24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T487,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample aaf789d10a3e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample aaf789d10a3e…. Malware family: Trojan.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 7 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/aaf789d10a3e643d1f808e2a5de084461b1f0625e88d4e800e75043b1b8d9f0d","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","aaf789d10a3e643d1f808e2a5de084461b1f0625e88d4e800e75043b1b8d9f0d"],"about":{"@type":"SoftwareApplication","name":"7u65j5hg.exe","applicationCategory":["peexe","executable"],"identifier":"aaf789d10a3e643d1f808e2a5de084461b1f0625e88d4e800e75043b1b8d9f0d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":21,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T901,"" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")26:T69d,"" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS")27:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"aaf789d10a3e643d1f808e2a5de084461b1f0625e88d4e800e75043b1b8d9f0d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790420095707,"unified_at":"2026-09-26T10:54:55.707Z","metadata":{"hashes":{"sha256":"aaf789d10a3e643d1f808e2a5de084461b1f0625e88d4e800e75043b1b8d9f0d","sha1":"fd7a0eef8685d7f7e96a557902fde2789b02dd5a","md5":"9c8b2d84665aeedc1368e9951c07a469","sha512":"6eb21d0b64ede22aecf3a60a9e73a101e4ef0da3f2fa9e2ee0f825392ca6fe32f68452b6dd684cf1db90266dd01780097cfe377cf609efdc16827ad16f0b2456","ssdeep":"6144:4N5sVv9KsmTM212i8CRbWG60XvvjcZPgr0KWqiOCEi7rLctf0l5JZ:AS8ugr0KWqiB760lV","ssdeep_chunks":["6144:4N5sVv9","6144:N5sVv9K","6144:5sVv9Ks","6144:sVv9Ksm","6144:Vv9KsmT","6144:v9KsmTM","6144:9KsmTM2","6144:KsmTM21","6144:smTM212","6144:mTM212i","6144:TM212i8","6144:M212i8C","6144:212i8CR","6144:12i8CRb","6144:2i8CRbW","6144:i8CRbWG","6144:8CRbWG6","6144:CRbWG60","6144:RbWG60X","6144:bWG60Xv","6144:WG60Xvv","6144:G60Xvvj","6144:60Xvvjc","6144:0XvvjcZ","6144:XvvjcZP","6144:vvjcZPg","6144:vjcZPgr","6144:jcZPgr0","6144:cZPgr0K","6144:ZPgr0KW","6144:Pgr0KWq","6144:gr0KWqi","6144:r0KWqiO","6144:0KWqiOC","6144:KWqiOCE","6144:WqiOCEi","6144:qiOCEi7","6144:iOCEi7r","6144:OCEi7rL","6144:CEi7rLc","6144:Ei7rLct","6144:i7rLctf","6144:7rLctf0","6144:rLctf0l","6144:Lctf0l5","6144:ctf0l5J","6144:tf0l5JZ","12288:4N5sVv9","12288:N5sVv9K","12288:5sVv9Ks","12288:sVv9Ksm","12288:Vv9KsmT","12288:v9KsmTM","12288:9KsmTM2","12288:KsmTM21","12288:smTM212","12288:mTM212i","12288:TM212i8","12288:M212i8C","12288:212i8CR","12288:12i8CRb","12288:2i8CRbW","12288:i8CRbWG","12288:8CRbWG6","12288:CRbWG60","12288:RbWG60X","12288:bWG60Xv","12288:WG60Xvv","12288:G60Xvvj","12288:60Xvvjc","12288:0XvvjcZ","12288:XvvjcZP","12288:vvjcZPg","12288:vjcZPgr","12288:jcZPgr0","12288:cZPgr0K","12288:ZPgr0KW","12288:Pgr0KWq","12288:gr0KWqi","12288:r0KWqiO","12288:0KWqiOC","12288:KWqiOCE","12288:WqiOCEi","12288:qiOCEi7","12288:iOCEi7r","12288:OCEi7rL","12288:CEi7rLc","12288:Ei7rLct","12288:i7rLctf","12288:7rLctf0","12288:rLctf0l","12288:Lctf0l5","12288:ctf0l5J","12288:tf0l5JZ","6144:AS8ugr0","6144:S8ugr0K","6144:8ugr0KW","6144:ugr0KWq","6144:r0KWqiB","6144:0KWqiB7","6144:KWqiB76","6144:WqiB760","6144:qiB760l","6144:iB760lV"],"imphash":"06e78c76f5301375317c4f02e8545874"},"file_info":{"file_name":"7u65j5hg.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":266752,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499292154000,"last_seen":1677383847000,"last_multi_scan":1677383847000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":13,"suspicious_count":21,"malicious_count":7,"total":41},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Yakes","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.ZPACK.185189","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.3014174","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"BC.Win.Packer.Troll-14","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Dridex.SYVS-5410","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.3014174 