\\system32\\en-US\\msctfui.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"key":"HKLM\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\PAIF2AC_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\PAIF2AC_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\DIRECT3D\\MOSTRECENTAPPLICATION\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\PLUMBYTES_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\PLUMBYTES_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WISP\\TOUCH\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WISP\\TOUCH\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WISP\\PEN\\SYSEVENTPARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WISP\\PEN\\PERSIST\\0\\1\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WISP\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WISP\\PEN\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WISP\\PEN\\PERSIST\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WISP\\PEN\\PERSIST\\0\\","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Plumbytes_Installer","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Local\\c:!users!anldxfm!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Local\\c:!users!anldxfm!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Local\\c:!users!anldxfm!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Plumbytes_Installer","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!anldxfm!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!anldxfm!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!anldxfm!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_LOW!_","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!anldxfm!appdata!roaming!microsoft!windows!cookies!low!","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!anldxfm!appdata!local!microsoft!windows!history!low!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!anldxfm!appdata!local!microsoft!windows!temporary internet files!low!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Local\\_!MSFTHISTORY!_LOW!_","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Local\\c:!users!anldxfm!appdata!local!microsoft!windows!temporary internet files!low!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Local\\c:!users!anldxfm!appdata!local!microsoft!windows!history!low!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Local\\c:!users!anldxfm!appdata!roaming!microsoft!windows!cookies!low!","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Plumbytes Anti-Malware 2016","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Plumbytes Anti-Malware 2016","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Local\\c:!users!anldxfm!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!anldxfm!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Global\\{743CDAB1-71B7-453A-B79F-8E8D8FE44204}","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Local\\__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Global\\{822C1381-802E-4DFD-9669-0320B7F7BF7B}","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"Local\\__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{822C1381-802E-4DFD-9669-0320B7F7BF7B}","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{743CDAB1-71B7-453A-B79F-8E8D8FE44204}","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{773F1B9A-35B9-4E95-83A0-A210F2DE3B37}-Default","sources":[{"report_type":"sandbox","report_id":"59a523a486fe16cf2d0e6cd4"}]}]}},"report_ids":{"sandbox_job_ids":["59a523a486fe16cf2d0e6cd4"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Malware.Generic Sample 7bd2d0ffa8b4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7bd2d0ffa8b4…. Malware family: Malware.Generic. Threat score 100/100. 8/29 AV engines flagged this file. 8 malicious and 32 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7bd2d0ffa8b4d3ff0256c0fdb800d83eee85d8720fcfb91952b2373fc99889cd"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware.Generic Sample 7bd2d0ffa8b4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7bd2d0ffa8b4…. Malware family: Malware.Generic. Threat score 100/100. 8/29 AV engines flagged this file. 8 malicious and 32 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7bd2d0ffa8b4d3ff0256c0fdb800d83eee85d8720fcfb91952b2373fc99889cd"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware.Generic Sample 7bd2d0ffa8b4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7bd2d0ffa8b4…. Malware family: Malware.Generic. Threat score 100/100. 8/29 AV engines flagged this file. 8 malicious and 32 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3a","11",{}]]