26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T485,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Nadrac.Generic Sample 94335091159c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 94335091159c…. Malware family: Nadrac.Generic. Threat score 100/100. 14/24 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/94335091159cb2da1cce72e379b10c2149bb87b3fd762619c6a76d138c9f9ff5","keywords":["Malicious","Nadrac.Generic","malware analysis","sandbox report","threat intelligence","94335091159cb2da1cce72e379b10c2149bb87b3fd762619c6a76d138c9f9ff5"],"about":{"@type":"SoftwareApplication","name":"sample.exe","applicationCategory":["peexe","executable"],"identifier":"94335091159cb2da1cce72e379b10c2149bb87b3fd762619c6a76d138c9f9ff5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Nadrac.Generic","antivirusDetections":{"malicious":14,"total":24},"behavioralIndicators":{"malicious":8,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Ta64,"explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\7D7F4414CCEF168ADF6BF40753B5BECD78375931"; Key: "BLOB") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS"; Key: "CERTIFICATES") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\A43489159A520F0D93D032CCAF37E7FE20A8B419"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\BE36A4562FB2EE05DBB3D32323ADF445084ED656"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\CDD4EEAE6000AC7F40C3802C171E30148030C072"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\02FAF3E291435468607857694DF5E45B68851868"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\2796BAE63F1801E277261BA0D77770028F20EEE4"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25"; Key: "BLOB")28:T5e0,"POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Content-Length: 143 Host: www.sysprogs.org" with no payload "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Content-Length: 72 Host: comecou2016.asia" with no payload "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Content-Length: 202 Host: www.riverbed.com" with no payload "POST /autoit3 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Content-Length: 153 Host: www.autoitscript.com" with no payload29:T8d9,"explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")2a:T1171,"explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CRLS") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CTLS") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CERTIFICATES") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CRLS") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CTLS") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CERTIFICATES") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CRLS") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CTLS") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")2b:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAABmZmZgAAAAAAZmZmYAAAAGeIiIZgAAAAAGiIiGYAB3d3iIiHd3d3d3dod3hnd3iPiIiIh4iIiIiIaIiIa7t4+IiIiIeIiIiIu2iIiGu7ePiIiIiHiIiIiIhoiIh7u3j4iIiIiId3d3d2eIiIiLt4+IiIiIiIiIiIiIiIj4i7ePiIiP/4iIiIiIiIiI+Iu3j4+P//+IiIiIiIiIiPiLh4+Pj////////4iIiIj4i4eP/4///4iIiIiIiIj/iIiHj//4iI+IiIh3d3d3d4iIh4/////4+IiIiIiIiIiIiIeP////iI+IiIiIiIiIiIiHj/////iI+IiIiIiIiIiIh4//////iIiIiIiIiIiIiIeP//////+IiIiIiIiIiIiHj///////+IiIiIiIiIiIh4/////////4j///////iIeP//////////+IiIiHd3eHiP/////////4iIiIiIiIh4iIiIiIiIiIiIjub///iIeIiIiIiIiIiIiI7u///4iHiIiIiIiImZ//iIh3d3d3dwiIiIiIiJmf///4iIiIiHAIiKov/4iIiIiId3d3d3dwCIiqr///+Ih3AAAAAAAAAACIiIiIiIiHcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwH/gP4A/4BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAGAAD//wAB//////////////////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"94335091159cb2da1cce72e379b10c2149bb87b3fd762619c6a76d138c9f9ff5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790540081521,"unified_at":"2026-09-27T20:14:41.521Z","metadata":{"hashes":{"sha256":"94335091159cb2da1cce72e379b10c2149bb87b3fd762619c6a76d138c9f9ff5","sha1":"afe42554975440116d6ae92877898b4230c212b7","md5":"8d1bcbf39876e255e93f5deba8ae661c","sha512":"29e7427098c7fa81f976d71c7fcb3dac87057ec6718ee1d845e9cadfa7e832649d87de14b0fa296bbf64a0fd484a7b66c23ae246b2017464729d588b13437295","ssdeep":"1536:t5Pkk9i95yRK6t6eXb9zn2