26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 35:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T416,{"@context":"https://schema.org","@type":"TechArticle","headline":"Sample 9b7206c6021c… — Score 0/100 — Hybrid Analysis","description":"Threat analysis for sample 9b7206c6021c…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9b7206c6021cef6c7b543b151929a111793310b0381f897130ef67e8b3e07dc3","keywords":["malware analysis","sandbox report","threat intelligence","9b7206c6021cef6c7b543b151929a111793310b0381f897130ef67e8b3e07dc3"],"about":{"@type":"SoftwareApplication","name":"9b7206c6021cef6c7b543b151929a111793310b0381f897130ef67e8b3e07dc3","applicationCategory":["pedll","executable"],"identifier":"9b7206c6021cef6c7b543b151929a111793310b0381f897130ef67e8b3e07dc3"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":25},"behavioralIndicators":{"malicious":0,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T35a9,Found reference to API (Indicator: "FindFirstUrlCacheEntryW"; Source: "sample.bin"), Found reference to API (Indicator: "NetGetJoinInformation"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "CredFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSizeEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "PathAppendW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeEx"; Source: "sample.bin"), Found reference to API (Indicator: "AllowMultipleTSSessions"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "NetApiBufferFree"; Source: "sample.bin"), Found reference to API (Indicator: "OpenEventW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "CloseServiceHandle"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "StrStrIW"; Source: "sample.bin"), Found reference to API (Indicator: "CryptProtectData"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFolderPathW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateGuid"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "FindCloseUrlCache"; Source: "sample.bin"), Found reference to API (Indicator: "SHCreateStreamOnFileEx"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "OutputDebugStringA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "LocalReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseMutex"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "IsWow64Process"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByteEx"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "CompareFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "sample.bin"), Found reference to API (Indicator: "CredEnumerateW"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "FlushViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "StrToInt64ExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "UnmapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedExchange"; Source: "sample.bin"), Found reference to API (Indicator: "PathFindFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenMutexW"; Source: "sample.bin"), Found reference to API (Indicator: "PathCombineW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeExW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeExA"; Source: "sample.bin"), Found reference to API (Indicator: "CryptUnprotectData"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "sample.bin"), Found reference to API (Indicator: "InternetQueryOptionW"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "SHCreateDirectoryExW"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "DuplicateHandle"; Source: "sample.bin"), Found reference to API (Indicator: "IdnToAscii"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "OpenFileMappingW"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "StrCmpIW"; Source: "sample.bin"), Found reference to API (Indicator: "UnregisterWaitEx"; Source: "sample.bin"), Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileMappingW"; Source: "sample.bin"), Found reference to API (Indicator: "MapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "UuidCreateSequential"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "QueryServiceConfigW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenServiceW"; Source: "sample.bin"), Found reference to API (Indicator: "PathRemoveFileSpecW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetSpecialFolderPathW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiA"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedDecrement"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "ServicesActive"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "StringFromGUID2"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventW"; Source: "sample.bin"), Found reference to API (Indicator: "GetUrlCacheEntryInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "PathRemoveExtensionW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "RpcServerInqCallAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "InternetTimeFromSystemTimeW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "CreateUrlCacheEntryW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "PathFileExistsW"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteUrlCacheEntryW"; Source: "sample.bin"), Found reference to API (Indicator: "PathFindExtensionW"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "StrToIntA"; Source: "sample.bin"), Found reference to API (Indicator: "StrToIntExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "CLSIDFromString"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "sample.bin"), Found reference to API (Indicator: "CoUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedIncrement"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "OpenSCManagerW"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceW"; Source: "sample.bin"), Found reference to API (Indicator: "CommitUrlCacheEntryW"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextUrlCacheEntryW"; Source: "sample.bin")28:Tee5,Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 60164-2004-161D520B Assembly shows XOR instruction xor eax ebp in Stream UID: 60164-2023-161D0B5B Assembly shows XOR instruction xor ecx ebp in Stream UID: 60164-2023-161D0B5B Assembly shows XOR instruction xor eax ebp in Stream UID: 60164-2024-161D2248 Assembly shows XOR instruction xor ecx ebp in Stream UID: 60164-2024-161D2248 Assembly shows XOR instruction xor eax ebp in Stream UID: 60164-2026-161D20D1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 60164-2026-161D20D1 Assembly shows XOR instruction xor eax ebp in Stream UID: 60164-2105-161BA24C Assembly shows XOR instruction xor ecx ebp in Stream UID: 60164-2105-161BA24C Assembly shows XOR instruction xor eax ebp in Stream UID: 60164-2145-161B9116 Assembly shows XOR instruction xor ecx ebp in Stream UID: 60164-2145-161B9116 Assembly shows XOR instruction xor eax ebp in Stream UID: 60164-2158-161B2830 Assembly shows XOR instruction xor ecx ebp in Stream UID: 60164-2158-161B2830 Assembly shows XOR instruction xor eax ebp in Stream UID: 60164-2172-161B5CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 60164-2172-161B5CAA Assembly shows XOR instruction xor byte ptr [esi] 00h in Stream UID: 60164-2176-16187478 Assembly shows XOR instruction xor eax ebp in Stream UID: 60164-2178-161B25DE Assembly shows XOR instruction xor ecx ebp in Stream UID: 60164-2178-161B25DE Assembly shows XOR instruction xor eax ebp in Stream UID: 60164-2179-161B159C Assembly shows XOR instruction xor ecx ebp in Stream UID: 60164-2179-161B159C Assembly shows XOR instruction xor eax ebp in Stream UID: 60164-2189-161B0504 Assembly shows XOR instruction xor ecx ebp in Stream UID: 60164-2189-161B0504 Assembly shows XOR instruction xor eax ebp in Stream UID: 60164-2230-1619F955 Assembly shows XOR instruction xor ecx ebp in Stream UID: 60164-2230-1619F955 Assembly shows XOR instruction xor eax ebp in Stream UID: 60164-2231-161BFB31 Assembly shows XOR instruction xor ecx ebp in Stream UID: 60164-2231-161BFB31 Assembly shows XOR instruction xor eax ebp in Stream UID: 60164-2233-161BF9D1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 60164-2233-161BF9D1 Assembly shows XOR instruction xor eax ebp in Stream UID: 60164-2239-1619FCF7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 60164-2239-1619FCF7 Assembly shows XOR instruction xor eax ebp in Stream UID: 60164-2263-1619A7E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 60164-2263-1619A7E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 60164-2267-16199F8C Assembly shows XOR instruction xor ecx ebp in Stream UID: 60164-2267-16199F8C Assembly shows XOR instruction xor eax ebp in Stream UID: 60164-2817-16185143 Assembly shows XOR instruction xor ecx ebp in Stream UID: 60164-2817-16185143 Assembly shows XOR instruction xor eax 00200000h in Stream UID: 60164-2829-16181C86 Assembly shows XOR instruction xor eax ebp in Stream UID: 60164-2885-16184282 Assembly shows XOR instruction xor ecx ebp in Stream UID: 60164-2885-16184282 Assembly shows XOR instruction xor eax ebp in Stream UID: 60164-2915-16185C3E Assembly shows XOR instruction xor ecx ebp in Stream UID: 60164-2915-16185C3E Assembly shows XOR instruction xor eax ebp in Stream UID: 60164-2922-16185D7D Assembly shows XOR instruction xor ecx ebp in Stream UID: 60164-2922-16185D7D Assembly shows XOR instruction xor cl byte ptr [ebp+0Bh] in Stream UID: 60164-2929-161847A3 Assembly shows XOR instruction xor byte ptr [esi+0Ch] cl in Stream UID: 60164-2929-161847A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 60164-2930-16185095 Assembly shows XOR instruction xor ecx ebp in Stream UID: 60164-2930-1618509529:T51e,Found XOR loop in file "sample.bin" at offset 610409; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 613277; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 617279; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 617769; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 621293; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 626495; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 627483; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 323802; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 323967; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 324225; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 620347; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1907; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 430651; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 437779; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 610370; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 616164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 617746; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 626476; code bytes = 80302a:Tc56,"rundll32.