23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 22:T485,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Agent Sample 9570e8ec36c9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9570e8ec36c9…. Malware family: Trojan.Agent. Threat score 100/100. 20/27 AV engines flagged this file. 11 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9570e8ec36c966432922969f8a948c5b55126e787d51ddb03f7ae71c40079813","keywords":["Malicious","Trojan.Agent","malware analysis","sandbox report","threat intelligence","9570e8ec36c966432922969f8a948c5b55126e787d51ddb03f7ae71c40079813"],"about":{"@type":"SoftwareApplication","name":"76f45e5drfg7.exe","applicationCategory":["peexe","executable"],"identifier":"9570e8ec36c966432922969f8a948c5b55126e787d51ddb03f7ae71c40079813","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Agent","antivirusDetections":{"malicious":20,"total":27},"behavioralIndicators":{"malicious":11,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T464,"\Sessions\1\BaseNamedObjects\IESQMMUTEX_0_208" "\Sessions\1\BaseNamedObjects\{e7538e23-afe8-9721-5cc1-9a59a7b9d7c1}" "\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "\Sessions\1\BaseNamedObjects\Local\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" "\Sessions\1\BaseNamedObjects\RasPbFile" "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\{b66091c5-252f-dd10-9a3e-dafd7cc7144e}" "\Sessions\1\BaseNamedObjects\Global\b66091c5252fdd109a3edafd7cc7144e"25:T901,"" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")26:T69d,"" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS")27:T494,"" loaded module "GPAPI.DLL" at base 75120000 "" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 77B10000 "" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 77B10000 "" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77B10000 "" loaded module "USER32.DLL" at base 75E70000 "" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 74540000 "" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 74520000 "" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75520000 "" loaded module "DNSAPI.DLL" at base 753E0000 "" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 74240000 "" loaded module "WS2_32.DLL" at base 77AD0000 "" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 75510000 "" loaded module "IPHLPAPI.DLL" at base 750B0000 "" loaded module "NCRYPT.DLL" at base 75690000 "" loaded module "CRYPTNET.DLL" at base 6BCB0000 "" loaded module "SHLWAPI.DLL" at base 75E1000028:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=29:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"9570e8ec36c966432922969f8a948c5b55126e787d51ddb03f7ae71c40079813","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790555806110,"unified_at":"2026-09-28T00:36:46.110Z","metadata":{"hashes":{"sha256":"9570e8ec36c966432922969f8a948c5b55126e787d51ddb03f7ae71c40079813","sha1":"2c26da43992ff1af1e8fba499dccba042f9e43a6","md5":"54bdf65b31b894f10395a3781bd5c2f1","sha512":"84cb4c5ace7294acbd04ecf76d785fed170e908a229850c64cbe8ab161956dd26215c93d7a1aa41f33f0548f22b487ba31cd3f0ea381ea35145a01cf989213f7","ssdeep":"3072:muEX6snuAyDRH0TRKDdZv/AnfDxyutM80O4AgIykCbZxd:XEX6snuAyDRCBxyR6nykgZx","ssdeep_chunks":["3072:muEX6sn","3072:uEX6snu","3072:EX6snuA","3072:X6snuAy","3072:6snuAyD","3072:snuAyDR","3072:nuAyDRH","3072:uAyDRH0","3072:AyDRH0T","3072:yDRH0TR","3072:DRH0TRK","3072:RH0TRKD","3072:H0TRKDd","3072:0TRKDdZ","3072:TRKDdZv","3072:RKDdZv/","3072:KDdZv/A","3072:DdZv/An","3072:dZv/Anf","3072:Zv/AnfD","3072:v/AnfDx","3072:/AnfDxy","3072:AnfDxyu","3072:nfDxyut","3072:fDxyutM","3072:DxyutM8","3072:xyutM80","3072:yutM80O","3072:utM80O4","3072:tM80O4A","3072:M80O4Ag","3072:80O4AgI","3072:0O4AgIy","3072:O4AgIyk","3072:4AgIykC","3072:AgIykCb","3072:gIykCbZ","3072:IykCbZx","3072:ykCbZxd","6144:muEX6sn","6144:uEX6snu","6144:EX6snuA","6144:X6snuAy","6144:6snuAyD","6144:snuAyDR","6144:nuAyDRH","6144:uAyDRH0","6144:AyDRH0T","6144:yDRH0TR","6144:DRH0TRK","6144:RH0TRKD","6144:H0TRKDd","6144:0TRKDdZ","6144:TRKDdZv","6144:RKDdZv/","6144:KDdZv/A","6144:DdZv/An","6144:dZv/Anf","6144:Zv/AnfD","6144:v/AnfDx","6144:/AnfDxy","6144:AnfDxyu","6144:nfDxyut","6144:fDxyutM","6144:DxyutM8","6144:xyutM80","6144:yutM80O","6144:utM80O4","6144:tM80O4A","6144:M80O4Ag","6144:80O4AgI","6144:0O4AgIy","6144:O4AgIyk","6144:4AgIykC","6144:AgIykCb","6144:gIykCbZ","6144:IykCbZx","6144:ykCbZxd","3072:XEX6snu","3072:nuAyDRC","3072:uAyDRCB","3072:AyDRCBx","3072:yDRCBxy","3072:DRCBxyR","3072:RCBxyR6","3072:CBxyR6n","3072:BxyR6ny","3072:xyR6nyk","3072:yR6nykg","3072:R6nykgZ","3072:6nykgZx"],"imphash":"dc36abf9db8a3b5f19d35b888ce64b36"},"file_info":{"file_name":"76f45e5drfg7.