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Dridex.AA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004d86461 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Yakes.oupk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.xy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MlwGen.efhjnv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Dridex-NG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Yakes.266752.D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TSPY_DR.F3091D4F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TSPY_DR.F3091D4F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Inject3.ZAT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Dridex.Win32.416","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00142015-00004024-17383-202-004165EE","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20d"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"119.160.223.115:1143\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"J:\\leginfo\\Housing\\C\\privileges\\be.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20d"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\Cab6F0C.tmp\"\n \"\" created file \"%TEMP%\\Tar6F0D.tmp\"\n \"\" created file \"%TEMP%\\Cab6F4C.tmp\"\n \"\" created file \"%TEMP%\\Tar6F4D.tmp\"\n \"\" created file \"%TEMP%\\Cab85D4.tmp\"\n \"\" created file \"%TEMP%\\Tar85D5.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"IESQMMUTEX_0_208\"\n \"Local\\_!MSFTHISTORY!_\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Global\\1e2897ac828d47ea2803934b8dc1effc\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20d"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"MPRMSG.DLL\" at base 6BBB0000\n \"\" loaded module \"RTUTILS.DLL\" at base 74290000\n \"\" loaded module \"KERNEL32.DLL\" at base 76E10000\n \"\" loaded module \"DSROLE.DLL\" at base 74170000\n \"\" loaded module \"API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL\" at base 77CB0000\n \"\" loaded module \"PROFAPI.DLL\" at base 75CC0000\n \"\" loaded module \"SHLWAPI.DLL\" at base 775C0000\n \"\" loaded module \"NTDLL\" at base 77B70000\n \"\" loaded module \"USERENV.DLL\" at base 75320000\n \"\" loaded module \"SHELL32.DLL\" at base 761C0000\n \"\" loaded module \"USER32.DLL\" at base 777A0000\n \"\" loaded module \"NTDLL.DLL\" at base 77B70000\n \"\" loaded module \"ADVAPI32.DLL\" at base 77700000\n \"\" loaded module \"WININET.DLL\" at base 76090000\n \"\" loaded module \"COMCTL32.DLL\" at base 74B90000\n \"\" loaded module \"OLE32.DLL\" at base 77A10000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"MprmsgGetErrorString@MPRMSG.dll\"\n \"TraceRegisterExA@rtutils.dll\"\n \"TracePrintfExA@rtutils.dll\"\n \"DsRoleGetPrimaryDomainInformation@dsrole.dll\"\n \"DsRoleFreeMemory@dsrole.dll\"\n \"ConvertSidToStringSidW@sechost.dll\"\n \"PathCanonicalizeW@SHLWAPI.dll\"\n \"PathRemoveFileSpecW@SHLWAPI.dll\"\n \"PathFindFileNameW@SHLWAPI.dll\"\n \"memmove@ntdll.dll\"\n \"GetUserProfileDirectoryW@USERENV.dll\"\n \"CommandLineToArgvW@SHELL32.dll\"\n \"RtlFillMemory@ntdll.dll\"\n \"RegOpenKeyExA@ADVAPI32.dll\"\n \"RegQueryValueExA@ADVAPI32.dll\"\n \"OpenProcessToken@ADVAPI32.dll\"\n \"GetTokenInformation@ADVAPI32.dll\"\n \"AllocateAndInitializeSid@ADVAPI32.dll\"\n \"EqualSid@ADVAPI32.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameExW@SSPICLI.DLL at 00142015-00004024-77BD228D-158277\n LookupAccountNameLocalW@SECHOST.DLL at 00142015-00004024-77BD228D-170399","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Cab6F0C.tmp.159500\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"Tar6F0D.tmp.159531\" has type \"data\"\n \"Cab6F4C.tmp.159562\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"Tar6F4D.tmp.159593\" has type \"data\"\n \"94308059B57B3142E455B38A6EB92015.165234\" has type \"data\"\n \"Cab85D4.tmp.165328\" has type \"Microsoft Cabinet archive data, 49660 bytes, 