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000000000000b0f0130043003a00a0f71300426ebc71ca178772feffffff70f71300ec29bc71690c00008cf71300ff29bc71000000000000000000000000 (UID: 00000000-00001180) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001180) "regsvr32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001220) "regsvr32.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180000000000000050df170043003a0040e61700426ebc71bb96e772feffffff10e61700ec29bc71690c00002ce61700ff29bc71000000000000000000000000 (UID: 00000000-00001220) "regsvr32.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001220)2b:T5cc,GetSystemTimeAsFileTime@KERNEL32.dll at 60164-2158-161B2830 FileTimeToSystemTime@KERNEL32.dll at 60164-2164-161B114C GetSystemTimeAsFileTime@KERNEL32.dll at 60164-2178-161B25DE FileTimeToSystemTime@KERNEL32.dll at 60164-2958-1618721A FileTimeToSystemTime@KERNEL32.dll at 60164-3010-161D46BD GetSystemTimeAsFileTime@KERNEL32.dll at 60164-3637-161A48DB GetSystemTimeAsFileTime@KERNEL32.dll at 60164-3644-161A4A7D FileTimeToSystemTime@KERNEL32.dll at 60164-3681-161A57B2 FileTimeToSystemTime@KERNEL32.dll at 60164-3684-161A58EC FileTimeToSystemTime@KERNEL32.dll at 60164-3699-161A5D59 FileTimeToSystemTime@KERNEL32.dll at 60164-3700-161A5DAF FileTimeToSystemTime@KERNEL32.dll at 60164-3711-161A60F9 FileTimeToSystemTime@KERNEL32.dll at 60164-3720-161A64EE FileTimeToSystemTime@KERNEL32.dll at 60164-3725-161A6768 FileTimeToSystemTime@KERNEL32.dll at 60164-3726-161A67BE GetSystemTimeAsFileTime@KERNEL32.dll at 60164-3896-161A98EA GetSystemTimeAsFileTime@KERNEL32.dll at 60164-3937-161BC1EE GetSystemTimeAsFileTime@KERNEL32.dll at 60164-3988-161BC33D GetSystemTimeAsFileTime@KERNEL32.dll at 60164-4005-161CA2B4 GetSystemTimeAsFileTime@KERNEL32.dll at 60164-4275-161B1392 FileTimeToSystemTime@KERNEL32.dll at 60164-4280-161B16A7 GetSystemTimeAsFileTime@KERNEL32.dll at 60164-4288-161B1C2A GetSystemTimeAsFileTime@KERNEL32.dll at 60164-4295-161B207A FileTimeToSystemTime@KERNEL32.dll at 60164-4345-161D1615 GetSystemTimeAsFileTime@KERNEL32.dll at 60164-4509-161B683B2c:T54c,GetSystemTime@KERNEL32.dll at 60164-2024-161D2248 GetSystemTimeAsFileTime@KERNEL32.dll at 60164-2158-161B2830 GetSystemTimeAsFileTime@KERNEL32.dll at 60164-2178-161B25DE GetSystemTime@KERNEL32.dll at 60164-3432-1619FECB GetSystemTimeAsFileTime@KERNEL32.dll at 60164-3637-161A48DB GetSystemTimeAsFileTime@KERNEL32.dll at 60164-3644-161A4A7D GetLocalTime@KERNEL32.dll at 60164-3879-161D2BD7 GetSystemTimeAsFileTime@KERNEL32.dll at 60164-3896-161A98EA GetSystemTimeAsFileTime@KERNEL32.dll at 60164-3937-161BC1EE GetSystemTime@KERNEL32.dll at 60164-3966-161CA26B GetSystemTime@KERNEL32.dll at 60164-3986-161BC108 GetSystemTimeAsFileTime@KERNEL32.dll at 60164-3988-161BC33D GetSystemTimeAsFileTime@KERNEL32.dll at 60164-4005-161CA2B4 GetSystemTimeAsFileTime@KERNEL32.dll at 60164-4275-161B1392 GetSystemTimeAsFileTime@KERNEL32.dll at 60164-4288-161B1C2A GetSystemTimeAsFileTime@KERNEL32.dll at 60164-4295-161B207A GetSystemTimeAsFileTime@KERNEL32.dll at 60164-4509-161B683B GetSystemTimeAsFileTime@KERNEL32.dll at 60164-4513-161B6A33 GetSystemTimeAsFileTime@KERNEL32.dll at 60164-4557-161B84D1 GetSystemTimeAsFileTime@KERNEL32.dll at 60164-4583-161B92A2 GetSystemTimeAsFileTime@KERNEL32.dll at 60164-4806-161C2EB5 GetSystemTime@KERNEL32.dll at 60164-4824-161C4772 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001220-61701-47-00332B432d:T586,"rundll32.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001180) "rundll32.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00001180) "rundll32.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00001180) "regsvr32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001220) "regsvr32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001220) "regsvr32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001220) "regsvr32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001220) "regsvr32.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001220) "regsvr32.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00001220) "regsvr32.exe" called "GetProcAddress" with a parameter DllRegisterServer (UID: 00000000-00001220) "regsvr32.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00001220) "rundll32.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001004) "rundll32.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00001004) "rundll32.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00001004)2e:Tfd0,"select="$mainLink/@xml:base" />

