24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T502,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Appwork.A potentially unwanted application Sample abad3a6610da… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample abad3a6610da…. Malware family: Appwork.A potentially unwanted application. Threat score 100/100. 8/24 AV engines flagged this file. 22 malicious and 30 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/abad3a6610dae56190a29bab54952ce4920c81db9176155b08f656788ddc0099","keywords":["Malicious","Appwork.A potentially unwanted application","malware analysis","sandbox report","threat intelligence","abad3a6610dae56190a29bab54952ce4920c81db9176155b08f656788ddc0099"],"about":{"@type":"SoftwareApplication","name":"Install JDownloader.exe","applicationCategory":["peexe","executable"],"identifier":"abad3a6610dae56190a29bab54952ce4920c81db9176155b08f656788ddc0099","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Appwork.A potentially unwanted application","antivirusDetections":{"malicious":8,"total":24},"behavioralIndicators":{"malicious":22,"suspicious":30},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T567,Found malicious artifacts related to "85.131.130.148" (ASN: 34309, Owner: Link11 GmbH): ... URL: http://installer.jdownloader.org/ (AV positives: 1/67 scanned on 03/04/2016 08:48:39) URL: http://installer.jdownloader.org/wb131015308786627120one (AV positives: 1/67 scanned on 03/04/2016 02:08:50) URL: http://installer.jdownloader.org/version_741/ic/JD2SilentSetup_x64.exe (AV positives: 1/67 scanned on 03/04/2016 00:06:12) URL: http://installer.jdownloader.org/rand_13090974699507260602/2434/44/windows/64/__/0/jdownloader2 (AV positives: 2/67 scanned on 03/03/2016 20:18:51) URL: http://installer.jdownloader.org/r_130988302929638671/2405/windows/64/chipjdownloader1/ (AV positives: 2/67 scanned on 03/02/2016 03:10:15) File SHA256: bc657ebd6bf63fe477a808e99b6b6feba7f678a5c2e43f1c085e5f7461c4f4fd (AV positives: 5/54 scanned on 03/07/2016 20:28:14) File SHA256: e9f708bc806e201f40fcfc791e0d8cae8b6a0e05cb6ba924fe4c02a588d7526b (AV positives: 2/56 scanned on 03/07/2016 17:57:20) File SHA256: 3e2767491d8cb69fb1d9def6904a34b75f977919bb588af37dbb50c2cf60bc32 (AV positives: 1/54 scanned on 03/06/2016 16:08:45) File SHA256: 3fe304edc2fdd8c5fb6eebca41f0c575c6221ddbacee1b1c7fbdc9116899951e (AV positives: 31/56 scanned on 03/04/2016 15:53:49) File SHA256: 0aeb2cc815a3d6df874a6090e69956ac4b045e2405c55396130e54c4de494c51 (AV positives: 37/56 scanned on 03/04/2016 15:42:09)26:T577,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000010.db" "" touched file "C:\Windows\System32\en-US\user32.dll.mui" "" touched file "C:\Windows\Fonts\StaticCache.dat" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "" touched file "C:\Windows\System32\rsaenh.dll" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "" touched file "C:\Windows\System32\wshqos.dll" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\WebInstaller[1].exe" "" touched file "C:\Windows\AppPatch\sysmain.sdb" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"27:Tdfd,"" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\131793429004410464.exe" (Handle: 564) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\131793429004410464.exe" (Handle: 564) "" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\131793429004410464.exe" (Handle: 564) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\131793429004410464.exe" (Handle: 564) "131793429004410464.exe" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nskD23C.tmp\nsD24D.tmp" (Handle: 480) "131793429004410464.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nskD23C.tmp\nsD24D.tmp" (Handle: 480) "131793429004410464.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nskD23C.tmp\nsD24D.tmp" (Handle: 480) "131793429004410464.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nskD23C.tmp\nsD24D.tmp" (Handle: 480) "131793429004410464.exe" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nskD23C.tmp\nsEDD5.tmp" (Handle: 476) "131793429004410464.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nskD23C.tmp\nsEDD5.tmp" (Handle: 476) "131793429004410464.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nskD23C.tmp\nsEDD5.tmp" (Handle: 476) "131793429004410464.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nskD23C.tmp\nsEDD5.tmp" (Handle: 476) "131793429004410464.exe" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\13179343920441046443.exe" (Handle: 620) "131793429004410464.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\13179343920441046443.exe" (Handle: 620) "131793429004410464.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\13179343920441046443.exe" (Handle: 620) "131793429004410464.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\13179343920441046443.exe" (Handle: 620) "nsD24D.tmp" wrote 1500 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 244) "nsD24D.tmp" wrote 4 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 244) "nsD24D.tmp" wrote 32 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 244) "nsD24D.tmp" wrote 52 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 244) "nsEDD5.tmp" wrote 1500 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 244) "nsEDD5.tmp" wrote 4 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 244) "nsEDD5.tmp" wrote 32 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 244) "nsEDD5.tmp" wrote 52 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 244) "13179343920441046443.exe" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-2QRR8.tmp\13179343920441046443.tmp" (Handle: 264) "13179343920441046443.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-2QRR8.tmp\13179343920441046443.tmp" (Handle: 264) "13179343920441046443.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-2QRR8.tmp\13179343920441046443.tmp" (Handle: 264) "13179343920441046443.