SVmxq4BWPR03wYJw4sWmbcdmMxW/eCxZl7L3:w56K6t1XZz2mmxzBWWwowrKmMxoF1L","ssdeep_chunks":["1536:t5Pkk9i","1536:5Pkk9i9","1536:Pkk9i95","1536:kk9i95y","1536:k9i95yR","1536:9i95yRK","1536:i95yRK6","1536:95yRK6t","1536:5yRK6t6","1536:yRK6t6e","1536:RK6t6eX","1536:K6t6eXb","1536:6t6eXb9","1536:t6eXb9z","1536:6eXb9zn","1536:eXb9zn2","1536:Xb9zn2S","1536:b9zn2SV","1536:9zn2SVm","1536:zn2SVmx","1536:n2SVmxq","1536:2SVmxq4","1536:SVmxq4B","1536:Vmxq4BW","1536:mxq4BWP","1536:xq4BWPR","1536:q4BWPR0","1536:4BWPR03","1536:BWPR03w","1536:WPR03wY","1536:PR03wYJ","1536:R03wYJw","1536:03wYJw4","1536:3wYJw4s","1536:wYJw4sW","1536:YJw4sWm","1536:Jw4sWmb","1536:w4sWmbc","1536:4sWmbcd","1536:sWmbcdm","1536:WmbcdmM","1536:mbcdmMx","1536:bcdmMxW","1536:cdmMxW/","1536:dmMxW/e","1536:mMxW/eC","1536:MxW/eCx","1536:xW/eCxZ","1536:W/eCxZl","1536:/eCxZl7","1536:eCxZl7L","1536:CxZl7L3","3072:t5Pkk9i","3072:5Pkk9i9","3072:Pkk9i95","3072:kk9i95y","3072:k9i95yR","3072:9i95yRK","3072:i95yRK6","3072:95yRK6t","3072:5yRK6t6","3072:yRK6t6e","3072:RK6t6eX","3072:K6t6eXb","3072:6t6eXb9","3072:t6eXb9z","3072:6eXb9zn","3072:eXb9zn2","3072:Xb9zn2S","3072:b9zn2SV","3072:9zn2SVm","3072:zn2SVmx","3072:n2SVmxq","3072:2SVmxq4","3072:SVmxq4B","3072:Vmxq4BW","3072:mxq4BWP","3072:xq4BWPR","3072:q4BWPR0","3072:4BWPR03","3072:BWPR03w","3072:WPR03wY","3072:PR03wYJ","3072:R03wYJw","3072:03wYJw4","3072:3wYJw4s","3072:wYJw4sW","3072:YJw4sWm","3072:Jw4sWmb","3072:w4sWmbc","3072:4sWmbcd","3072:sWmbcdm","3072:WmbcdmM","3072:mbcdmMx","3072:bcdmMxW","3072:cdmMxW/","3072:dmMxW/e","3072:mMxW/eC","3072:MxW/eCx","3072:xW/eCxZ","3072:W/eCxZl","3072:/eCxZl7","3072:eCxZl7L","3072:CxZl7L3","1536:w56K6t1","1536:56K6t1X","1536:6K6t1XZ","1536:K6t1XZz","1536:6t1XZz2","1536:t1XZz2m","1536:1XZz2mm","1536:XZz2mmx","1536:Zz2mmxz","1536:z2mmxzB","1536:2mmxzBW","1536:mmxzBWW","1536:mxzBWWw","1536:xzBWWwo","1536:zBWWwow","1536:BWWwowr","1536:WWwowrK","1536:WwowrKm","1536:wowrKmM","1536:owrKmMx","1536:wrKmMxo","1536:rKmMxoF","1536:KmMxoF1","1536:mMxoF1L"],"imphash":"795c24cd977c8cc91156edc2ffc64d41"},"file_info":{"file_name":"sample.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":93696,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499290903000,"last_seen":1719684806000,"last_multi_scan":1719684806000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":15,"suspicious_count":18,"malicious_count":8,"total":41},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Yakes","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/Win32.Androm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Yakes.bzyqi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Nadrac.5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Nadrac.5 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Smokeloader.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Yakes.eiebay","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.KFLN-0904","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanDownloader.Dofoil","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Yakes.Win32.60657","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Nadrac.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 43512-698-00401716\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00019406-00002572-55708-96-00033DE9\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00019406-00002572-55708-13-000319D1\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00019406-00002572-55708-175-000315B7\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00019406-00002572-55708-583-00031716\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00020698-00002652-61812-13-000619D1\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00020698-00002652-61812-96-00063DE9\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00020698-00002652-61812-583-00061716\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00020698-00002652-61812-175-000615B7","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00019406-00002572-55708-187-0003149F\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00020698-00002652-61812-187-0006149F","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 43512-708-004063E4\n GetProcessHeap@KERNEL32.DLL at 00019406-00002572-55708-81-0003C440\n