21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 26:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T437,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 8ca84effb556… — Score 68/100 — Hybrid Analysis","description":"Malicious verdict for sample 8ca84effb556…. Threat score 68/100. 2/28 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8ca84effb556838d2311e10206688ab6142c8ce31a474ca05cb26b756ee45218","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","8ca84effb556838d2311e10206688ab6142c8ce31a474ca05cb26b756ee45218"],"about":{"@type":"SoftwareApplication","name":"DuplicateFilesFixer.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"8ca84effb556838d2311e10206688ab6142c8ce31a474ca05cb26b756ee45218","additionalType":"Malicious sample"},"threatScore":68,"antivirusDetections":{"malicious":2,"total":28},"behavioralIndicators":{"malicious":2,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:Tbda,"7*.**.*-1-1010-1-17-13*.odt;*.ott;*.oth;*.odm;*.sxw;*.stw;*.sxg;*.doc;*.dot;*.docx;*.docm;*.dotx;*.dotm;*.wpd;*.wps;*.rtf;*.csv;*.sdw;*.sgl;*.vor;*.uot;*.uof;*.jtd;*.jtt;*.hwp;*.602;*.pdb;*.psw;*.xls;*.xlw;*.xlt;*.xlsx;*.xlsm;*.xltx;*.xltm;*.xlsb;*.wk1;*.wks;*.123;*.dif;*.sdc;*.dbf;*.slk;*.uos;*.pxl;*.wb2;*.ppt;*.pps;*.pot;*.pptx;*.pptm;*.potx;*.potm;*.sdd;*.sdp;*.uop;*.cgm;*.pdf;*.txt;*.mdb;*.accdb;*.odt;*.ott;*.oth;*.odm;*.sxw;*.stw;*.sxg;*.doc;*.dot;*.docx;*.docm;*.dotx;*.dotm;*.wpd;*.wps;*.rtf;*.csv;*.sdw;*.sgl;*.vor;*.uot;*.uof;*.jtd;*.jtt;*.hwp;*.602;*.pdb;*.psw;*.xls;*.xlw;*.xlt;*.xlsx;*.xlsm;*.xltx;*.xltm;*.xlsb;*.wk1;*.wks;*.123;*.dif;*.sdc;*.dbf;*.slk;*.uos;*.pxl;*.wb2;*.ppt;*.pps;*.pot;*.pptx;*.pptm;*.potx;*.potm;*.sdd;*.sdp;*.uop;*.cgm;*.pdf;*.txt;*.mdb;*.accdb;-1-10-10-1-13-14*.raw;*.wmp;*.tif;*.tiff;*.pict;*.cdr;*.bmp;*.gif;*.jpeg;*.jpg;*.ofx;*.pub;*.ps;*.psd;*.qxd;*.png;*.eps;*.dwg;*.dxf;*.ico;*.indd;*.iges;*.cr2;*.3ds;*.pcx;*.sgv;*.wmf;*.met;*.pgm;*.ras;*.svm;*.xbm;*.emf;*.pbm;*.plt;*.sda;*.tga;*.xpm;*.pcd;*.pct;*.ppm;*.sgf;*.raw;*.wmp;*.tif;*.tiff;*.pict;*.cdr;*.bmp;*.gif;*.jpeg;*.jpg;*.ofx;*.pub;*.ps;*.psd;*.qxd;*.png;*.eps;*.dwg;*.dxf;*.ico;*.indd;*.iges;*.cr2;*.3ds;*.pcx;*.sgv;*.wmf;*.met;*.pgm;*.ras;*.svm;*.xbm;*.emf;*.pbm;*.plt;*.sda;*.tga;*.xpm;*.pcd;*.pct;*.ppm;*.sgf;-1-10-10-1-14-15*.wma;*.ses;*.ram;*.m4a;*.m4b;*.m4p;*.mid;*.midi;*.mp2;*.mp3;*.mso;*.ogg;*.cda;*.all;*.amr;*.ape;*.asf;*.aif;*.aiff;*.au;*.audiocd;*.dm;*.dss;*.dvf;*.wav;*.flac;*.aac;*.wma;*.ses;*.ram;*.m4a;*.m4b;*.m4p;*.mid;*.midi;*.mp2;*.mp3;*.mso;*.ogg;*.cda;*.all;*.amr;*.ape;*.asf;*.aif;*.aiff;*.au;*.audiocd;*.dm;*.dss;*.dvf;*.wav;*.flac;*.aac;-1-10-10-1-15-16*.3g;*.3gp;*.3gpp;*.avi;*.divx;*.dv;*.f4v;*.flv;*.m2ts;*.m4v;*.mkv;*.mod;*.mov;*.mp4;*.mpe;*.mpeg;*.mpeg4;*.mpg;*.mts;*.nsv;*.ogm;*.ogv;*.qt;*.tod;*.ts;*.vob;*.wmv;*.rm;*.rmvb;*.ifo;*.asx;*.swf;*.avs;*.bsf;*.3g;*.3gp;*.3gpp;*.avi;*.divx;*.dv;*.f4v;*.flv;*.m2ts;*.m4v;*.mkv;*.mod;*.mov;*.mp4;*.mpe;*.mpeg;*.mpeg4;*.mpg;*.mts;*.nsv;*.ogm;*.ogv;*.qt;*.tod;*.ts;*.vob;*.wmv;*.rm;*.rmvb;*.ifo;*.asx;*.swf;*.avs;*.bsf;-1-10-10-1-16-1"23:T760,"DuplicateFilesFixer.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "DuplicateFilesFixer.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "DuplicateFilesFixer.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "DuplicateFilesFixer.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "DuplicateFilesFixer.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "DuplicateFilesFixer.