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-2QRR8.tmp\13179343920441046443.tmp" (Handle: 264)28:Tfc8,Found malicious artifacts related to "85.131.130.148": ... URL: http://installer.jdownloader.org/fetch_1437421276345/wjd2oic1 (AV positives: 3/67 scanned on 08/21/2018 14:58:07) URL: http://installer.jdownloader.org/ (AV positives: 1/67 scanned on 08/21/2018 08:52:54) URL: http://installer.jdownloader.org/wb131792878899785000two (AV positives: 1/70 scanned on 08/21/2018 02:34:37) URL: http://installer.jdownloader.org/r_131792865272305000/2405/windows/32/0/cjdownloader2 (AV positives: 1/70 scanned on 08/21/2018 01:36:22) URL: http://installer.jdownloader.org/wb131792568251728935two (AV positives: 1/67 scanned on 08/21/2018 00:27:37) File SHA256: bc657ebd6bf63fe477a808e99b6b6feba7f678a5c2e43f1c085e5f7461c4f4fd (AV positives: 12/69 scanned on 08/20/2018 23:36:31) File SHA256: 3e2767491d8cb69fb1d9def6904a34b75f977919bb588af37dbb50c2cf60bc32 (AV positives: 3/67 scanned on 08/18/2018 17:06:06) File SHA256: 3b6e0a9c21bc65dda10e4744a9c9f9ac0bf131222417a19216ed5dfa413c9693 (AV positives: 32/69 scanned on 08/16/2018 11:35:38) File SHA256: 0783ae5bb52d022c9b4a696274d9986071fbd67f8c5fd0a0e6be49f584c36986 (AV positives: 24/61 scanned on 08/13/2018 15:27:45) File SHA256: abecc8bb3ee07c146b6e8e1285379be6517b69eb8419ff5ee5ceb4e9a675df3c (AV positives: 22/63 scanned on 08/13/2018 15:25:23) File SHA256: ecac7258921ac63a3307211dc50a905cbf9bc31a321b8331945a9e9d3567fe1f (Date: 07/09/2018 01:33:29) File SHA256: 32c8e69f7eb527222f7156212daea6e4b452fd1a8fa89b16a7441da287336e08 (Date: 02/28/2018 02:30:29) File SHA256: f0335f33ab0fa1615f3523c141e1020db24999b2a57ccf3fbe653712a0fd0a3f (Date: 02/27/2018 17:59:41) File SHA256: c9211ced6c6c7e8263b50a74cef1b4c4d6e1f182e2049c8a9ea7bcfccd53dcf9 (Date: 02/16/2018 17:21:25) File SHA256: 90d5248d24e7b687885556454a08e0e939f9ba08d02c0cf09532e2c05b2ebd03 (Date: 02/07/2018 18:06:46) Found malicious artifacts related to "148.251.68.18": ... URL: http://fetch.jdcdn.org/download/dl/prepare?l=5&t=1437508059046&v=2&s=cCUuxKSzOBGSVQdx%2fUzZG%2fe4EjZFjRQtdZaK0VqBU4o%3d (AV positives: 1/67 scanned on 08/21/2018 12:52:32) URL: http://fetch.jdcdn.org/download/dl/forward?rand_13079794515867898992/2434/49/windows/32/_GDATAINTERNETSECURITY_/0/jdownloader2 (AV positives: 1/67 scanned on 08/17/2018 23:51:09) URL: http://fetch.jdcdn.org/download/dl/forward?rand_13178865155781250062%2F2434%2F1%2Fwindows%2F32%2F_Code0x8004100e_DescriptionInvalidnamespace_FacilityWMI_%2F0%2Fjdownloader2 (AV positives: 1/70 scanned on 08/17/2018 10:58:16) URL: http://jdownloader.download-tools.org/download/dl/download?t=1441490112205&v=2&s=jrZVPETT7wF%2FZ1K6CrBekGnaetyvfJa7Cp4Wcv46lhQ%3D (AV positives: 2/67 scanned on 08/07/2018 01:48:24) URL: http://fetch.jdcdn.org/12110959312073481753.php?l=2&t=1422704639&v=1&e=1422704644&s=T5BDEtfq90CCraySckTfb--Y9zs (AV positives: 1/67 scanned on 07/22/2018 00:47:53) File SHA256: ecac7258921ac63a3307211dc50a905cbf9bc31a321b8331945a9e9d3567fe1f (Date: 07/09/2018 01:33:29) File SHA256: 6273546dfdbfef4d0661fd10ae2d375af945ed390f40fd3b6daceb827d482142 (Date: 06/04/2018 16:07:10) File SHA256: cb31e949505402099c89ba863a15b9f32520d85572ffd64dc8b4a8a73594f5fd (Date: 06/04/2018 14:52:43) File SHA256: 9a3dbeb1ff78bf8af1d87c0887010e58936414f989ffab998b11cf3e6501d7e6 (Date: 05/30/2018 17:05:37) File SHA256: dc0dc3f6ccb015893ed54b3f45386747a19aa121dd4548a1871d2550d9e917d5 (Date: 02/27/2018 17:59:49) File SHA256: 2dcf8977d68dd783457a764cabe1ec3b638209cc3377a57c8b6cf544f5a30397 (AV positives: 58/62 scanned on 07/03/2017 08:05:51) File SHA256: 6226f2f81f22c9fc9e2e69fc34a181f5441041fa215bd08717a81788f8b70ef0 (AV positives: 9/56 scanned on 03/03/2016 08:40:34) File SHA256: dcd0c2fb2c1754c2794f24a3e931ed3f8045672fafe72a205b4dea46db11f853 (AV positives: 5/56 scanned on 03/03/2016 08:34:53) File SHA256: f9e9e226d8cdda25800e4346e7fd8013f6653832f9f192d8eea95b50f80adf0a (AV positives: 5/56 scanned on 03/03/2016 05:51:15) File SHA256: ad15f507a90dd5cd9dc82ac8adfcfb4f608a83b75fa8971c1a6a337418a95a0b (AV positives: 8/56 scanned on 03/03/2016 05:43:55)29:T509,Found API call GetVersionExA@KERNEL32.DLL directly followed by "cmp dword ptr [ebp-000001B4h], 02h" and "jne 100013E0h" at 00009668-00003316-58349-3-100010D3 Found API call GetVersionExA@KERNEL32.DLL directly followed by "cmp dword ptr [ebp-000001B4h], 02h" and "jne 100013E0h" at 00010351-00002896-1166-3-100010D3 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jc 0042E119h" at 00011369-00002572-12471-748-0042E09C Found API call GetVersion@KERNEL32.DLL directly followed by "cmp bl, 04h" and "jnc 0041F161h" at 00011369-00002572-12471-885-0041F118 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0004h" and "setnb byte ptr [0049B5C4h]" at 00011369-00002572-12471-879-00419040 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 00000601h" and "jc 0046E180h" at 00011369-00002572-12471-1005-0046E13C Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0004h" and "jc 00411854h" at 00011369-00002572-12471-2463-004116F4 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 0042D9CFh" at 00011369-00002572-12471-2705-0042D974 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jnc 0045CBF5h" at 00011369-00002572-12471-1125-0045CBC02a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAB/AABwAAAHAAAAAAAAAABwAAAxAAAAAAAwAAABAAAHAAAQBHMHAAAAAAMwsAAAcAAAADAAAAAAAAE7sxMAAHAAAzMzMwAAADA7u7NMAAAAcAAzMzMxAAADu7u7M3AAAAAAACMzMzAAO7u7uzywAAAAACMyMzOzC7u7u7uzMAAAAAIzMzM7uzATO7u7s3AAAAAzMzMzI7uzAAu7MzMwAAADMzMzMzC7uzA7u7sAAAAAMzMzMyAAC7uwe7MAMzAAADMzMyAAAAO7s3uzAAAAAAAzMzRAAAAAO7O7swAAAAACIzZGZAAAAAuzu7MAgAAAAkRmZmZAAAADs7uwAAAAAjRmNmZmZAAAADe7MAAAAANmZmZmZmRAAAALuzAAAAADRmZmZmZmYAAAC7swAAAAAzOzZmZmZmQAADi7sAAAAAO7u7dmZmZEQAB7u7EAAAADu7t7N2ZmZAAAi7uzAAAAAju7a7tmZmAAAIu7swAAAAA7u7trs2ZgAAeLu7MAAAAAA7uzRzNmYAAIuzuzMwAA9wA7uzZmZgBAOLs7sLAAAHdwMzMzI2MwAHuzO7uwAAB3RwMkIiJDMwO7sjuzAAAAAAdwAAAAMzILuzAzu7AAAA8H9wAAAAAAe7MDe7sAAAAAAGcAAAAAA7swADOwAAAAAAAAAAAAA7u7swAAAAAAD//////////////8//gA+P/wAHB/4AAAf8AAAD+AAAA/AAAAHgAAAdwAAAH8AAAB+AAAAfgAAAD4AAAA8AAAAPAAAADwAAAAcAAAAPAAAAD4AAAA+AAAAPgAAAD8AAAB/AAAAf4AAAP/AAAH/4AAD//AAB//4AA///gA////j//w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"abad3a6610dae56190a29bab54952ce4920c81db9176155b08f656788ddc0099","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790288545031,"unified_at":"2026-09-24T22:22:25.031Z","metadata":{"hashes":{"sha256":"abad3a6610dae56190a29bab54952ce4920c81db9176155b08f656788ddc0099","sha1":"801fb099c67a2e7264a1675fc3359c63fe9287f7","md5":"e6d17971f0a6265a9efd7c57e6709bd0","sha512":"54dc90e1ec2691676617894bec299db7fd28af80186f0a60b1a7cc290eb58721f29abc31f379a5aa59ea5cd9e414a93e3fad5e04bcb3cef80568abb4d1722482","ssdeep":"6144:b8dNXSEo7NBjYjWV58fGm3ZlaECSyFW9H71ke6QU/4OkVokku3yprswNR:QO1DBqGS0Whqd/cH4rsw3","ssdeep_chunks":["6144:b8dNXSE","6144:8dNXSEo","6144:dNXSEo7","6144:NXSEo7N","6144:XSEo7NB","6144:SEo7NBj","6144:Eo7NBjY","6144:o7NBjYj","6144:7NBjYjW","6144:NBjYjWV","6144:BjYjWV5","6144:jYjWV58","6144:YjWV58f","6144:jWV58fG","6144:WV58fGm","6144:V58fGm3","6144:58fGm3Z","6144:8fGm3Zl","6144:fGm3Zla","6144:Gm3ZlaE","6144:m3ZlaEC","6144:3ZlaECS","6144:ZlaECSy","6144:laECSyF","6144:aECSyFW","6144:ECSyFW9","6144:CSyFW9H","6144:SyFW9H7","6144:yFW9H71","6144:FW