Build a list of referenced nodes from cf:sort and cf:group -->

Process channel elements -->

Process items -->

" (Source: 9b7206c6021cef6c7b543b151929a111793310b0381f897130ef67e8b3e07dc3, Indicator: "select="$mainlink/@xml:base" />

build a list of referenced nodes from cf:sort and cf:group -->

process channel elements -->

process items -->

") "select="msfeednorm:CleanXhtmlToPlainText($normXhtml)" /> xhtml->html: drop unsafe html -->

Note that any unknown type value will yield empty output --> Generic output templates--> Output attribute with plain text value -->

xhtml->html: drop unsafe html -->

note that any unknown type value will yield empty output -->

generic output templates--> output attribute with plain text value -->

Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6addb4db6822b0637c0301db"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 60164-2829-16181C86","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"6addb4db6822b0637c0301db"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.DLL at 00000000-00001220-61701-30-0033175D\n GetModuleHandleA@KERNEL32.DLL at 00000000-00001220-61701-44-00332B04","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6addb4db6822b0637c0301db"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.DLL at 00000000-00001220-61701-52-00332519","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6addb4db6822b0637c0301db"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.dll at 60164-3888-161D5980","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6addb4db6822b0637c0301db"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to capture credentials","description":"CredEnumerateW@ADVAPI32.dll at 60164-3662-161A51CF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1555.004","relevance":7,"id":"stream-68","sources":[{"report_type":"sandbox","report_id":"6addb4db6822b0637c0301db"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineW@KERNEL32.DLL at 00000000-00001220-61701-27-00331467","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"6addb4db6822b0637c0301db"}]},{"level":"suspicious","category":"System Destruction","name":"Contains ability to remove directories","description":"RemoveDirectoryW@KERNEL32.dll at 60164-3429-1619FDAF\n RemoveDirectoryW@KERNEL32.dll at 60164-3501-161A141C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.004","relevance":3,"id":"stream-109","sources":[{"report_type":"sandbox","report_id":"6addb4db6822b0637c0301db"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to terminate a process","description":"TerminateProcess@KERNEL32.DLL at 00000000-00001220-61701-20-003327D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1489","relevance":1,"id":"stream-88","sources":[{"report_type":"sandbox","report_id":"6addb4db6822b0637c0301db"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtSetInformationProcess@NTDLL.DLL at 00000000-00001220-61701-36-00331A27","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6addb4db6822b0637c0301db"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcessToken\n RegCloseKey\n CredEnumerateW\n RegOpenKeyExA\n RegOpenKeyExW\n CreateThread\n FindResourceW\n CreateFileMappingW\n GetTickCount\n GetSystemDirectoryW\n WriteFile\n GetFileAttributesW\n OpenFileMappingW\n LoadLibraryW\n OpenProcess\n UnhandledExceptionFilter\n TerminateProcess\n GetModuleFileNameW\n GetModuleHandleW\n DeleteFileW\n FindNextFileW\n LockResource\n CreateFileW\n GetVersionExW\n OutputDebugStringA\n LoadLibraryA\n GetFileSizeEx\n FindFirstFileW\n MapViewOfFile\n GetTempPathW\n GetProcAddress\n GetVersionExA\n CreateDirectoryW\n Sleep","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6addb4db6822b0637c0301db"}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":74,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Sample