1 file\"\n \"Tar85D5.tmp.165343\" has type \"data\"\n \"119_160_223_115[1].txt.171593\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 743-452-004191CB\n SetUnhandledExceptionFilter@KERNEL32.dll at 743-1640-00415EC3\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00142015-00004024-17383-16-0040C0C4\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00142015-00004024-17383-17-0040E07D\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00142015-00004024-17383-244-004191CB","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20d"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .rdata with unusual entropies 7.39163622264\n 7.37706936971","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20d"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00142015-00004024-77BD228D-156569\n RasRpcGetVersion@RASMAN.DLL at 00142015-00004024-77BD228D-158130","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 743-606-00406A71\n GetProcessHeap@KERNEL32.dll at 743-723-004055A4\n GetProcessHeap@KERNEL32.dll at 743-1643-00405373\n GetProcessHeap@KERNEL32.dll at 743-1595-00403584\n GetProcessHeap@KERNEL32.dll at 743-704-0040390A\n GetProcessHeap@KERNEL32.DLL at 00142015-00004024-17383-266-00403584","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20d"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\"\n \"\" created file \"C:\\Windows\\system32\\rsaenh.dll\"\n \"\" created file \"C:\\Windows\\system32\\en-US\\WINHTTP.dll.mui\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S9Y0GKU4\\119_160_223_115[1].txt\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QA0UPEJW\\119_160_223_115[1].txt\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20d"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"listen@WS2_32.DLL at 00142015-00004024-77BD228D-156899\n RasPortListen@RASMAN.DLL at 00142015-00004024-77BD228D-158048","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"Z:\\7u65j5hg.exe\" marked \"%TEMP%\\Cab6F0C.tmp\" for deletion\n \"Z:\\7u65j5hg.exe\" marked \"%TEMP%\\Tar6F0D.tmp\" for deletion\n \"Z:\\7u65j5hg.exe\" marked \"%TEMP%\\Cab6F4C.tmp\" for deletion\n \"Z:\\7u65j5hg.exe\" marked \"%TEMP%\\Tar6F4D.tmp\" for deletion\n \"Z:\\7u65j5hg.exe\" marked \"%TEMP%\\Cab85D4.tmp\" for deletion\n \"Z:\\7u65j5hg.exe\" marked \"%TEMP%\\Tar85D5.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\Cab6F0C.tmp\" with delete access\n \"\" opened \"%TEMP%\\Tar6F0D.tmp\" with delete access\n \"\" opened \"%TEMP%\\Cab6F4C.tmp\" with delete access\n \"\" opened \"%TEMP%\\Tar6F4D.tmp\" with delete access\n \"\" opened \"%TEMP%\\Cab85D4.tmp\" with delete access\n \"\" opened \"%TEMP%\\Tar85D5.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$25","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetProcAddress\n LoadLibraryA\n GetModuleHandleA\n GetTickCount\n Sleep\n LoadLibraryW\n WriteFile\n GetModuleFileNameA\n VirtualAlloc\n CreateFileA\n GetStartupInfoA\n GetCommandLineA\n GetModuleHandleW\n IsDebuggerPresent\n TerminateProcess\n UnhandledExceptionFilter\n FindWindowA\n GetWindowThreadProcessId\n FindWindowExW\n FindWindowExA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20d"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20d"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/54 Antivirus vendors marked sample as malicious (1% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20d"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 119.160.223.115 on port 1143","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"$26","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtSetSystemInformation@NTDLL.DLL at 00142015-00004024-77BD228D-160130","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20d"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Possibly checks for the presence of an Antivirus engine","description":"\"Nextop Malwarebytes\" (Indicator: \"malwarebytes\")","origin":"File/Memory","relevance":3,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"\" (Thread