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":177152,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499295483000,"last_seen":1659603057000,"last_multi_scan":1659603057000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":13,"suspicious_count":18,"malicious_count":11,"total":42},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Emotet.Exp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Yakes","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dridex.dfgj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.BSAO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.LOEJ-0735","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.BSAO (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Dridex.AA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dridex","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004d86461 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Yakes.phyh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.yk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dridex.ebeoxy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Agent-AQVA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TSPY_DRIDEX.KLC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TSPY_DRIDEX.KLC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.IIH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Yakes","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts server","description":"\"71.46.208.93:1943\"\n \"41.38.18.230:443\"\n \"93.104.211.103:443\"\n \"159.8.57.10:443\"\n \"82.144.200.154:443\"\n \"5.9.43.177:8443\"\n \"212.126.59.41:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\Cab2367.tmp\"\n \"\" created file \"%TEMP%\\Tar2378.tmp\"\n \"\" created file \"%TEMP%\\Cab26C5.tmp\"\n \"\" created file \"%TEMP%\\Tar26C6.tmp\"\n \"\" created file \"%TEMP%\\Cab458A.tmp\"\n \"\" created file \"%TEMP%\\Tar459A.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$24","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"informative","category":"General","name":"Reads System Certificates Settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA\", Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\109F1CAED645BB78B3EA2B94C0697C740733031C\", Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\D559A586669B08F46A30A133F8A9ED3D038E2EA8\", Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\", Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\A377D1B1C0538833035211F4083D00FECC414DAB\", Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6\", Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\7D7F4414CCEF168ADF6BF40753B5BECD78375931\", Key: \"BLOB\")","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\", Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c schtasks.exe /Create /F /TN \"User_Feed_Synchronization-{0fa29185-a388-c1b4-ba73-14ede9b78670}\" /SC minute /MO 10 /TR \"rundll32.exe %LOCALAPPDATA%\\ow\\vjc9CD.tmp RzDLw2QGI3FXkaH5BTErKL8\"\" on 2016-3-24.02:41:16.749","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c schtasks.exe /Create /F /TN \"User_Feed_Synchronization-{0fa29185-a388-c1b4-ba73-14ede9b78670}\" /SC minute /MO 10 /TR \"rundll32.exe %LOCALAPPDATA%\\ow\\vjc9CD.tmp RzDLw2QGI3FXkaH5BTErKL8\"\" (UID: 00021137-00003724)\n Spawned process \"taskhost.exe\" (UID: 00021145-00001384)\n Spawned process \"schtasks.exe\" with commandline \"/Create /F /TN \"User_Feed_Synchronization-{0fa29185-a388-c1b4-ba73-14ede9b78670}\" /SC minute /MO 10 /TR \"rundll32.exe %LOCALAPPDATA%\\ow\\vjc9CD.tmp RzDLw2QGI3FXkaH5BTErKL8\"\" (UID: 00021148-00000936)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df\" has type \"data\"\n \"Tar2378.tmp\" has type \"data\"\n \"TarC532.tmp\" has type \"data\"\n \"94308059B57B3142E455B38A6EB92015\" has type \"data\"\n \"Cab2367.tmp\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"Cab26C5.tmp\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"Cab458A.tmp\" has type \"Microsoft Cabinet archive data, 49661 bytes, 1 file\"\n \"CabC531.tmp\" has type \"Microsoft Cabinet archive data, 49661 bytes, 1 file\"\n \"Tar26C6.tmp\" has type \"data\"\n \"Tar459A.tmp\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".crt0 with unusual entropies 7.15001660535","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\", Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\system32\\rsaenh.dll\"\n \"\" created file \"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\"\n \"\" created file \"C:\\Windows\\system32\\en-US\\KERNELBASE.dll.mui\"\n \"\" created file \"C:\\Windows\\system32\\en-US\\WINHTTP.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"suspicious","category":"Pattern Matching","name":"Code classification distribution is known to appear in malware","description":"TrID distribution is very similar to the \"CTB-Locker\" family (e.g. SHA256: cbba56bd16222191f1468a1d93b63945394371cfb9ffe38f34a9575c5655e57a)","origin":"TrID Evaluation","relevance":5,"id":"trid-0","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00012134-00001884-33645-145-004062A3\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00012134-00001884-33645-130-00403EC0\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00012134-00001884-33645-144-00406406\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00012134-00001884-38402-145-004062A3\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00012134-00001884-38402-130-00403EC0\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00012134-00001884-38402-144-00406406\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00012134-00001884-42254-130-00403EC0\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00012134-00001884-42254-144-00406406\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00012134-00001884-42254-145-004062A3","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\76f45e5drfg7.exe\" marked \"%TEMP%\\Cab2367.tmp\" for deletion\n \"C:\\76f45e5drfg7.exe\" marked \"%TEMP%\\Tar2378.tmp\" for deletion\n \"C:\\76f45e5drfg7.exe\" marked \"%TEMP%\\Cab26C5.tmp\" for deletion\n \"C:\\76f45e5drfg7.exe\" marked \"%TEMP%\\Tar26C6.tmp\" for deletion\n \"C:\\76f45e5drfg7.exe\" marked \"%TEMP%\\Cab458A.tmp\" for deletion\n \"C:\\76f45e5drfg7.exe\" marked \"%TEMP%\\Tar459A.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\Cab2367.tmp\" with delete access\n \"\" opened \"%TEMP%\\Tar2378.tmp\" with delete access\n \"\" opened \"%TEMP%\\Cab26C5.tmp\" with delete access\n \"\" opened \"%TEMP%\\Tar26C6.tmp\" with delete access\n \"\" opened \"%TEMP%\\Cab458A.tmp\" with delete access\n \"\" opened \"%TEMP%\\Tar459A.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$25","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"4053eb765858ec76186aec76653ced760000000000bf91760000000056cc9176000000007cca917600000000376808756a2ced76d62ded7600000000206908750000000029a6917600000000a48d087500000000f70e917600000000\" to virtual address \"0x752D1000\" (part of module \"NSI.DLL\")\n \"\" wrote bytes \"7739e97679a8ed76be72ed76d62ded761de2e87605a2ed76c868ec7657d1f376bee3e876616fed766841eb760050eb7600000000ad37fc768b2dfc76b641fc7600000000\" to virtual address \"0x74A01000\" (part of module \"WSHIP6.DLL\")\n \"\" wrote bytes \"92e6e87679a8ed76be72ed76d62ded761de2e87605a2ed76bee3e876616fed766841eb760050eb7600000000ad37fc768b2dfc76b641fc7600000000\" to virtual address \"0x744F1000\" (part of module \"WSHTCPIP.