9H71k","6144:W9H71ke","6144:9H71ke6","6144:H71ke6Q","6144:71ke6QU","6144:1ke6QU/","6144:ke6QU/4","6144:e6QU/4O","6144:6QU/4Ok","6144:QU/4OkV","6144:U/4OkVo","6144:/4OkVok","6144:4OkVokk","6144:OkVokku","6144:kVokku3","6144:Vokku3y","6144:okku3yp","6144:kku3ypr","6144:ku3yprs","6144:u3yprsw","6144:3yprswN","6144:yprswNR","12288:b8dNXSE","12288:8dNXSEo","12288:dNXSEo7","12288:NXSEo7N","12288:XSEo7NB","12288:SEo7NBj","12288:Eo7NBjY","12288:o7NBjYj","12288:7NBjYjW","12288:NBjYjWV","12288:BjYjWV5","12288:jYjWV58","12288:YjWV58f","12288:jWV58fG","12288:WV58fGm","12288:V58fGm3","12288:58fGm3Z","12288:8fGm3Zl","12288:fGm3Zla","12288:Gm3ZlaE","12288:m3ZlaEC","12288:3ZlaECS","12288:ZlaECSy","12288:laECSyF","12288:aECSyFW","12288:ECSyFW9","12288:CSyFW9H","12288:SyFW9H7","12288:yFW9H71","12288:FW9H71k","12288:W9H71ke","12288:9H71ke6","12288:H71ke6Q","12288:71ke6QU","12288:1ke6QU/","12288:ke6QU/4","12288:e6QU/4O","12288:6QU/4Ok","12288:QU/4OkV","12288:U/4OkVo","12288:/4OkVok","12288:4OkVokk","12288:OkVokku","12288:kVokku3","12288:Vokku3y","12288:okku3yp","12288:kku3ypr","12288:ku3yprs","12288:u3yprsw","12288:3yprswN","12288:yprswNR","6144:QO1DBqG","6144:O1DBqGS","6144:1DBqGS0","6144:DBqGS0W","6144:BqGS0Wh","6144:qGS0Whq","6144:GS0Whqd","6144:S0Whqd/","6144:0Whqd/c","6144:Whqd/cH","6144:hqd/cH4","6144:qd/cH4r","6144:d/cH4rs","6144:/cH4rsw","6144:cH4rsw3"],"imphash":"e160ef8e55bb9d162da4e266afd9eef3"},"file_info":{"file_name":"Install JDownloader.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":298064,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499293546000,"last_seen":1737278377000,"last_multi_scan":1737278377000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["neshta","parite","refresh","scrinject","slugin","bundlore","installcore","pua","pup","adware","filetour"]},"stats":{"av":{"malicious_count":8,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":14},"sandbox_signatures":{"informative_count":35,"suspicious_count":30,"malicious_count":22,"total":87},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Dropper.Corebot-7599208-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"PUA_Win32_Creprote","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/grayware_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Appwork.A potentially unwanted application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Riskware.Nsis.Agent.eocvgy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Adware.Win32.BundleApp.HSN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_48.4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Appwork.A potentially unwanted application","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","identifiers":[{"type":"suspicious","value":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"},{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1116","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1132","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00012287-00002028-45234-71-004042DD\n GetDiskFreeSpaceA@KERNEL32.DLL at 00012287-00002028-49955-71-004042DD","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"installer.jdownloader.org\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"85.131.130.148:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\nsnAC0.tmp\\System.dll\"\n \"\" created file \"%TEMP%\\nsnAC0.tmp\\inetc.dll\"\n \"\" created file \"%TEMP%\\131019492407640000.exe\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"System.dll.1504221800\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386\n for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /wb131019492116077500two HTTP/1.1\nUser-Agent: AppworkWI_26062015_1\nHost: installer.jdownloader.org\nConnection: Keep-Alive\nCache-Control: no-cache\"\n \"GET /wb131019492407640000two HTTP/1.1\nUser-Agent: AppworkWI_26062015_1\nHost: installer.jdownloader.org\nConnection: Keep-Alive\nCache-Control: no-cache\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 6A6E0000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, ST=UT, C=US\" (SHA1: DF:94:6A:5E:50:30:15:77:7F:D2:2F:46:B5:62:4E:CD:27:BE:E3:76, see report for more information)\n The input sample is signed with a certificate issued by \"CN=thawte Primary Root CA, OU=\"c 2006 thawte\n Inc. - For authorized use only\", OU=Certification Services Division, O=\"thawte\n Inc.\", C=US\" (SHA1: D0:0C:FD:BF:46:C9:8A:83:8B:C1:0D:C4:E0:97:AE:01:52:C4:61:BC, see report for more information)\n The input sample is signed with a certificate issued by \"CN=thawte SHA256 Code Signing CA, O=\"thawte\n Inc.\", C=US\" (SHA1: 5F:88:42:66:C8:54:1F:4E:FF:42:4E:80:51:76:D6:DC:A8:AE:04:8F, see report for more information)","origin":"Certificate Data","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"WebInstaller[1].exe.1304947218\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive\"\n \"System.dll.1504221800\" has type \"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows\"\n \"131019492407640000.exe.1550834354\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive\"\n \"inetc.dll.2587124840\" has type \"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://nsis.sf.net/NSIS_Error\"\n Pattern match: \"http://installer.jdownloader.org/wb\"\n Pattern match: \"http://www.usertrust.com1\"\n Pattern match: \"crl.usertrust.com/UTN-USERFirst-Object.crl05\"\n Pattern match: \"http://ocsp.usertrust.com0\"\n Pattern match: \"http://t2.symcb.com0\"\n Pattern match: \"http://t1.symcb.com/ThawtePCA.crl0\"\n Pattern match: \"http://tl.symcb.com/tl.crl0\"\n Pattern match: \"https://www.thawte.com/cps0/\"\n Pattern match: \"https://www.thawte.com/repository0\"\n Pattern match: \"http://tl.symcd.com0&\"\n Pattern match: \"http://tl.symcb.com/tl.crt0\"\n Heuristic match: \"ownloader.org\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00012287-00002028-45234-7-00405BC6\n GetVersion@KERNEL32.DLL at 00012287-00002028-49955-7-00405BC6","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\", Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\"\n \"\" created file \"C:\\Windows\\system32\\en-US\\urlmon.dll.mui\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QA0UPEJW\\WebInstaller[1].exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"WebInstaller[1].exe.1304947218\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive\"\n \"System.dll.1504221800\" has type \"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows\"\n \"131019492407640000.exe.1550834354\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive\"\n \"inetc.dll.2587124840\" has type \"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00012287-00002028-45234-80-00404FCD\n