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "DuplicateFilesFixer.exe" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "DuplicateFilesFixer.exe" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config" "DuplicateFilesFixer.exe" touched file "C:\Windows\assembly\pubpol247.dat" "DuplicateFilesFixer.exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll.aux" "DuplicateFilesFixer.exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll.aux" "DuplicateFilesFixer.exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll.aux" "DuplicateFilesFixer.exe" touched file "C:\Windows\System32\rsaenh.dll" "DuplicateFilesFixer.exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll.aux" "DuplicateFilesFixer.exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\d9f0293b9d57900da85de5a4190de717\System.Xaml.ni.dll.aux" "DuplicateFilesFixer.exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll.aux"24:T99e,"DuplicateFilesFixer.exe" wrote bytes "db4d496e00000000" to virtual address "0x01212000" (part of module "DUPLICATEFILESFIXER.EXE") "DuplicateFilesFixer.exe" wrote bytes "b810156d62ffe0" to virtual address "0x74FA11F8" (part of module "SSPICLI.DLL") "DuplicateFilesFixer.exe" wrote bytes "48120000" to virtual address "0x74FA139C" (part of module "SSPICLI.DLL") "DuplicateFilesFixer.exe" wrote bytes "48120000" to virtual address "0x74FA12DC" (part of module "SSPICLI.DLL") "DuplicateFilesFixer.exe" wrote bytes "4812fa74" to virtual address "0x74FB83DC" (part of module "SSPICLI.DLL") "DuplicateFilesFixer.exe" wrote bytes "a0116d62" to virtual address "0x7574E324" (part of module "WININET.DLL") "DuplicateFilesFixer.exe" wrote bytes "f8110000" to virtual address "0x74FA1408" (part of module "SSPICLI.DLL") "DuplicateFilesFixer.exe" wrote bytes "b890126d62ffe0" to virtual address "0x74FA1248" (part of module "SSPICLI.DLL") "DuplicateFilesFixer.exe" wrote bytes "4812fa74" to virtual address "0x74FB8348" (part of module "SSPICLI.DLL") "DuplicateFilesFixer.exe" wrote bytes "f811fa74" to virtual address "0x74FB8368" (part of module "SSPICLI.DLL") "DuplicateFilesFixer.exe" wrote bytes "f8110000" to virtual address "0x74FA12CC" (part of module "SSPICLI.DLL") "DuplicateFilesFixer.exe" wrote bytes "b880116d62ffe0" to virtual address "0x767E1368" (part of module "WS2_32.DLL") "DuplicateFilesFixer.exe" wrote bytes "f811fa74" to virtual address "0x74FB834C" (part of module "SSPICLI.DLL") "DuplicateFilesFixer.exe" wrote bytes "c04e247720542577e0652577b53826770000000000d00c7700000000c5ea0c770000000088ea0c7700000000e9682d7582282677ee29267700000000d2692d75000000007dbb0c770000000009be2d7500000000ba180c7700000000" to virtual address "0x75791000" (part of module "NSI.DLL") "DuplicateFilesFixer.exe" wrote bytes "4812fa74" to virtual address "0x74FB83C0" (part of module "SSPICLI.DLL") "DuplicateFilesFixer.exe" wrote bytes "f811fa74" to virtual address "0x74FB83E0" (part of module "SSPICLI.DLL") "DuplicateFilesFixer.exe" wrote bytes "68130000" to virtual address "0x767E1680" (part of module "WS2_32.DLL") "DuplicateFilesFixer.exe" wrote bytes "76de540d" to virtual address "0x69A7F798" (part of module "CLR.DLL") "DuplicateFilesFixer.exe" wrote bytes "f811fa74" to virtual address "0x74FB83C4" (part of module "SSPICLI.DLL") "DuplicateFilesFixer.exe" wrote bytes "4812fa74" to virtual address "0x74FB8364" (part of module "SSPICLI.DLL")25:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAEZmZmZkAAAAAAAAAAAAAGZmZmZmZmYAAAAAAAAAAGZmZmZmZmZmZgAAAAAAAAZmZmZ2ZmZmZmZgAAAAAARmZmZmZmZmZmZmZkAAAAAGZmZmZmZmZmZmZ2ZgAAAAZmZmZmZmZmZmZn/3ZgAABmZmZmdmZmZmZmef/2ZgAEZmZ4j/iHZmZmaPOf9mZABmZ4/4h4j4h2Zo//M3ZmYAZmZ3Z4iHeI+Hj///dmZmBGZmiP/4iP/4iP//92ZmZmZmZ4iHaP///////3ZmZmZmZmZniP/4h3j///dmZmd3dmZn/4//j/+IaP+GZmZnd3ZmZneP+HaI//iPhmbu7nd2ZueI/4//h3iIj/7u7u7ndm7uiP+P///4dmj47u7u7mZu7uf/j/////+I+O7u7uZm7u7n/4/////4iPju7u7uZu7u7v+I//iO6O/47u7u7mDu7u6PiIiIiIiP/u7u7u4Abu7uj/iIiIiI/47u7u7nAE7u7uj/iIiIj//u7u7u5gAG7u7uj/+IiP/+7u7u7mAAAG7u7uj////47u7u7u4AAABO7u7u6IiI7u7u7u7kAAAABu7u7u7u7u7u7u7uYAAAAABO7u7u7u7u7u7u5AAAAAAAAG7u7u7u7u7u5gAAAAAAAAAEbu7u7u7u5kAAAAAAAAAAAABm7u7uZgAAAAAAD/wAP//wAA//wAAH/4AAAf8AAAD+AAAAfAAAAHwAAAA4AAAAGAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAHAAAAD4AAAB+AAAAfwAAAP+AAAH/4AAH//AAD//+AH/w==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"8ca84effb556838d2311e10206688ab6142c8ce31a474ca05cb26b756ee45218","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":68,"unified_at_epoch_ms":1790333487007,"unified_at":"2026-09-25T10:51:27.007Z","metadata":{"hashes":{"sha256":"8ca84effb556838d2311e10206688ab6142c8ce31a474ca05cb26b756ee45218","sha1":"29c8e2da5a199ae406a3bd36208dd66c06b1ce03","md5":"390a43115ef9bd21b025a7bd94ceb77d","sha512":"2f9f4f37e7dd2a8ee6eff58cddcd035fed5ffb6bb6e7eb36fac1f407d9cfd97ade581fab51fc6c2a68c1532efcab096d2a2764e22f4b3a2f2817dcbb662f6ee1","ssdeep":"196608:EWFGMtU0NhxIx0NIOq6HV9xrod6ObDTq9I6Mj:ENENhyx0NIqHBhObZ","ssdeep_chunks":["196608:EWFGMtU","196608:WFGMtU0","196608:FGMtU0N","196608:GMtU0Nh","196608:MtU0Nhx","196608:tU0NhxI","196608:U0NhxIx","196608:0NhxIx0","196608:NhxIx0N","196608:hxIx0NI","196608:xIx0NIO","196608:Ix0NIOq","196608:x0NIOq6","196608:0NIOq6H","196608:NIOq6HV","196608:IOq6HV9","196608:Oq6HV9x","196608:q6HV9xr","196608:6HV9xro","196608:HV9xrod","196608:V9xrod6","196608:9xrod6O","196608:xrod6Ob","196608:rod6ObD","196608:od6ObDT","196608:d6ObDTq","196608:6ObDTq9","196608:ObDTq9I","196608:bDTq9I6","196608:DTq9I6M","196608:Tq9I6Mj","393216:EWFGMtU","393216:WFGMtU0","393216:FGMtU0N","393216:GMtU0Nh","393216:MtU0Nhx","393216:tU0NhxI","393216:U0NhxIx","393216:0NhxIx0","393216:NhxIx0N","393216:hxIx0NI","393216:xIx0NIO","393216:Ix0NIOq","393216:x0NIOq6","393216:0NIOq6H","393216:NIOq6HV","393216:IOq6HV9","393216:Oq6HV9x","393216:q6HV9xr","393216:6HV9xro","393216:HV9xrod","393216:V9xrod6","393216:9xrod6O","393216:xrod6Ob","393216:rod6ObD","393216:od6ObDT","393216:d6ObDTq","393216:6ObDTq9","393216:ObDTq9I","393216:bDTq9I6","393216:DTq9I6M","393216:Tq9I6Mj","196608:ENENhyx","196608:NENhyx0","196608:ENhyx0N","196608:Nhyx0NI","196608:hyx0NIq","196608:yx0NIqH","196608:x0NIqHB","196608:0NIqHBh","196608:NIqHBhO","196608:IqHBhOb","196608:qHBhObZ"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"DuplicateFilesFixer.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":8295424,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1599828534000,"last_seen":1679184207000,"last_multi_scan":1679184207000}},"detections":{"summary":{"verdict":"malicious","score":68,"tags":["ransomware"]},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":9},"sandbox_signatures":{"informative_count":13,"suspicious_count":15,"malicious_count":2,"total":30},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.zgRAT.Heur","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/techniques/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to query the machine version"}],"sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"tactic":"Discovery","technique":"Network Service Scanning","attack_id":"T1046","attack_id_wiki":"https://attack.mitre.org/techniques/T1046","identifiers":[{"type":"suspicious","value":"Detected increased number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Detected a large number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"System.Diagnostics.FileVersionInfo::GetVersionInfo at 390a43115ef9bd21b025a7bd94ceb77d-6000235-ctor","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"DuplicateFilesFixer.exe\" queries