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/56 Antivirus vendors marked sample as malicious (8% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated memory in \"%WINDIR%\\explorer.exe\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00014336-00001496)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 71.46.208.93 on port 1943\n TCP traffic to 5.9.43.177 on port 8443","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"$26","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00012134-00001884)\n Spawned process \"explorer.exe\" with commandline \"%WINDIR%\\Explorer.EXE\" (UID: 00014336-00001496)\n Spawned process \"cmd.exe\" with commandline \"/c schtasks.exe /Create /F /TN \"User_Feed_Synchronization-{0fa29185-a388-c1b4-ba73-14ede9b78670}\" /SC minute /MO 10 /TR \"rundll32.exe %LOCALAPPDATA%\\ow\\vjc9CD.tmp RzDLw2QGI3FXkaH5BTErKL8\"\" (UID: 00021137-00003724)\n Spawned process \"taskhost.exe\" (UID: 00021145-00001384)\n Spawned process \"schtasks.exe\" with commandline \"/Create /F /TN \"User_Feed_Synchronization-{0fa29185-a388-c1b4-ba73-14ede9b78670}\" /SC minute /MO 10 /TR \"rundll32.exe %LOCALAPPDATA%\\ow\\vjc9CD.tmp RzDLw2QGI3FXkaH5BTErKL8\"\" (UID: 00021148-00000936)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"S:\\Work\\_bin\\Release-Win32\\netcheck_x32.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$27","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"RegisterGPNotificationInternal@GPAPI.dll\"\n \"OpenSCManagerW@sechost.dll\"\n \"OpenServiceW@sechost.dll\"\n \"CloseServiceHandle@sechost.dll\"\n \"QueryServiceConfigW@sechost.dll\"\n \"ConvertSidToStringSidW@sechost.dll\"\n \"RegDeleteTreeA@ADVAPI32.dll\"\n \"RegDeleteTreeW@ADVAPI32.dll\"\n \"NSPStartup@napinsp.dll\"\n \"ConvertStringSecurityDescriptorToSecurityDescriptorW@sechost.dll\"\n \"NSPStartup@pnrpnsp.dll\"\n \"NSPStartup@mswsock.dll\"\n \"DnsQueryConfigAllocEx@dnsapi.DLL\"\n \"NSPStartup@winrnr.dll\"\n \"DnsApiAlloc@dnsapi.DLL\"\n \"DnsApiFree@dnsapi.DLL\"\n \"WSPStartup@mswsock.dll\"\n \"WSHOpenSocket@wship6.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"LookupAccountNameLocalW@SECHOST.DLL at 00126093-00000356-779F228D-142805","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00126093-00000356-779F228D-149627","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"Wrote 382 instructions to foreign process \"Explorer.EXE\" (UID: 00146437-00001488)","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 41472 bytes to a foreign process \"explorer.exe\" (PID: 00001488)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtSetSystemInformation@NTDLL.DLL at 00126093-00000356-779F228D-132658\n NtQueryVirtualMemory@NTDLL.DLL at 00126093-00000356-779F228D-149625","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Injects into explorer"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":67,"imported_dlls_count":222,"dropped_files_count":0,"extracted_files_count":17,"files_written_count":42,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":7,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":11,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":7,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"56f3b518aac2ed723b0b443f","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"QVM20.1.Malware","contacted_countries":["DEU","EGY","IRL","UKR","USA"],"submit_name":"76f45e5drfg7.exe","analysis_start_time":"2016-03-24T04:36:51+00:00","indicators_count":{"informative":9,"suspicious":30,"malicious":9},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"56f3b518aac2ed723b0b443d","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"QVM20.1.Malware","contacted_countries":["DEU","EGY","IRL","UKR","USA"],"submit_name":"76f45e5drfg7.exe","analysis_start_time":"2016-03-24T04:36:38+00:00","indicators_count":{"informative":11,"suspicious":29,"malicious":15},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"71.46.208.93","port":1943,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"address":"41.38.18.230","port":443,"protocol":"TCP","country":"Egypt","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"address":"93.104.211.103","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"address":"159.8.57.10","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"address":"82.144.200.154","port":443,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"address":"5.9.43.177","port":8443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"address":"212.126.59.41","port":443,"protocol":"TCP","country":"Ireland","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}],"processes":[{"pid":356,"ppid":0,"name":"76f45e5drfg7.exe","command_line":"","normalized_path":"Z:\\76f45e5drfg7.exe","uid":"00126093-00000356","icon":"$28"},{"pid":1488,"ppid":0,"name":"Explorer.EXE","command_line":"","normalized_path":"%WINDIR%\\Explorer.EXE","uid":"00146437-00001488","icon":"$29"},{"pid":3840,"ppid":0,"name":"cmd.exe","command_line":"/c