OpenClipboard@USER32.DLL at 00012287-00002028-49955-80-00404FCD","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\Install_JDownloader.exe\" marked \"%TEMP%\\nsr783.tmp\" for deletion\n \"C:\\Install_JDownloader.exe\" marked \"%TEMP%\\nsnAC0.tmp\" for deletion\n \"C:\\Install_JDownloader.exe\" marked \"%TEMP%\\nsnAC0.tmp\\inetc.dll\" for deletion\n \"C:\\Install_JDownloader.exe\" marked \"%TEMP%\\nsnAC0.tmp\\System.dll\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\nsr783.tmp\" with delete access\n \"\" opened \"%TEMP%\\nsnAC0.tmp\" with delete access\n \"\" opened \"%TEMP%\\nsnAC0.tmp\\inetc.dll\" with delete access\n \"\" opened \"%TEMP%\\nsnAC0.tmp\\System.dll\" with delete access\n \"\" opened \"%TEMP%\\nsnAC0.tmp\\\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"WebInstaller[1].exe\" claimed CRC 144016 while the actual is CRC 327494","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetTickCount\n GetFileAttributesA\n CreateDirectoryA\n GetFileSize\n GetModuleFileNameA\n CopyFileA\n GetTempPathA\n Sleep\n LoadLibraryA\n CreateThread\n CreateProcessA\n CreateFileA\n GetTempFileNameA\n GetProcAddress\n GetModuleHandleA\n GetCommandLineA\n LoadLibraryExA\n FindFirstFileA\n FindNextFileA\n DeleteFileA\n WriteFile\n FindWindowExA\n ShellExecuteA\n RegCloseKey\n RegOpenKeyExA\n RegDeleteKeyA\n RegDeleteValueA\n RegCreateKeyExA\n RegEnumKeyA\n VirtualAlloc\n VirtualProtect\n HttpQueryInfoA\n HttpSendRequestExA\n HttpSendRequestA\n FtpOpenFileA\n InternetQueryOptionA\n InternetWriteFile\n InternetReadFile\n InternetConnectA\n InternetCloseHandle\n InternetOpenA\n InternetCrackUrlA\n SleepEx","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"4053eb765858ec76186aec76653ced760000000000bf91760000000056cc9176000000007cca917600000000376808756a2ced76d62ded7600000000206908750000000029a6917600000000a48d087500000000f70e917600000000\" to virtual address \"0x752D1000\" (part of module \"NSI.DLL\")\n \"\" wrote bytes \"7739e97679a8ed76be72ed76d62ded761de2e87605a2ed76c868ec7657d1f376bee3e876616fed766841eb760050eb7600000000ad37fc768b2dfc76b641fc7600000000\" to virtual address \"0x74A01000\" (part of module \"WSHIP6.DLL\")\n \"\" wrote bytes \"92e6e87679a8ed76be72ed76d62ded761de2e87605a2ed76bee3e876616fed766841eb760050eb7600000000ad37fc768b2dfc76b641fc7600000000\" to virtual address \"0x744F1000\" (part of module \"WSHTCPIP.DLL\")\n \"\" wrote bytes \"0857d0750478d9750000000051c1b8769498b876ee9cb87675dcba76273eba76efb2be760000000046ce9176013d927638ed9276cfcd917631239176de2f9276c4ca917680bb917652ba91769fbb917692bb917646ba91760abf917600000000\" to virtual address \"0x6A761000\" (part of module \"SHFOLDER.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"7/55 Antivirus vendors marked sample as malicious (12% detection rate)\n 4/43 Antivirus vendors marked sample as malicious (9% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"malicious","category":"General","name":"The input sample dropped a file that was identified as malicious","description":"7/80 Antivirus vendors marked dropped file \"WebInstaller[1].exe.1304947218\" as malicious (classified as \"Adware.InstallCore\" with 8% detection rate)\n 7/80 Antivirus vendors marked dropped file \"131019492407640000.exe.1550834354\" as malicious (classified as \"Adware.InstallCore\" with 8% detection rate)\n 1/77 Antivirus vendors marked dropped file \"inetc.dll.2587124840\" as malicious (classified as \"Trojan.Virlock\" with 1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated memory in \"%TEMP%\\131019492407640000.exe\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 11264 bytes starting with PE header signature to file \"%TEMP%\\nsnAC0.tmp\\System.dll\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...\n \"\" wrote 22016 bytes starting with PE header signature to file \"%TEMP%\\nsnAC0.tmp\\inetc.dll\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...\n \"\" wrote 8192 bytes starting with PE header signature to file \"%TEMP%\\131019492407640000.exe\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$25","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00012287-00002028-45234-1-004030E2\n ExitWindowsEx@USER32.DLL at 00012287-00002028-49955-1-004030E2","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero\n Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".reloc\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"13179343920441046443.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\13179343920441046443.TMP\")\n \"13179343920441046443.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\13179343920441046443.TMP\")\n \"13179343920441046443.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\LUTUL_IS1\")\n \"13179343920441046443.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\LUTUL_IS1\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO EXE - Served Inline HTTP\" (SID: 2014519, Rev: 7, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO EXE - Served Attached HTTP\" (SID: 2014520, Rev: 6, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"nsD24D.tmp\" (UID: 00011835-00001772) was launched with new environment variables: \"__COMPAT_LAYER=\"VistaSetup\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"#32770\"\n \"131793429004410464.exe\" searching for class \"#32770\"\n \"131793429004410464.exe\" searching for class \"SysListView32\"\n \"13179343920441046443.tmp\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"131793429004410464.exe\" (UID: 00011704-00003900)\n Spawned process \"nsD24D.tmp\" with commandline \"wmic /NAMESPACE:\\\\root\\SecurityCenter path AntiVirusProduct get ...\" (UID: 00011835-00001772)\n Spawned process \"WMIC.exe\" with commandline \"wmic /NAMESPACE:\\\\root\\SecurityCenter path AntiVirusProduct get ...\" (UID: 00011950-00003516)\n Spawned process \"nsEDD5.tmp\" with commandline \"wmic /NAMESPACE:\\\\root\\SecurityCenter2 path AntiVirusProduct get ...\" (UID: 00012286-00003136)\n Spawned process \"WMIC.exe\" with commandline \"wmic /NAMESPACE:\\\\root\\SecurityCenter2 path AntiVirusProduct get ...\" (UID: 00012404-00002088)\n Spawned process \"13179343920441046443.exe\" (UID: 00012825-00003980)\n Spawned process \"13179343920441046443.tmp\" with commandline \"/SL5=\"$6027A\n1511816\n260608\n%TEMP%\\13179343920441046443.exe\"\" (UID: 00012972-00001824)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"131793429004410464.exe\" (UID: 00011704-00003900)\n Spawned process \"nsD24D.tmp\" with commandline \"wmic /NAMESPACE:\\\\root\\SecurityCenter path AntiVirusProduct get ...