volume information of \"C:\\DuplicateFilesFixer.exe\" at 00064252-00002912-0000010C-3036331","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"_ldap._tcp.dc._msdcs.scl3.dc\"\n \"isatap.scl3.dc\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"$22","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\__DDrawExclMode__\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\__DDrawCheckExclMode__\"\n \"Global\\cbackuplogmutexTimeLogs\"\n \"DBWinMutex\"\n \"Local\\__DDrawExclMode__\"\n \"Global\\DuplicateFilesFixer_97BEA57A-0FC2-42EF-BA0F-95E4CD0D05FA\"\n \"Local\\__DDrawCheckExclMode__\"\n \"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\cbackuplogmutexTimeLogs\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\DuplicateFilesFixer_97BEA57A-0FC2-42EF-BA0F-95E4CD0D05FA\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"DuplicateFilesFixer.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 68660000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"DuplicateFilesFixer.exe\" touched \"WBEM Locator\" (Path: \"HKCU\\CLSID\\{4590F811-1D3A-11D0-891F-00AA004B2E24}\\INPROCSERVER32\")\n \"DuplicateFilesFixer.exe\" touched \"NDP SymBinder\" (Path: \"HKCU\\CLSID\\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\\INPROCSERVER32\")\n \"DuplicateFilesFixer.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject\" (Path: \"HKCU\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TREATAS\")\n \"DuplicateFilesFixer.exe\" touched \"Windows Management and Instrumentation\" (Path: \"HKCU\\CLSID\\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\\TREATAS\")\n \"DuplicateFilesFixer.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{7C857801-7381-11CF-884D-00AA004B2E24}\\TREATAS\")\n \"DuplicateFilesFixer.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IWbemServices\" (Path: \"HKCU\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TREATAS\")\n \"DuplicateFilesFixer.exe\" touched \"WbemDefaultPathParser\" (Path: \"HKCU\\CLSID\\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\\INPROCSERVER32\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"DuplicateFilesFixer.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"backup6.bin\" has type \"data\"\n \"DuplicateFilesFixer_1.txt\" has type \"UTF-8 Unicode (with BOM) text with CRLF line terminators\"\n \"se.xml\" has type \"XML 1.0 document ASCII text with very long lines with no line terminators\"\n \"DuplicateFilesFixer.txt\" has type \"UTF-8 Unicode (with BOM) text with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$23","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.microsoft.com/winfx/2006/xaml\"\n Pattern match: \"http://schemas.openxmlformats.org/markup-compatibility/2006\"\n Pattern match: \"http://www.w3.org/1999/02/22-rdf-syntax-ns#\"\n Pattern match: \"http://schemas.microsoft.com/wpf/2008/toolkit\"\n Pattern match: \"http://wpfanimatedgif.codeplex.com\"\n Pattern match: \"https://indiantypefoundry.comThis\"\n Pattern match: \"http://www.w3.org/2001/XMLSchema-instance\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"DuplicateFilesFixer.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"8ca84effb556838d2311e10206688ab6142c8ce31a474ca05cb26b756ee45218.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"DuplicateFilesFixer.exe\" at 00064252-00002912-00000105-3176785","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"DuplicateFilesFixer.exe\" queried SystemProcessInformation at 00064252-00002912-00000105-7270019\n \"DuplicateFilesFixer.exe\" queried SystemProcessInformation at 00064252-00002912-00000105-7271565","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"DuplicateFilesFixer.