schtasks.exe /Create /F /TN \"User_Feed_Synchronization-{739fdf13-6941-b186-6cf2-d5e5e77823e8}\" /SC minute /MO 10 /TR \"rundll32.exe %LOCALAPPDATA%\\ow\\fdjD92D.tmp DdYumNxh9ab9x3TquE\"","normalized_path":"%WINDIR%\\System32\\cmd.exe","uid":"00252265-00003840"},{"pid":3848,"ppid":0,"name":"schtasks.exe","command_line":"/Create /F /TN \"User_Feed_Synchronization-{739fdf13-6941-b186-6cf2-d5e5e77823e8}\" /SC minute /MO 10 /TR \"rundll32.exe %LOCALAPPDATA%\\ow\\fdjD92D.tmp DdYumNxh9ab9x3TquE\"","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00253437-00003848"},{"pid":1460,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00253468-00001460"},{"pid":3852,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00259000-00003852"}],"all_imported_dlls":["schannel.dll","devrtl.dll","FWPUCLNT.DLL","secur32.dll","dhcpcsvc6.dll","setupapi.dll","ws2_32.dll","rasapi32.dll","NapiNSP.dll","cabinet.dll","shell32.dll","cryptbase.dll","userenv.dll","rtutils.dll","credssp.dll","kernel32.dll","gdi32.dll","cryptsp.dll","wininet.dll","crypt32.dll","wintrust.dll","rasman.dll","msasn1.dll","user32.dll","rasadhlp.dll","wshqos.dll","WSHTCPIP.DLL","webio.dll","ntdll.dll","KernelBase.dll","devobj.dll","advapi32.dll","rsaenh.dll","winnsi.dll","pnrpnsp.dll","cfgmgr32.dll","sechost.dll","urlmon.dll","profapi.dll","nsi.dll","mswsock.dll","dhcpcsvc.dll","shlwapi.dll","sspicli.dll","ntmarta.dll","ole32.dll","oleaut32.dll","winhttp.dll","normaliz.dll","nlaapi.dll","cryptnet.dll","winrnr.dll","bcrypt.dll","rpcrt4.dll","comctl32.dll","SensApi.dll","wship6.dll","ncrypt.dll","msvcrt.dll","Wldap32.dll","iertutil.dll","msctf.dll","bcryptprimitives.dll","lpk.dll","IPHLPAPI.DLL","usp10.dll","imm32.dll","dnsapi.dll","gpapi.dll","GDI32.dll","ADVAPI32.dll","ieproxy.dll","PROPSYS.dll","wer.dll","MSCTF.dll","ieframe.dll","SyncCenter.dll","pnidui.dll","wwanapi.dll","dxp.dll","SETUPAPI.dll","LPK.dll","SHLWAPI.dll","napinsp.dll","Cabinet.dll","SXS.DLL","QAgent.dll","gdiplus.dll","Secur32.dll","wwapi.dll","EhStorShell.dll","WINMM.dll","wevtapi.dll","CRYPTUI.dll","wlanutil.dll","wkscli.dll","IconCodecService.dll","srvcli.dll","USP10.dll","CRYPTBASE.dll","dhcpcsvc6.DLL","dhcpcsvc.DLL","msi.dll","shdocvw.dll","WINHTTP.dll","actxprxy.dll","msls31.dll","WINSTA.dll","EXPLORERFRAME.dll","Actioncenter.dll","gameux.dll","ehSSO.dll","framedynos.dll","wpdshserviceobj.dll","netshell.dll","FXSAPI.dll","USER32.dll","cscapi.dll","QUtil.dll","wshtcpip.dll","DeviceCenter.dll","WS2_32.dll","CRYPTSP.dll","RASAPI32.dll","iphlpapi.DLL","ntshrui.dll","stobject.dll","WLDAP32.dll","sfc.dll","dnsapi.DLL","DUI70.dll","CLBCatQ.DLL","samcli.dll","ksuser.dll","hcproviders.dll","DEVRTL.dll","MSASN1.dll","netutils.dll","wshtcpip.DLL","AltTab.dll","FXSRESM.DLL","Syncreg.dll","AUDIOSES.DLL","SearchFolder.dll","msiltcfg.dll","WinSCard.dll","DEVOBJ.dll","Normaliz.dll","ATL.DLL","AVRT.dll","NetworkExplorer.dll","WTSAPI32.dll","WINBRAND.dll","KERNELBASE.dll","WININET.dll","ktmw32.dll","NLAapi.dll","npmproxy.dll","hgcpl.dll","SndVolSSO.DLL","SSPICLI.DLL","WindowsCodecs.dll","wercplsupport.dll","USERENV.dll","NSI.dll","UxTheme.dll","OLEACC.dll","HID.DLL","fwpuclnt.dll","slc.dll","WSCAPI.dll","StructuredQuery.dll","Wlanapi.dll","BatMeter.dll","IMM32.DLL","GPAPI.dll","werconcpl.dll","PortableDeviceTypes.dll","POWRPROF.dll","MsftEdit.dll","uxtheme.dll","SHELL32.dll","authui.dll","msxml3.dll","MMDevApi.dll","SspiCli.dll","fxsst.dll","netprofm.dll","PSAPI.DLL","CRYPT32.dll","WINTRUST.dll","provsvc.dll","DUser.dll","taskschd.dll","RpcRtRemote.dll","CFGMGR32.dll","ws2_32.DLL","tiptsf.dll","srchadmin.dll","SAMLIB.dll","themeui.dll","UIAnimation.dll","apphelp.dll","schannel.DLL","thumbcache.dll","IMM32.dll","LINKINFO.dll","XmlLite.dll","midimap.dll","VERSION.dll","sensapi.dll","WINNSI.DLL","wscinterop.dll","MSACM32.dll","imapi2.dll","dwmapi.dll","shacct.dll","es.dll","OLEAUT32.dll","RPCRT4.dll","PortableDeviceApi.dll","prnfldr.