\" (UID: 00011835-00001772)\n Spawned process \"WMIC.exe\" with commandline \"wmic /NAMESPACE:\\\\root\\SecurityCenter path AntiVirusProduct get ...\" (UID: 00011950-00003516)\n Spawned process \"nsEDD5.tmp\" with commandline \"wmic /NAMESPACE:\\\\root\\SecurityCenter2 path AntiVirusProduct get ...\" (UID: 00012286-00003136)\n Spawned process \"WMIC.exe\" with commandline \"wmic /NAMESPACE:\\\\root\\SecurityCenter2 path AntiVirusProduct get ...\" (UID: 00012404-00002088)\n Spawned process \"13179343920441046443.exe\" (UID: 00012825-00003980)\n Spawned process \"13179343920441046443.tmp\" with commandline \"/SL5=\"$6027A\n1511816\n260608\n%TEMP%\\13179343920441046443.exe\"\" (UID: 00012972-00001824)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"}{~7m8]87n7)?o^\"\n \"}}{~7m8]87n7\"0?0Zu\", \"}}{~7m8]87n7)?^o\", \"}}{~7m8]87n7\"0o7hyhi\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")\n \"131793429004410464.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"13179343920441046443.exe\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970\n \"13179343920441046443.tmp\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970\n \"is-RLSLB.tmp\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Sun Sep 4 22:34:46 2005","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"InstallJDownloader.exe_.exe.bin\" was detected as \"Nullsoft PiMP Stub -> SFX\"\n \"WebInstaller[1].exe\" was detected as \"Nullsoft PiMP Stub -> SFX\"\n \"inetc.dll\" was detected as \"Microsoft visual C++ 6.0 DLL\"\n \"13179343920441046443.exe\" was detected as \"Borland Delphi 4.0\"\n \"13179343920441046443.tmp\" was detected as \"Borland Delphi 3.0\"\n \"is-RLSLB.tmp\" was detected as \"Borland Delphi 3.0\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.3004937348","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"131793429004410464.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/70 reputation engines marked \"http://nsis.sf.net\" as malicious (1% detection rate)\n 1/67 reputation engines marked \"http://installer.jdownloader.org\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"fetch.jdcdn.org\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"wmic.exe\" (Indicator: \"wmic.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"nsD24D.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"nsEDD5.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads system information using Windows Management Instrumentation Commandline (WMIC)","description":"Process \"WMIC.exe\" with commandline \"wmic /NAMESPACE:\\\\root\\SecurityCenter path AntiVirusProduct get displayName\" (UID: 00011950-00003516)\n Process \"WMIC.exe\" with commandline \"wmic /NAMESPACE:\\\\root\\SecurityCenter2 path AntiVirusProduct get displayName\" (UID: 00012404-00002088)","origin":"Monitored Target","mitre_attack_id":"T1047","relevance":3,"id":"target-10","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"19/67 Antivirus vendors marked sample as malicious (28% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"16/77 Antivirus vendors marked dropped file \"WebInstaller[1].exe\" as malicious (classified as \"Application.Bundler\" with 20% detection rate)\n 16/77 Antivirus vendors marked dropped file \"131793429004410464.exe\" as malicious (classified as \"Application.Bundler\" with 20% detection rate)\n 1/76 Antivirus vendors marked dropped file \"inetc.dll\" as malicious (classified as \"Adware.iBryte.jda\" with 1% detection rate)\n 39/68 Antivirus vendors marked dropped file \"13179343920441046443.exe\" as malicious (classified as \"Application.DealAgent\" with 57% detection rate)\n 1/76 Antivirus vendors marked dropped file \"nsExec.dll\" as malicious (classified as \"Unsafe\" with 1% detection rate)\n 39/68 Antivirus vendors marked dropped file \"JDownloader2Setup[1].exe\" as malicious (classified as \"Application.DealAgent\" with 57% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"16/77 Antivirus vendors marked spawned process \"131793429004410464.exe\" (PID: 3900) as malicious (classified as \"Application.Bundler\" with 20% detection rate)\n 2/68 Antivirus vendors marked spawned process \"nsD24D.tmp\" (PID: 1772) as malicious (classified as \"AdWare.MSIL\" with 2% detection rate)\n 2/68 Antivirus vendors marked spawned process \"nsEDD5.tmp\" (PID: 3136) as malicious (classified as \"AdWare.MSIL\" with 2% detection rate)\n 39/68 Antivirus vendors marked spawned process \"13179343920441046443.exe\" (PID: 3980) as malicious (classified as \"Application.DealAgent\" with 57% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"131793429004410464.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\"\n \"131793429004410464.exe\" allocated memory in \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\"\n \"131793429004410464.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\PeerDist\\Service\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$27","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: AppworkWI_26062015_1\n AppworkWI_2434_jdownloader2","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$28","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\"\n \"131793429004410464.exe\" checked file \"C:\"\n \"WMIC.exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00011262-00002476)\n Spawned process \"131793429004410464.exe\" (UID: 00011704-00003900)\n Spawned process \"nsD24D.tmp\" with commandline \"wmic /NAMESPACE:\\\\root\\SecurityCenter path AntiVirusProduct get displayName\" (UID: 00011835-00001772)\n Spawned process \"WMIC.exe\" with commandline \"wmic /NAMESPACE:\\\\root\\SecurityCenter path AntiVirusProduct get displayName\" (UID: 00011950-00003516)\n Spawned process \"nsEDD5.tmp\" with commandline \"wmic /NAMESPACE:\\\\root\\SecurityCenter2 path AntiVirusProduct get displayName\" (UID: 00012286-00003136)\n Spawned process \"WMIC.exe\" with commandline \"wmic /NAMESPACE:\\\\root\\SecurityCenter2 path AntiVirusProduct get displayName\" (UID: 00012404-00002088)\n Spawned process \"13179343920441046443.exe\" (UID: 00012825-00003980)\n Spawned process \"13179343920441046443.tmp\" with commandline \"/SL5=\"$6027A\n1511816\n260608\n%TEMP%\\13179343920441046443.exe\"\" (UID: 00012972-00001824)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.DLL at 00009990-00001752-46519-203-0040102C\n GetSystemTime@KERNEL32.DLL at 00010534-00001312-53738-203-0040102C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"WMIC.exe\" issued a query \"SELECT displayName FROM AntiVirusProduct\"","origin":"API Call","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"13161408188563453102.exe\" queries