ID: 304) slept \"220\" times (threshold: 200)","origin":"API Call","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20d"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20d"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/42 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" touched file \"C:\\Users\\kPOxQ15\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\"\n \"\" touched file \"%WINDIR%\\system32\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\RASAPI32\" (Filter: 14)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\crypt32\" (Filter: 4)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\RASMANCS\" (Filter: 14)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"2.3.4.480\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","origin":"Registry Access","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"47/56 Antivirus vendors marked sample as malicious (83% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Contains ability to listen for incoming connections"},{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Accesses potentially sensitive information from local browsers"}],"sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":25,"imported_dlls_count":108,"dropped_files_count":0,"extracted_files_count":8,"files_written_count":30,"files_deleted_count":0,"registry_keys_created_count":128,"registry_keys_modified_count":0,"registry_keys_deleted_count":7,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":135,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"57cd7c57aac2ed1f44ba215e","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.GenericKD","contacted_countries":["THA"],"submit_name":"aaf789d10a3e643d1f808e2a5de084461b1f0625e88d4e800e75043b1b8d9f0d.bin","analysis_start_time":"2016-09-05T16:09:12+00:00","indicators_count":{"informative":11,"suspicious":13,"malicious":7},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"56a8cfac0e316d2a7583f20d","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"suspicious","threat_score":25,"malware_family":"BehavesLike.PWSZbot","submit_name":"7u65j5hg.exe","analysis_start_time":"2016-01-27T08:10:16+00:00","indicators_count":{"informative":4,"suspicious":9,"malicious":1},"is_in_unified_schema":true},{"id":"56a8cfac0e316d2a7583f20b","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":95,"malware_family":"BehavesLike.PWSZbot","contacted_countries":["THA"],"submit_name":"7u65j5hg.exe","analysis_start_time":"2016-01-27T08:10:36+00:00","indicators_count":{"informative":10,"suspicious":21,"malicious":5},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"119.160.223.115","port":1143,"protocol":"TCP","country":"Thailand","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}],"processes":[{"pid":4024,"ppid":0,"name":"7u65j5hg.exe","command_line":"","normalized_path":"","uid":"00142015-00004024","icon":"$27"}],"all_imported_dlls":["wininet.dll","ADVAPI32.dll","ole32.dll","msvcrt.dll","rasman.dll","napinsp.dll","dnsapi.DLL","pnrpnsp.dll","LPK.dll","uxtheme.dll","MPRMSG.dll","winrnr.dll","credssp.dll","GPAPI.dll","Cabinet.dll","ntmarta.dll","wshtcpip.DLL","bcryptprimitives.dll","fwpuclnt.dll","SHELL32.dll","SspiCli.dll","DEVOBJ.dll","RPCRT4.dll","rasadhlp.dll","schannel.DLL","sechost.dll","MSCTF.dll","SHLWAPI.dll","wship6.dll","RASDLG.dll","rsaenh.dll","cryptnet.dll","rtutils.dll","RASAPI32.dll","MPRAPI.dll","GDI32.dll","OLEAUT32.dll","wintrust.dll","KERNELBASE.dll","kernel32.dll","USER32.dll","SETUPAPI.dll","NSI.dll","IMM32.DLL","CRYPTSP.dll","Normaliz.dll","dhcpcsvc.DLL","CRYPT32.dll","dhcpcsvc6.DLL","CRYPTBASE.dll","sensapi.dll","DEVRTL.dll","CFGMGR32.dll","ntdll.dll","dsrole.dll","comctl32.dll","urlmon.dll","WINHTTP.dll","USP10.dll","PSAPI.DLL","MSASN1.dll","NLAapi.dll","mswsock.dll","VERSION.dll","profapi.dll","USERENV.dll","SECUR32.DLL","WS2_32.dll","iphlpapi.DLL","ncrypt.dll","imm32.dll","user32.dll","usp10.dll","advapi32.dll","crypt32.dll","msasn1.dll","msctf.dll","rpcrt4.dll","shlwapi.dll","cryptbase.dll","cryptsp.dll","gdi32.dll","shell32.dll","nsi.dll","rasdlg.dll","KernelBase.dll","lpk.dll","rasapi32.dll","ws2_32.dll","mprapi.dll","mprmsg.dll","sspicli.dll","IPHLPAPI.DLL","normaliz.dll","oleaut32.dll","userenv.dll","security.dll","SensApi.dll","secur32.dll","winnsi.dll","Wldap32.dll","iertutil.dll","schannel.dll","nlaapi.dll","NapiNSP.dll","dnsapi.dll","wshqos.dll","WSHTCPIP.