24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 3f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample a3a2fe509cb2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a3a2fe509cb2…. Malware family: Trojan.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 2 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a3a2fe509cb278c84202c7f6023db15692a1e501ea3dc6c46a1d45788cacd1f4","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","a3a2fe509cb278c84202c7f6023db15692a1e501ea3dc6c46a1d45788cacd1f4"],"about":{"@type":"SoftwareApplication","name":"winwsdriver.exe","applicationCategory":["peexe","executable"],"identifier":"a3a2fe509cb278c84202c7f6023db15692a1e501ea3dc6c46a1d45788cacd1f4","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":13,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Taeb," HTTP/2 200 OK Content-Type: application/octet-stream Date: Sun 31 May 2026 08:21:29 GMT Last-Modified: Wed 08 Apr 2026 16:21:07 GMT X-Azure-Ref: 20260531T082129Z-1676f68c76bzxrdqhC1ATL3s4s0000001qag000000004myu X-Ms-Version: 2009-09-19 X-Ms-Lease-Status: unlocked X-Fd-Int-Roxy-Purgeid: 0 Vary: Accept-Encoding Content-Encoding: br X-Cache: TCP_HIT Cache-Control: public max-age=604800 X-Ms-Request-Id: 0d650d72-301e-0068-48ff-e7ac51000000 X-Ms-Blob-Type: BlockBlob with no response body "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2 Host: trc.taboola.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Date: Sun 31 May 2026 08:21:31 GMT Server: nginx X-Service-Version: v1 X-Served-By: cache-lax-kwhp1940145-LAX P3p: policyref="http://trc.taboola.com/p3p.xml" CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" Pragma: no-cache X-Cache-Hits: 0 Via: 1.1 varnish Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true X-Fastly-To-Nlb-Rtt: 63356 X-Timer: S1780215691.319254 VS0 VE129 X-Cache: MISS X-Vcl-Time-Ms: 129 Cache-Control: no-cache no-store Accept-Ranges: bytes with response body ==>BINARY_CONTENT....... "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2 Host: px.ads.linkedin.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67" Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Sun 31 May 2026 08:21:30 GMT X-Li-Fabric: prod-ltx1 Vary: Accept-Encoding X-Li-Proto: http/2 Content-Encoding: gzip Set-Cookie: lidc="b=TGST08:s=T:r=T:a=T:p=T:g=3287:u=1:x=1:i=1780215691:t=1780302091:v=2:sig=AQEpcMcjMw21mPuRkwu1usOjieGB6KtK"; Expires=Mon 01 Jun 2026 08:21:31 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure X-Li-Uuid: AAZTGMPpSIU67+luK6PLDw== Nel: {"report_to":"network-errors" "max_age":1296000 "success_fraction":0.00066 "failure_fraction":1 "include_subdomains":true} X-Msedge-Ref: Ref A: 58EA73D41D024E0B9C631A8F1A3EEC2B Ref B: BY1AA1072318034 Ref C: 2026-05-31T08:21:31Z X-Li-Pop: afd-prod-ltx1-x Report-To: {"group":"network-errors" "max_age":2592000 "endpoints":[{"url":"https://www.linkedin.com/li/rep"}] "include_subdomains":true} X-Cache: CONFIG_NOCACHE Alt-Svc: h3=":443"; ma=86400 Linkedin-Action: 1 with response body ==>BINARY_CONTENT....... "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 307 Temporary Redirect Content-Type: text/html; charset=utf-8 Date: Sun 31 May 2026 08:21:32 GMT Server: nginx/1.25.5 Set-Cookie: uuid2=3644343448780137682; SameSite=None; Path=/; Max-Age=7776000; Expires=Sat 29-Aug-2026 08:21:32 GMT; Domain=.adnxs.com; Secure; HttpOnly Expires: Sat 15 Nov 2008 16:00:00 GMT X-Xss-Protection: 0 An-X-Request-Uuid: cf19cb36-23ad-4107-bcbc-64afe770a240 X-Proxy-Origin: 64.124.12.162; 64.124.12.162; 900.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; *.adnxs.com Location: https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D Cache-Control: no-store no-cache private P3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml" CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Pragma: no-cache Accept-Ch: Sec-CH-UA-Full-Version-List Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Bitness with no response body "GET /mouse-gesture/config.json HTTP/2 Host: edge-consumer-static.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json Date: Sun 31 May 2026 08:21:44 GMT X-Azure-Ref: 20260531T082144Z-r1b75b5c86cvlb7chC1IADffc40000001890000000009vdh X-Ms-Version: 2009-09-19 X-Ms-Lease-Status: unlocked X-Ms-Blob-Type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id Server x-ms-version Content-Type ETag Last-Modified x-ms-lease-status x-ms-blob-type Content-Length Date Transfer-Encoding Access-Control-Allow-Origin: * Last-Modified: Tue 24 Oct 2023 08:27:00 GMT X-Fd-Int-Roxy-Purgeid: 83583309 Etag: 0x8DBD46AFE482320 X-Cache: TCP_HIT Cache-Control: public max-age=432000 Accept-Ranges: bytes X-Ms-Request-Id: b8597440-901e-0020-7eea-e9c9d0000000 with no response body2f:Tca3," "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgBzaHlldG9vdHZhbACNoplI"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Sun 31 May 2026 08:20:29 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Api-Version: 2.0.0 X-Timer: S1780215629.109549 VS0 VE311 X-Served-By: cache-lax-kwhp1940088-LAX X-Cache: MISS Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /chromewebstore/v1.1/items/verify HTTP/2 Host: www.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Content-Type: application/json Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "{"hash":"huW2ItenUB5YVlZ7NXhe0AUDOCkafTPcGdT6MELt6xg=","ids":["ghbmnnjooekpmoecnnnilnnbdlolhkhi"],"protocol_version":1}" HTTP/2 200 OK Content-Type: application/json; charset=UTF-8 Date: Sun 31 May 2026 08:21:30 GMT Server: ESF X-Xss-Protection: 0 X-Content-Type-Options: nosniff Vary: Referer Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT.......3c:Td18," www.upx.sourceforge.net\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a1beeeecac0be452501cbf4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"