GetProcessHeap@KERNEL32.DLL at 00019406-00002572-55708-587-000363E4\n GetProcessHeap@KERNEL32.DLL at 00020698-00002652-61812-81-0006C440\n GetProcessHeap@KERNEL32.DLL at 00020698-00002652-61812-587-000663E4","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"C:\\\" at 00019406-00002572-0000010C-48229480\n \"\" queries volume information of \"%APPDATA%\\sysxapn.exe\" at 00019406-00002572-0000010C-48233273\n \"sysxapn.exe\" queries volume information of \"C:\\\" at 00021680-00002848-0000010C-53798921","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"\" queries volume information of \"C:\\\" at 00019406-00002572-0000010C-48229480\n \"sysxapn.exe\" queries volume information of \"C:\\\" at 00021680-00002848-0000010C-53798921","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"comecou2016.asia\"\n \"sysprogs.com\"\n \"www.autoitscript.com\"\n \"www.riverbed.com\"\n \"www.sysprogs.org\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"178.77.110.129:80\"\n \"2.16.196.38:80\"\n \"2.16.196.38:443\"\n \"212.227.91.231:80\"\n \"212.227.91.231:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\06B7FBF65749DC4152CDCDEB4D8D244F24C2B6A0\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: sysprogs.com\"\n \"GET /autoit3/ HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: www.autoitscript.com\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"informative","category":"General","name":"Reads System Certificates Settings","description":"$27","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"sysxapn.exe\" (UID: 00020698-00002652)\n Spawned process \"sysxapn.exe\" (UID: 00021680-00002848)\n Spawned process \"explorer.exe\" (UID: 00023108-00002880)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"sysxapn.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"SkypeHost.lnk\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Sat Dec 17 19:27:00 2016 mtime=Sat Dec 17 19:27:00 2016 atime=Sat Dec 17 19:01:00 2016 length=93696 window=hide\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\SkypeHost.lnk\"\n \"sysxapn.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"sysxapn.exe\" touched file \"%WINDIR%\\system32\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"sysxapn.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"sysxapn.exe\" at 00021680-00002848-00000105-53803900","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".sdfg with unusual entropies 7.89449696782","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00019406-00002572-55708-28-00031816\n cpuid at 00020698-00002652-61812-28-00061816","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"sysxapn.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"explorer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"sysxapn.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"explorer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"$28","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Users\\PSPUBWS\\Desktop\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Searches\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Videos\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Pictures\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Contacts\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Favorites\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Music\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Downloads\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Documents\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Links\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 65536 bytes starting with PE header signature to file \"%APPDATA%\\sysxapn.exe\": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"178.77.110.129\"\n \"104.27.181.153\"\n \"2.16.196.38\"\n \"212.227.91.231\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\94335091159cb2da1cce72e379b10c2149bb87b3fd762619c6a76d138c9f9ff5.exe\" marked \"%APPDATA%\\sysxapn.exe:Zone.Identifier\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%APPDATA%\\sysxapn.exe:Zone.Identifier\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$29","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n