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"119_160_223_115[1].txt","sha256":"0c18e130670b37e5f0fbe6619929b0887f55139a0723972df3b655678eb81032","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"name":"94308059B57B3142E455B38A6EB92015","sha256":"b9df82bf25389b10079a31f5bd3bd996195c8cec2587d43742cf3482b4700a90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"name":"Cab6F0C.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"name":"Cab6F4C.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"name":"Cab85D4.tmp","sha256":"e4cc7a1e1fa15e6610818c9512bbb47089f5c909c354d7f4e7fd18bef22c622f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"name":"Tar6F0D.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"name":"Tar6F4D.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"name":"Tar85D5.tmp","sha256":"1381bbdd25b7a9a146dc77bf19f71e82d9249de6376e3d70c0c4890ce480438d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20d"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"path":"PIPE\\lsarpc","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"path":"%WINDIR%\\system32\\en-US\\WINHTTP.dll.mui","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S9Y0GKU4\\119_160_223_115[1].txt","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QA0UPEJW\\119_160_223_115[1].txt","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\7U65J5HG_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUSTEDPEOPLE\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUSTEDPEOPLE\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\\CATALOGDB\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{C374246F-6300-E3AE-13C8-A4988E211EE8}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{C374246F-6300-E3AE-13C8-A4988E211EE8}\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\7U65J5HG_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]}]},"mutex_activity":{"mutex_created":[{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"name":"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"name":"Global\\1e2897ac828d47ea2803934b8dc1effc","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"56a8cfac0e316d2a7583f20d"},{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!kpoxq15!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!kpoxq15!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!kpoxq15!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"57cd7c57aac2ed1f44ba215e"}]}]}},"report_ids":{"sandbox_job_ids":["57cd7c57aac2ed1f44ba215e","56a8cfac0e316d2a7583f20b","56a8cfac0e316d2a7583f20d"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample aaf789d10a3e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample aaf789d10a3e…. Malware family: Trojan.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 7 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/aaf789d10a3e643d1f808e2a5de084461b1f0625e88d4e800e75043b1b8d9f0d"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample aaf789d10a3e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample aaf789d10a3e…. Malware family: Trojan.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 7 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/aaf789d10a3e643d1f808e2a5de084461b1f0625e88d4e800e75043b1b8d9f0d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample aaf789d10a3e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample aaf789d10a3e…. Malware family: Trojan.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 7 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]