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df","sha256":"f4a44ad1f0f38c9e1ee6483712153fe16da4d3c4fe716cecabc50f3871f9a133","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"94308059B57B3142E455B38A6EB92015","sha256":"2e8b47658be96a88d87324cb4556c54496791ca8a5cea5bb949cd9173b52b3ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"Cab2367.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"Cab26C5.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"Cab458A.tmp","sha256":"0c14c3c231978d326fd3cda052987290867e67eb5b7eaebc52bf2696ea11f65a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"CabC531.tmp","sha256":"0c14c3c231978d326fd3cda052987290867e67eb5b7eaebc52bf2696ea11f65a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"Tar2378.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"Tar26C6.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"Tar459A.tmp","sha256":"d3f9f7ca9baf937199375fd8a7caa6904aeb25e7ae21b598c1c8bb1de57dceb2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"TarC532.tmp","sha256":"d3f9f7ca9baf937199375fd8a7caa6904aeb25e7ae21b598c1c8bb1de57dceb2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"Cab19AC.tmp","sha256":"0c14c3c231978d326fd3cda052987290867e67eb5b7eaebc52bf2696ea11f65a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"Cab257.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"Cab2D6.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"Tar19AD.tmp","sha256":"d3f9f7ca9baf937199375fd8a7caa6904aeb25e7ae21b598c1c8bb1de57dceb2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"Tar258.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"Tar2D7.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"User_Feed_Synchronization-{739fdf13-6941-b186-6cf2-d5e5e77823e8}","sha256":"c4061d6fd09795c214e027df29dd6ee34713280023d7f2c1093a528e85feadc0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"path":"%WINDIR%\\system32\\en-US\\WINHTTP.dll.mui","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"%TEMP%\\CabC531.tmp","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"path":"%TEMP%\\TarC532.tmp","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"%TEMP%\\CabA087.tmp","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"%TEMP%\\TarA088.tmp","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"%SAMPLEDIR%\\76f45e5drfg7.exe","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"C:\\","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"path":"%LOCALAPPDATA%\\ow\\fdjD92D.tmp","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\76F45E5DRFG7_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\76F45E5DRFG7_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"},{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{55A87084-A003-4EB0-123E-36D1609BCD04}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{55A87084-A003-4EB0-123E-36D1609BCD04}\\","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{FA9977F6-2618-33BD-A03E-EB5D86C3E822}\\SHELLFOLDER\\1D185B16CD5AE50DERA\\1D185B16CD5AE50DERA","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\CCLEANER MONITORING\\CCLEANER MONITORING","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{e7538e23-afe8-9721-5cc1-9a59a7b9d7c1}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{b66091c5-252f-dd10-9a3e-dafd7cc7144e}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\b66091c5252fdd109a3edafd7cc7144e","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443f"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{bb0bfc8e-cd0e-725b-029c-0b85578f963a}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{f43a7539-9acb-497b-4d3a-8ea7cb8bda67}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"Global\\f43a75399acb497b4d3a8ea7cb8bda67","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{ca7b4f62-5c7e-b328-8c96-456230762f25}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{9736e61c-81b7-233f-38e9-21ddb8c3750a}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"Global\\82a2d64b665e7267dd831ef703b4a66e","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