volume information of \"C:\\\" at 00009990-00001752-00000046-43707124\n \"13161408188563453102.exe\" queries volume information of \"C:\\\" at 00009990-00001752-00000046-43707305\n \"13161408188563453102.exe\" queries volume information of \"C:\\\" at 00009990-00001752-00000046-43709283\n \"13161408188563453102.exe\" queries volume information of \"C:\\\" at 00009990-00001752-00000046-43750113","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"13161408188563453102.exe\" queries volume information of \"C:\\\" at 00009990-00001752-00000046-43707124\n \"13161408188563453102.exe\" queries volume information of \"C:\\\" at 00009990-00001752-00000046-43707305\n \"13161408188563453102.exe\" queries volume information of \"C:\\\" at 00009990-00001752-00000046-43709283\n \"13161408188563453102.exe\" queries volume information of \"C:\\\" at 00009990-00001752-00000046-43750113","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"level":"informative","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET INFO EXE - Served Attached HTTP\" (SID: 2014520, Rev: 6, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"WMIC.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"\"GET /download/dl/feedback?feed_13161408188563453102/2434/windows/0/jdownloader2/OK/0 HTTP/1.1User-Agent: AppworkWI_2434_jdownloader2Host: fetch.jdcdn.orgConnection: Keep-AliveCache-Control: no-cache\"\n \"GET /download/dl/feedback?feed_13161408188563453102/2434/1/windows/0/jdownloader2/OK/0 HTTP/1.1User-Agent: AppworkWI_2434_jdownloader2Host: fetch.jdcdn.orgConnection: Keep-AliveCache-Control: no-cache\"\n \"GET /download/dl/feedback?feed_13161408188563453102/2434/windows/7/64/0/jdownloader2/OK/0 HTTP/1.1User-Agent: AppworkWI_2434_jdownloader2Host: fetch.jdcdn.orgConnection: Keep-AliveCache-Control: no-cache\"","origin":"Network Traffic","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LoadResource@KERNEL32.DLL at 00009990-00001752-46519-93-004044A4\n FindResourceA@KERNEL32.DLL at 00009990-00001752-46519-95-004043EC\n LockResource@KERNEL32.DLL at 00009990-00001752-46519-92-004044AC\n SizeofResource@KERNEL32.DLL at 00009990-00001752-46519-94-004044E4\n SizeofResource@KERNEL32.DLL at 00010534-00001312-53738-94-004044E4\n FindResourceA@KERNEL32.DLL at 00010534-00001312-53738-95-004043EC\n LockResource@KERNEL32.DLL at 00010534-00001312-53738-92-004044AC\n LoadResource@KERNEL32.DLL at 00010534-00001312-53738-93-004044A4","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST / HTTP/1.1Accept: */*Host: rp.Dodedore.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoContent-Length: 1072Cache-Control: no-cache\" with no payload\n \"POST / HTTP/1.1Accept: */*Host: rp.Dodedore.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoContent-Length: 1296Cache-Control: no-cache\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"13161408188563453102.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")","origin":"Registry Access","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the windows product ID","description":"\"13161408188563453102.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTID\")","origin":"Registry Access","relevance":6,"id":"registry-5","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 23.42.27.27 on port 56504","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"level":"malicious","category":"System Security","name":"Executes WMI queries in order to detect local security applications","description":"\"WMIC.exe\" issued a query \"SELECT displayName FROM AntiVirusProduct\"","origin":"API Call","relevance":7,"id":"api-80","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_A@NTDLL.DLL at 00008273-00001848-9439-64-00401000\n NtdllDefWindowProc_A@NTDLL.DLL at 00008654-00001316-16484-144-00401000","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$29","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeA@KERNEL32.DLL at 00011369-00002572-12471-832-004585C8","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.DLL at 00011369-00002572-12471-434-0045559C","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00008941-00002504-00000105-5257619243\n \"131723475561423408.exe\" at 00009464-00002448-00000105-49838626785\n \"WMIC.exe\" at 00009829-00001992-00000105-21258005657\n \"WMIC.exe\" at 00010514-00002872-00000105-37200106047","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")\n \"131723475561423408.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")\n \"WMIC.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetSecurityDescriptorDacl@ADVAPI32.DLL at 00009668-00003316-58349-3-100010D3\n SetSecurityDescriptorDacl@ADVAPI32.DLL at 00010351-00002896-1166-3-100010D3","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]}]},"activity":{"stats":{"process_count":11,"spawned_processes_count":11,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":41,"imported_dlls_count":133,"dropped_files_count":0,"extracted_files_count":38,"files_written_count":141,"files_deleted_count":0,"registry_keys_created_count":23,"registry_keys_modified_count":0,"registry_keys_deleted_count":11,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":34,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":5,"dns_resolutions_count":6,"contacted_urls_count":26,"http_requests_count":26},"behavior_tags":["neshta","parite","refresh","scrinject","slugin","bundlore","installcore","pua","pup","adware","filetour"],"sample_flags":["Network Traffic","Extracted Files","Sample Crashed","Multi-Process","TOR analysis"],"sandbox_reports":[{"id":"678cc3a9c3f6ff05f9099bfe","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"contacted_countries":["USA"],"submit_name":"Install JDownloader.exe","analysis_start_time":"2025-01-19T09:19:38+00:00","indicators_count":{"informative":140,"suspicious":29,"malicious":2},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":false},{"id":"5f5b94f69df78a57be324443","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":51,"malware_family":"Application.Downloader","contacted_countries":["DEU"],"submit_name":"Install JDownloader.exe_","analysis_start_time":"2020-09-11T15:17:17+00:00","indicators_count":{"informative":28,"suspicious":29,"malicious":13},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":false},{"id":"5b7c48eb7ca3e141ca3ec448","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Application.Downloader","contacted_countries":["DEU"],"submit_name":"Install JDownloader.exe_","analysis_start_time":"2018-08-21T18:12:26+00:00","indicators_count":{"informative":25,"suspicious":29,"malicious":12},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"5a6a950b7ca3e1666f41ec67","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"W32.HfsAdware","contacted_countries":["DEU","EU","USA"],"submit_name":"Install