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.30936144426","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"DuplicateFilesFixer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"DuplicateFilesFixer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/79 reputation engines marked \"http://purl.org\" as malicious (1% detection rate)\n 1/79 reputation engines marked \"http://www.w3.org/1999/02/22-rdf-syntax-ns\" as malicious (1% detection rate)\n 1/78 reputation engines marked \"http://purl.org/dc/elements/1.1\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"System.Windows.FrameworkElement::FindResource at 390a43115ef9bd21b025a7bd94ceb77d-6001141-ctor","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"_ldap._tcp.dc._msdcs.scl3.dc\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"suspicious","category":"Network Related","name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"169.254.77.40/32, 192.168.240.54/32, 192.168.240.104/32, 192.168.241.77/32, 192.168.241.156/32, 192.168.241.223/32, ...\"","origin":"Network Traffic","mitre_attack_id":"T1046","relevance":10,"id":"network-32","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"FWpfAnimatedGif, Version=1.4.17.0, Culture=neutral, PublicKeyToken=null\"\n Heuristic match: \"System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\"\n Heuristic match: \"File name: 'System.Data.SQLite, Version=1.0.111.0, Culture=neutral, PublicKeyToken=db937bc2d44ff139'\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains many references to file extensions (often found in ransomware)","description":"Found reference to a lot of file extensions within a single string: .123\n .3ds\n .3gp\n .602\n .csv\n .doc\n .dot\n .ppt\n .rtf\n .xls\n .aac\n .accdb\n .ai\n .aiff\n .al\n .asf\n .asx\n .avi\n .bmp\n .cdr\n .cgm\n .cr2\n .cs\n .csv\n .db\n .dbf\n .dif\n .doc\n .docm\n .docx\n .dot\n .dotm\n .dotx\n .dwg\n .dxf\n .eps\n .fla\n .flac\n .flv\n .gif\n .hwp\n .indd\n .jpe\n .jpeg\n .jpg\n .m2\n .m2ts\n .m4a\n .m4p\n .m4v\n .md\n .mdb\n .mid\n .mkv\n .mov\n .mp3\n .mp4\n .mpeg\n .mpg\n .odm\n .odt\n .ogg\n .oth\n .ott\n .pcd\n .pct\n .pdb\n .pdf\n .pl\n .png\n .pot\n .potm\n .potx\n .pps\n .ppt\n .pptm\n .pptx\n .ps\n .psd\n .raw\n .rm\n .rtf\n .sda\n .slk\n .stw\n .swf\n .sxg\n .sxw\n .tga\n .tif\n .tiff\n .txt\n .uop\n .uot\n .vob\n .wav\n .wb2\n .wk1\n .wks\n .wma\n .wmv\n .wpd\n .wps\n .xls\n .xlsb\n .xlsm\n .xlsx\n .xlt\n .xltm\n .xltx\n .xlw","origin":"File/Memory","relevance":10,"id":"string-52","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"8ca84effb556838d2311e10206688ab6142c8ce31a474ca05cb26b756ee45218.bin\" claimed CRC 8309708 while the actual is CRC 8296694","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$24","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"DuplicateFilesFixer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"DuplicateFilesFixer.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/69 Antivirus vendors marked sample as malicious (1% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"level":"malicious","category":"Network Related","name":"Detected a large number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"169.254.77.40/32, 169.254.156.73/32, 169.254.248.19/32, 192.168.240.1/32, 192.168.240.2/32, 192.168.240.49/32, 192.168.240.50/32, 192.168.240.54/32, 192.168.240.56/32, 192.168.240.62/32, 192.168.240.75/32, 192.168.240.79/32, 192.168.240.91/32, 192.168.240.94/32, 192.168.240.99/32, 192.168.240.104/31, 192.168.240.106/32, 192.168.240.108/32, 