{82a2d64b-665e-7267-dd83-1ef703b4a66e}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{10c58062-3a7a-b7fd-742f-04906df58b79}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{5b0322c3-ebc8-4a63-9d42-15a8b237f358}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{7af548be-31cf-7ddf-0c9d-1eea64861c9a}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{85b6aa32-5cf2-6d27-51a8-15c0de0feed6}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{0c70be54-c3bd-9f9a-1535-ad9c50285c38}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{7ec20355-2a1c-703d-feb0-205347434cb6}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{cb20fe81-9d77-43a5-9b7e-84fb94667839}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{46c45ce4-fd29-13b9-e183-fa6bddc75b43}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{dfafaa80-af04-ee50-a673-70ad27fc598f}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"Global\\2d1b16c1cb75737f3e1e14432e883ce8","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{2d1b16c1-cb75-737f-3e1e-14432e883ce8}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{1d41c128-2ce0-e3b5-32d8-494a4bc2f681}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{f7da5487-1ceb-2a57-8b1a-ae3ab6ec58b9}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{7681459c-9cef-1f8d-e4eb-807e51139105}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{a4bdfb44-6996-9a94-58e2-7f32824bb519}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{5e74bfcb-6530-af0e-b4df-0388cab318e4}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{6455cad7-5de8-7084-e2c8-251c4afac44f}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{e387692b-3a0d-caed-0cf0-d424fd3200c8}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{58e47d13-8918-babf-1841-b6796bf2b4ac}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{09f6c187-8ad3-a27b-ef98-6c8f0737f937}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{6fb98ea1-55e8-347b-2ffd-0a4aa6621ee2}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{ab3f4f4d-1198-6ba4-1189-8cc1fc76fd5b}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{bf8d65b8-dc33-2791-d789-8c87fb343ac3}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{b712dc8b-0118-077b-13f2-97e9cbd8125e}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{ef6348af-f43c-bf32-acb2-cbc9c0fca922}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{01117a5b-adb8-8530-2e3e-d524665069c6}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{540130aa-64bc-1371-15b4-e9f23b3c90ca}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{01fd9af5-226d-8ad9-4c20-67bf73c4c968}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{73a75d8d-30ba-6bbc-cc87-16bce454ec42}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{5d669bbe-20b7-131b-568c-eaec22b01ffb}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{b7011d40-4a2a-fbf8-806c-11d1578ae304}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]},{"name":"{43b57503-06cc-da10-ef2b-46f8820f5403}","sources":[{"report_type":"sandbox","report_id":"56f3b518aac2ed723b0b443d"}]}]}},"report_ids":{"sandbox_job_ids":["56f3b518aac2ed723b0b443f","56f3b518aac2ed723b0b443d"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Trojan.Agent Sample 9570e8ec36c9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9570e8ec36c9…. Malware family: Trojan.Agent. Threat score 100/100. 20/27 AV engines flagged this file. 11 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9570e8ec36c966432922969f8a948c5b55126e787d51ddb03f7ae71c40079813"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Agent Sample 9570e8ec36c9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9570e8ec36c9…. Malware family: Trojan.Agent. Threat score 100/100. 20/27 AV engines flagged this file. 11 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9570e8ec36c966432922969f8a948c5b55126e787d51ddb03f7ae71c40079813"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Agent Sample 9570e8ec36c9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9570e8ec36c9…. Malware family: Trojan.Agent. Threat score 100/100. 20/27 AV engines flagged this file. 11 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]