JDownloader.exe","analysis_start_time":"2018-01-26T03:39:51+00:00","indicators_count":{"informative":30,"suspicious":27,"malicious":17},"tags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"is_in_unified_schema":true},{"id":"576e169faac2ed5d44dafc52","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"HEUR:AdWare.Generic","contacted_countries":["DEU"],"submit_name":"Install JDownloader.exe","analysis_start_time":"2018-06-01T10:24:55+00:00","indicators_count":{"informative":31,"suspicious":32,"malicious":14},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"56df4f9daac2edf3159a275e","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":97,"malware_family":"Trojan.Generic","contacted_countries":["DEU"],"submit_name":"Install JDownloader.exe","analysis_start_time":"2016-03-08T16:18:25+00:00","indicators_count":{"informative":12,"suspicious":20,"malicious":8},"tags":["Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"56614a030e316d344978d975","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Adware.InstallCore","contacted_countries":["DEU"],"submit_name":"Install JDownloader.exe","analysis_start_time":"2015-12-04T02:08:49+00:00","indicators_count":{"informative":13,"suspicious":26,"malicious":11},"tags":["Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"562086e20e316da82b257ab9","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":76,"malware_family":"Adware.InstallCore","contacted_countries":["DEU"],"submit_name":"Install JDownloader.exe","analysis_start_time":"2015-10-16T00:12:32+00:00","indicators_count":{"informative":11,"suspicious":19,"malicious":7},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":[{"address":"85.131.130.148","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"address":"148.251.68.18","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"address":"52.49.132.154","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"address":"66.225.197.197","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"address":"23.42.27.27","port":56504,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]}],"dns_resolutions":[{"domain":"installer.jdownloader.org","address":"85.131.130.148","country":"Germany","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"domain":"fetch.jdcdn.org","address":"148.251.68.18","ttl":3023,"country":"Germany","registrar_name":"eNom, Inc.","registrar_organization":"AppWork GmbH","registrar_name_servers":"NS-1049.AWSDNS-03.ORG","registrar_creation_date":"2014-08-18T09:07:31+00:00","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"domain":"rp.Dodedore.com","address":"52.49.132.154","country":"United States","registrar_name":"PDR Ltd. d/b/a PublicDomainRegistry.com","registrar_organization":"Privacy Protection Service INC d/b/a PrivacyProtect.org","registrar_creation_date":"2015-04-21T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"domain":"crl4.digicert.com","address":"66.225.197.197","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"domain":"rp.dodedore.com","address":"54.76.38.42","country":"United States","registrar_name":"PDR Ltd. d/b/a PublicDomainRegistry.com","registrar_organization":"Privacy Protection Service INC d/b/a PrivacyProtect.org","registrar_creation_date":"2015-04-21T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"domain":"crl3.digicert.com","address":"93.184.220.29","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]}],"http_requests":[{"host":"installer.jdownloader.org","host_ip":"85.131.130.148:80","url":"/wb131019492116077500two","method":"GET","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"host":"installer.jdownloader.org","host_ip":"85.131.130.148:80","url":"/wb131019492407640000two","method":"GET","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"host":"installer.jdownloader.org","host_ip":"85.131.130.148:80","url":"/wb131793429004410464two","method":"GET","header":"GET /wb131793429004410464two HTTP/1.1\nUser-Agent: AppworkWI_26062015_1\nHost: installer.jdownloader.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"host":"installer.jdownloader.org","host_ip":"85.131.130.148:80","url":"/rand_13179343920441046443/2434/1/windows/32/__/0/jdownloader2","method":"GET","header":"GET /rand_13179343920441046443/2434/1/windows/32/__/0/jdownloader2 HTTP/1.1\nUser-Agent: AppworkWI_2434_jdownloader2\nHost: installer.jdownloader.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"host":"fetch.jdcdn.org","host_ip":"148.251.68.18:80","url":"/download/dl/forward?rand_13179343920441046443/2434/1/windows/32/__/0/jdownloader2","method":"GET","header":"GET /download/dl/forward?rand_13179343920441046443/2434/1/windows/32/__/0/jdownloader2 HTTP/1.1\nUser-Agent: AppworkWI_2434_jdownloader2\nHost: fetch.jdcdn.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"host":"installer.jdownloader.org","host_ip":"85.131.130.148:80","url":"/feed_13179343920441046443/2434/windows/0/jdownloader2/OK/0","method":"GET","header":"GET /feed_13179343920441046443/2434/windows/0/jdownloader2/OK/0 HTTP/1.1\nUser-Agent: AppworkWI_2434_jdownloader2\nHost: installer.jdownloader.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"host":"fetch.jdcdn.org","host_ip":"148.251.68.18:80","url":"/download/dl/feedback?feed_13179343920441046443/2434/windows/0/jdownloader2/OK/0","method":"GET","header":"GET /download/dl/feedback?feed_13179343920441046443/2434/windows/0/jdownloader2/OK/0 HTTP/1.1\nUser-Agent: AppworkWI_2434_jdownloader2\nHost: fetch.jdcdn.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"host":"installer.jdownloader.org","host_ip":"85.131.130.148:80","url":"/feed_13179343920441046443/2434/1/windows/0/jdownloader2/OK/0","method":"GET","header":"GET /feed_13179343920441046443/2434/1/windows/0/jdownloader2/OK/0 HTTP/1.1\nUser-Agent: AppworkWI_2434_jdownloader2\nHost: installer.jdownloader.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"host":"fetch.jdcdn.org","host_ip":"148.251.68.18:80","url":"/download/dl/feedback?feed_13179343920441046443/2434/1/windows/0/jdownloader2/OK/0","method":"GET","header":"GET /download/dl/feedback?feed_13179343920441046443/2434/1/windows/0/jdownloader2/OK/0 HTTP/1.1\nUser-Agent: AppworkWI_2434_jdownloader2\nHost: fetch.jdcdn.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"host":"installer.jdownloader.org","host_ip":"85.131.130.148:80","url":"/feed_13179343920441046443/2434/windows/7/32/0/jdownloader2/OK/0","method":"GET","header":"GET /feed_13179343920441046443/2434/windows/7/32/0/jdownloader2/OK/0 HTTP/1.1\nUser-Agent: AppworkWI_2434_jdownloader2\nHost: installer.jdownloader.