192.168.240.110/32, 192.168.240.113/32, 192.168.240.114/31, 192.168.240.116/32, 192.168.240.142/31, 192.168.240.145/32, 192.168.240.146/32, 192.168.240.151/32, 192.168.240.152/32, 192.168.240.168/32, 192.168.240.195/32, 192.168.240.196/32, 192.168.240.200/32, 192.168.240.232/32, 192.168.240.234/32, 192.168.240.236/32, 192.168.241.77/32, 192.168.241.92/32, 192.168.241.111/32, 192.168.241.156/32, 192.168.241.223/32, 192.168.243.121/32, 192.168.243.140/32, 192.168.243.155/32\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":10,"id":"network-31","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]}],"incidents":[{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected a large number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":88,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":78,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5f5b72350bfb8f2b9742a58d","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":68,"malware_family":"Malware.Generic","submit_name":"DuplicateFilesFixer.exe","analysis_start_time":"2020-09-11T12:49:03+00:00","indicators_count":{"informative":13,"suspicious":15,"malicious":2},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"_ldap._tcp.dc._msdcs.scl3.dc","ttl":86393,"country":"-","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"domain":"isatap.scl3.dc","ttl":86383,"country":"-","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}],"processes":[{"pid":2912,"ppid":0,"name":"DuplicateFilesFixer.exe","command_line":"","sha256":"8ca84effb556838d2311e10206688ab6142c8ce31a474ca05cb26b756ee45218","normalized_path":"C:\\DuplicateFilesFixer.exe","uid":"00064252-00002912","icon":"$25"}],"all_imported_dlls":["vcruntime140_clr0400.dll","System.Deployment.ni.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","psapi.dll","System.Xml.ni.dll","WindowsCodecs.dll","d3d8thk.dll","cryptsp.dll","wpfgfx_v0400.dll","sspicli.dll","mscoree.dll","rpcrt4.dll","uxtheme.dll","iertutil.dll","wininet.dll","advapi32.dll","msctf.dll","clr.dll","System.ni.dll","comctl32.dll","api-ms-win-core-synch-l1-2-0.dll","user32.dll","DWrite.dll","mscorrc.dll","wmiutils.dll","WindowsCodecsExt.dll","ws2_32.dll","wbemsvc.dll","oleaut32.dll","wbemcomn.dll","icm32.dll","usp10.dll","GdiPlus.dll","ntdsapi.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","PresentationCore.ni.dll","WMINet_Utils.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","normaliz.dll","System.Core.ni.dll","nlssorting.dll","RpcRtRemote.dll","wbemprox.dll","nsi.dll","userenv.dll","rsaenh.dll","shell32.dll","System.Management.ni.dll","mshtml.dll","dwmapi.dll","urlmon.dll","PresentationNative_v0400.dll","KernelBase.dll","d3d9.dll","cryptbase.dll","ntdll.dll","version.dll","sechost.dll","lpk.dll","System.Xaml.ni.dll","api-ms-win-core-xstate-l2-1-0.dll","clrjit.dll","diasymreader.dll","fastprox.dll","kernel32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","PresentationFramework.Aero.ni.dll","shlwapi.dll","api-ms-win-downlevel-version-l1-1-0.dll","mscoreei.dll","WindowsBase.ni.dll","PresentationFramework.ni.dll","System.Configuration.ni.dll","clbcatq.dll","Microsoft.VisualBasic.ni.dll","gdi32.dll","imm32.dll","msvcrt.dll","ole32.dll","System.Windows.Forms.ni.dll","bcrypt.dll","mscms.dll","ucrtbase_clr0400.dll","mscorlib.ni.dll","msvcp140_clr0400.dll","System.Drawing.ni.dll","profapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"DuplicateFilesFixer.txt","sha256":"2212919d2477734781d0d951084fe2a099b3a06838b253bbcb536aa31c58bb8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"name":"DuplicateFilesFixer_1.txt","sha256":"f34fd5f784d2b32f7349964d0de4404b4c0655371504a58fc6f88013b58c520e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"name":"se.xml","sha256":"cb245699224d95f0d93d60884220509e6bbbfbc77f29f307b5e08f46f7a633b7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"name":"backup6.bin","sha256":"404273f2f8cd6d5d245e32a5db92dd8c0d177cb7d396c203afee24a2db5b93fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\assembly\\pubpol247.dat","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\WindowsBase\\1a4cc316fb6d09525321fc0be44692d8\\WindowsBase.