Crashed"],"sandbox_reports":[{"id":"6addb4db6822b0637c0301db","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"9b7206c6021cef6c7b543b151929a111793310b0381f897130ef67e8b3e07dc3","analysis_start_time":"2026-10-25T07:50:52+00:00","indicators_count":{"informative":145,"suspicious":12,"malicious":0},"tags":["Multi-Process","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6addb4db6822b0637c0301db"}],"processes":[{"pid":3024,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00000000-00003024"},{"pid":1180,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\9b7206c6021cef6c7b543b151929a111793310b0381f897130ef67e8b3e07dc3.dll\",#1","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00001180","icon":"$31"},{"pid":1220,"ppid":0,"name":"regsvr32.exe","command_line":"/s \"C:\\9b7206c6021cef6c7b543b151929a111793310b0381f897130ef67e8b3e07dc3.dll\"","sha256":"890c1734ed1ef6b2422a9b21d6205cf91e014add8a7f41aa5a294fcf60631a7b","normalized_path":"%WINDIR%\\System32\\regsvr32.exe","uid":"00000000-00001220","icon":"$32"},{"pid":1004,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\9b7206c6021cef6c7b543b151929a111793310b0381f897130ef67e8b3e07dc3.dll\",#3","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00001004","icon":"$33"},{"pid":3120,"ppid":1004,"name":"WerFault.exe","command_line":"-u -p 1004 -s 240","sha256":"08bace187a0225e10677de9aa6738a7118be3e5cad6dc45fb8d3366a61bb343c","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00001004","uid":"00000000-00003120"},{"pid":3716,"ppid":0,"name":"WerFault.exe","command_line":"-u -p 1004 -s 240","sha256":"08bace187a0225e10677de9aa6738a7118be3e5cad6dc45fb8d3366a61bb343c","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00003716","icon":"$34"}],"all_imported_dlls":["lpk.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","iertutil.dll","api-ms-win-downlevel-user32-l1-1-0.dll","rpcss.dll","sechost.dll","shlwapi.dll","api-ms-win-core-localization-l1-2-0.dll","ws2_32.dll","urlmon.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","gdi32.dll","AcLayers.dll","msctf.dll","api-ms-win-crt-environment-l1-1-0.dll","msacm32.dll","rpcrt4.dll","ole32.dll","kernel32.dll","msvcrt.dll","profapi.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","nsi.dll","fltLib.dll","api-ms-win-crt-utility-l1-1-0.dll","normaliz.dll","AcGenral.dll","imm32.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","uxtheme.dll","cfgmgr32.dll","devobj.dll","ucrtbase.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","VxSSL32.dll","oleaut32.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-string-l1-1-0.dll","sfc.dll","sfc_os.dll","setupapi.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","user32.dll","apphelp.dll","shell32.dll","userenv.dll","mpr.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-stdio-l1-1-0.dll","msvcp140.dll","api-ms-win-core-synch-l1-2-0.dll","KernelBase.dll","9b7206c6021cef6c7b543b151929a111793310b0381f897130ef67e8b3e07dc3.dll","vcruntime140.dll","api-ms-win-core-file-l1-2-0.dll","comctl32.dll","imagehlp.dll","dwmapi.dll","winmm.dll","advapi32.dll","sspicli.dll","api-ms-win-crt-runtime-l1-1-0.dll","ntdll.dll","api-ms-win-crt-math-l1-1-0.dll","version.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","samcli.dll","wininet.dll","cryptbase.dll","usp10.dll","api-ms-win-downlevel-version-l1-1-0.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6addb4db6822b0637c0301db"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6addb4db6822b0637c0301db"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6addb4db6822b0637c0301db"}]}]}},"report_ids":{"sandbox_job_ids":["6addb4db6822b0637c0301db"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Sample 9b7206c6021c… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 9b7206c6021c…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9b7206c6021cef6c7b543b151929a111793310b0381f897130ef67e8b3e07dc3"}],["$","meta","4",{"property":"og:title","content":"Sample 9b7206c6021c… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 9b7206c6021c…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9b7206c6021cef6c7b543b151929a111793310b0381f897130ef67e8b3e07dc3"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 9b7206c6021c… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 9b7206c6021c…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L35","11",{}]]