GetCommandLineW\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n GetCommandLineA\n GetProcAddress\n FindFirstFileExA\n WriteFile\n FindNextFileA\n GetModuleHandleW\n TerminateProcess\n GetModuleHandleExW\n CreateFileW\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"94335091159cb2da1cce72e379b10c2149bb87b3fd762619c6a76d138c9f9ff5.exe.bin\" has a section named \".gfids\"\n \"94335091159cb2da1cce72e379b10c2149bb87b3fd762619c6a76d138c9f9ff5.exe.bin\" has a section named \".sdfg\"","origin":"Static Parser","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%APPDATA%\\sysxapn.exe\\:Zone.Identifier:$DATA\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"\"\" opened \"%APPDATA%\\sysxapn.exe:Zone.Identifier\" with delete access","origin":"API Call","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET TROJAN Sharik/Smoke Loader Java Connectivity Check\" (SID: 2022026, Rev: 3, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)\n Detected alert \"ETPRO TROJAN Sharik/Smoke Checkin 2\" (SID: 2821148, Rev: 3, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"42/57 Antivirus vendors marked sample as malicious (73% detection rate)\n 12/42 Antivirus vendors marked sample as malicious (28% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"42/57 Antivirus vendors marked sample as malicious (73% detection rate)\n 12/42 Antivirus vendors marked sample as malicious (28% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00023108-00002880)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"$2a","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\\94335091159cb2da1cce72e379b10c2149bb87b3fd762619c6a76d138c9f9ff5.exe\\:Zone.Identifier:$DATA\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Modifies System Certificates Settings"},{"detail":"Persists itself using auto-execute at a hidden registry location"},{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 5 domains and 5 hosts"}],"sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":5,"imported_dlls_count":47,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":30,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":5,"dns_resolutions_count":5,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"581715fdaac2ed4a22e2bca8","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","error_type":"Failed to save report to webservice","verdict":"malicious","threat_score":100,"malware_family":"Trojan.GenericKD","contacted_countries":["DEU","EU","USA"],"submit_name":"sample.exe","analysis_start_time":"2016-12-17T19:58:45+00:00","indicators_count":{"informative":15,"suspicious":22,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"178.77.110.129","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"address":"2.16.196.38","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"address":"2.16.196.38","port":443,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"address":"212.227.91.231","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"address":"212.227.91.231","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]}],"dns_resolutions":[{"domain":"comecou2016.asia","address":"104.27.181.153","country":"United States","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"domain":"sysprogs.com","address":"178.77.110.129","country":"Germany","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"domain":"www.autoitscript.com","address":"212.227.91.231","country":"Germany","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"domain":"www.riverbed.com","address":"2.16.196.38","country":"European Union","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"domain":"www.sysprogs.org","address":"178.77.110.129","country":"Germany","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]}],"http_requests":[{"host":"178.77.110.129","host_ip":"178.77.110.129:80","url":"/","method":"POST","response_code":"301","response_phrase":"Moved Permanently","header":"POST / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nContent-Length: 143\nHost: www.sysprogs.org","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"host":"212.227.91.231","host_ip":"212.227.91.231:80","url":"/autoit3","method":"POST","response_code":"301","response_phrase":"Moved Permanently","header":"POST /autoit3 HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nContent-Length: 153\nHost: www.autoitscript.com","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"host":"212.227.91.231","host_ip":"212.227.91.231:80","url":"/autoit3/","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /autoit3/ HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: www.autoitscript.com","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}],"processes":[{"pid":2572,"ppid":0,"name":"94335091159cb2da1cce72e379b10c2149bb87b3fd762619c6a76d138c9f9ff5.exe","command_line":"","normalized_path":"C:\\94335091159cb2da1cce72e379b10c2149bb87b3fd762619c6a76d138c9f9ff5.exe","uid":"00019406-00002572","icon":"$2b"},{"pid":2652,"ppid":2572,"name":"sysxapn.exe","command_line":"","normalized_path":"%APPDATA%\\sysxapn.exe","parent_uid":"00019406-00002572","uid":"00020698-00002652"},{"pid":2848,"ppid":2652,"name":"sysxapn.exe","command_line":"","normalized_path":"%APPDATA%\\sysxapn.exe","parent_uid":"00020698-00002652","uid":"00021680-00002848"},{"pid":2880,"ppid":2848,"name":"explorer.exe","command_line":"","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00021680-00002848","uid":"00023108-00002880","icon":"$2c"}],"all_imported_dlls":["kernel32.dll","msvcrt.dll","msctf.dll","clbcatq.dll","comctl32.dll","setupapi.dll","linkinfo.dll","rsaenh.dll","KernelBase.dll","shlwapi.dll","sechost.dll","urlmon.dll","iertutil.dll","cfgmgr32.dll","ole32.dll","lpk.dll","usp10.dll","advapi32.dll","oleaut32.dll","propsys.dll","profapi.dll","ntdll.dll","user32.dll","rpcrt4.dll","rpcss.dll","uxtheme.dll","devobj.dll","cscapi.dll","wininet.dll","cryptbase.dll","sspicli.dll","cryptsp.dll","gdi32.dll","msasn1.dll","webio.dll","Wldap32.dll","imm32.dll","shell32.dll","apphelp.dll","shdocvw.dll","srvcli.dll","winhttp.dll","ntmarta.dll","ntshrui.dll","slc.dll","crypt32.dll","netutils.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"SkypeHost.lnk","sha256":"5df23377615efd687a4974a8af4dbff2ce5aba2d2955b1c5f7d0c4b588e84b7c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]}],"files_written":[{"path":"C:\\94335091159cb2da1cce72e379b10c2149bb87b3fd762619c6a76d138c9f9ff5.exe","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"C:\\94335091159cb2da1cce72e379b10c2149bb87b3fd762619c6a76d138c9f9ff5.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"%APPDATA%\\sysxapn.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"%USERPROFILE%\\Searches\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"%USERPROFILE%\\Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"%USERPROFILE%\\Contacts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"%USERPROFILE%\\Saved Games\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\SkypeHost.lnk","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"%APPDATA%\\Microsoft\\agshwswg","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"%APPDATA%\\Microsoft\\agshwswg\\cetcsgra.exe","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"path":"%APPDATA%\\Microsoft\\agshwswg\\agshwswg","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\06B7FBF65749DC4152CDCDEB4D8D244F24C2B6A0","sources":[{"report_type":"sandbox","report_id":"581715fdaac2ed4a22e2bca8"}]}]}},"report_ids":{"sandbox_job_ids":["581715fdaac2ed4a22e2bca8"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Nadrac.Generic Sample 94335091159c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 94335091159c…. Malware family: Nadrac.Generic. Threat score 100/100. 14/24 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/94335091159cb2da1cce72e379b10c2149bb87b3fd762619c6a76d138c9f9ff5"}],["$","meta","4",{"property":"og:title","content":"Malicious Nadrac.Generic Sample 94335091159c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 94335091159c…. Malware family: Nadrac.Generic. Threat score 100/100. 14/24 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/94335091159cb2da1cce72e379b10c2149bb87b3fd762619c6a76d138c9f9ff5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Nadrac.Generic Sample 94335091159c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 94335091159c…. Malware family: Nadrac.Generic. Threat score 100/100. 14/24 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]