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\PresentationCore\\468f4e17be144ca12a73a4297eacc9cc\\PresentationCore.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xaml\\d9f0293b9d57900da85de5a4190de717\\System.Xaml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\f7568d7f1b9d356f64779b4c0927cfb3\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\c9a4cbc00f690a9e3cddfc400f6e85bb\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Deployment\\b2a75aa57e7482fa46ca17bc2e8cfaa5\\System.Deployment.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%APPDATA%\\Systweak","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%APPDATA%\\Systweak\\Duplicate Files Fixer","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%APPDATA%\\Systweak\\Duplicate Files Fixer\\1.2.0.10608","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Presentatio1c9175f8#\\0aac68b688207583aa8da0aa42010cc1\\PresentationFramework.Aero.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%APPDATA%\\Systweak\\Duplicate Files Fixer\\Logs","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%APPDATA%\\Systweak\\Duplicate Files Fixer\\Logs\\DuplicateFilesFixer.txt","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%APPDATA%\\Systweak\\Duplicate Files Fixer\\Logs\\DuplicateFilesFixer_1.txt","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\Fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\Fonts\\segoeuib.ttf","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\Fonts\\segoeuii.ttf","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\Fonts\\segoeuiz.ttf","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%APPDATA%\\Systweak\\Duplicate Files Fixer\\Logs\\TimeLogs.txt","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%APPDATA%\\Systweak\\Duplicate Files Fixer\\thumb","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%APPDATA%\\Systweak\\Duplicate Files Fixer\\thumb\\large","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%APPDATA%\\Systweak\\Duplicate Files Fixer\\thumb\\medium","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%APPDATA%\\Systweak\\Duplicate Files Fixer\\thumb\\small","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%APPDATA%\\Systweak\\Duplicate Files Fixer\\thumb\\icon","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\e114780fd3ea5727401c06ea4f22ef35\\System.Management.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\a891970b44db9e340c3ef3efa95b793c\\Microsoft.VisualBasic.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\System32\\mshtml.dll","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%PUBLIC%\\DFFXR","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%PUBLIC%\\DFFXR\\backup6.bin","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Xaml\\v4.0_4.0.0.0__b77a5c561934e089\\System.Xaml.dll","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\dll\\System.Xaml.pdb","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\symbols\\dll\\System.Xaml.pdb","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\System.Xaml.pdb","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Xaml\\v4.0_4.0.0.0__b77a5c561934e089\\System.Xaml.pdb","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\PresentationFramework\\v4.0_4.0.0.0__31bf3856ad364e35\\PresentationFramework.dll","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\PresentationFramework\\v4.0_4.0.0.0__31bf3856ad364e35\\PresentationFramework.pdb","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\symbols\\dll\\PresentationFramework.pdb","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\dll\\PresentationFramework.pdb","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\PresentationFramework.pdb","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\WindowsBase\\v4.0_4.0.0.0__31bf3856ad364e35\\WindowsBase.dll","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\WindowsBase\\v4.0_4.0.0.0__31bf3856ad364e35\\WindowsBase.pdb","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\symbols\\dll\\WindowsBase.pdb","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\dll\\WindowsBase.pdb","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\WindowsBase.pdb","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\symbols\\dll\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\dll\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"C:\\DuplicateFilesFixer.exe.config","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"C:\\DuplicateFilesFixer.exe","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Presentatio5ae0f00f#\\252cc7b0fae8cfe083bdc149957c0c54\\PresentationFramework.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%APPDATA%\\Systweak\\Duplicate Files Fixer\\se.xml","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\color\\sRGB Color Space Profile.icm","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\DIRECT3D\\MOSTRECENTAPPLICATION\\","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"key":"HKCU\\SOFTWARE\\SYSTWEAK\\DUPLICATE FILES FIXER\\1.2.0.10608\\","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"key":"HKCU\\SOFTWARE\\SYSTWEAK\\","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"key":"HKCU\\SOFTWARE\\SYSTWEAK\\DUPLICATE FILES FIXER\\","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"name":"Global\\cbackuplogmutexTimeLogs","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"name":"Local\\__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"name":"Global\\DuplicateFilesFixer_97BEA57A-0FC2-42EF-BA0F-95E4CD0D05FA","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"name":"Local\\__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\cbackuplogmutexTimeLogs","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\DuplicateFilesFixer_97BEA57A-0FC2-42EF-BA0F-95E4CD0D05FA","sources":[{"report_type":"sandbox","report_id":"5f5b72350bfb8f2b9742a58d"}]}]}},"report_ids":{"sandbox_job_ids":["5f5b72350bfb8f2b9742a58d"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Sample 8ca84effb556… — Score 68/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8ca84effb556…. Threat score 68/100. 2/28 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8ca84effb556838d2311e10206688ab6142c8ce31a474ca05cb26b756ee45218"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 8ca84effb556… — Score 68/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8ca84effb556…. Threat score 68/100. 2/28 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8ca84effb556838d2311e10206688ab6142c8ce31a474ca05cb26b756ee45218"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 8ca84effb556… — Score 68/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8ca84effb556…. Threat score 68/100. 2/28 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L26","11",{}]]