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"host":"fetch.jdcdn.org","host_ip":"148.251.68.18:80","url":"/download/dl/feedback?feed_13179343920441046443/2434/windows/7/32/0/jdownloader2/OK/0","method":"GET","header":"GET /download/dl/feedback?feed_13179343920441046443/2434/windows/7/32/0/jdownloader2/OK/0 HTTP/1.1\nUser-Agent: AppworkWI_2434_jdownloader2\nHost: fetch.jdcdn.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"host":"installer.jdownloader.org","host_ip":"85.131.130.148:80","url":"/wb131614080500634531two","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wb131614080500634531two HTTP/1.1\nUser-Agent: AppworkWI_26062015_1\nHost: installer.jdownloader.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"host":"installer.jdownloader.org","host_ip":"85.131.130.148:80","url":"/rand_13161408188563453102/2434/1/windows/64/__/0/jdownloader2","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /rand_13161408188563453102/2434/1/windows/64/__/0/jdownloader2 HTTP/1.1\nUser-Agent: AppworkWI_2434_jdownloader2\nHost: installer.jdownloader.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"host":"fetch.jdcdn.org","host_ip":"148.251.68.18:80","url":"/download/dl/forward?rand_13161408188563453102/2434/1/windows/64/__/0/jdownloader2","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /download/dl/forward?rand_13161408188563453102/2434/1/windows/64/__/0/jdownloader2 HTTP/1.1\nUser-Agent: AppworkWI_2434_jdownloader2\nHost: fetch.jdcdn.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"host":"rp.Dodedore.com","host_ip":"52.49.132.154:80","url":"/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST / HTTP/1.1\nAccept: */*\nHost: rp.Dodedore.com\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nContent-Length: 1072\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"host":"crl4.digicert.com","host_ip":"66.225.197.197:80","url":"/DigiCertHighAssuranceEVRootCA.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /DigiCertHighAssuranceEVRootCA.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl4.digicert.com","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"host":"crl3.digicert.com","host_ip":"93.184.220.29:80","url":"/sha2-ha-cs-g1.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /sha2-ha-cs-g1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl3.digicert.com","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"host":"installer.jdownloader.org","host_ip":"85.131.130.148:80","url":"/feed_13161408188563453102/2434/windows/0/jdownloader2/OK/0","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /feed_13161408188563453102/2434/windows/0/jdownloader2/OK/0 HTTP/1.1\nUser-Agent: AppworkWI_2434_jdownloader2\nHost: installer.jdownloader.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"host":"fetch.jdcdn.org","host_ip":"148.251.68.18:80","url":"/download/dl/feedback?feed_13161408188563453102/2434/windows/0/jdownloader2/OK/0","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /download/dl/feedback?feed_13161408188563453102/2434/windows/0/jdownloader2/OK/0 HTTP/1.1\nUser-Agent: AppworkWI_2434_jdownloader2\nHost: fetch.jdcdn.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"host":"installer.jdownloader.org","host_ip":"85.131.130.148:80","url":"/feed_13161408188563453102/2434/1/windows/0/jdownloader2/OK/0","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /feed_13161408188563453102/2434/1/windows/0/jdownloader2/OK/0 HTTP/1.1\nUser-Agent: AppworkWI_2434_jdownloader2\nHost: installer.jdownloader.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"host":"fetch.jdcdn.org","host_ip":"148.251.68.18:80","url":"/download/dl/feedback?feed_13161408188563453102/2434/1/windows/0/jdownloader2/OK/0","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /download/dl/feedback?feed_13161408188563453102/2434/1/windows/0/jdownloader2/OK/0 HTTP/1.1\nUser-Agent: AppworkWI_2434_jdownloader2\nHost: fetch.jdcdn.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"host":"installer.jdownloader.org","host_ip":"85.131.130.148:80","url":"/feed_13161408188563453102/2434/windows/7/64/0/jdownloader2/OK/0","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /feed_13161408188563453102/2434/windows/7/64/0/jdownloader2/OK/0 HTTP/1.1\nUser-Agent: AppworkWI_2434_jdownloader2\nHost: installer.jdownloader.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"host":"fetch.jdcdn.org","host_ip":"148.251.68.18:80","url":"/download/dl/feedback?feed_13161408188563453102/2434/windows/7/64/0/jdownloader2/OK/0","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /download/dl/feedback?feed_13161408188563453102/2434/windows/7/64/0/jdownloader2/OK/0 HTTP/1.1\nUser-Agent: AppworkWI_2434_jdownloader2\nHost: fetch.jdcdn.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"host":"installer.jdownloader.org","host_ip":"85.131.130.148:80","url":"/wb131723475561423408two","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wb131723475561423408two HTTP/1.1\nUser-Agent: AppworkWI_26062015_1\nHost: installer.jdownloader.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"host":"installer.jdownloader.org","host_ip":"85.131.130.148:80","url":"/rand_13172347695339945651/2434/1/windows/32/__/0/jdownloader2","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /rand_13172347695339945651/2434/1/windows/32/__/0/jdownloader2 HTTP/1.1\nUser-Agent: AppworkWI_2434_jdownloader2\nHost: installer.jdownloader.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"host":"fetch.jdcdn.org","host_ip":"148.251.68.18:80","url":"/download/dl/forward?rand_13172347695339945651/2434/1/windows/32/__/0/jdownloader2","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /download/dl/forward?rand_13172347695339945651/2434/1/windows/32/__/0/jdownloader2 HTTP/1.1\nUser-Agent: AppworkWI_2434_jdownloader2\nHost: fetch.jdcdn.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}],"processes":[{"pid":1848,"ppid":0,"name":"abad3a6610dae56190a29bab54952ce4920c81db9176155b08f656788ddc0099.exe","command_line":"","sha256":"abad3a6610dae56190a29bab54952ce4920c81db9176155b08f656788ddc0099","normalized_path":"C:\\abad3a6610dae56190a29bab54952ce4920c81db9176155b08f656788ddc0099.exe","uid":"00008273-00001848","icon":"$2a"},{"pid":1316,"ppid":1848,"name":"131614080500634531.exe","command_line":"","sha256":"bc657ebd6bf63fe477a808e99b6b6feba7f678a5c2e43f1c085e5f7461c4f4fd","normalized_path":"%TEMP%\\131614080500634531.exe","parent_uid":"00008273-00001848","uid":"00008654-00001316"},{"pid":1084,"ppid":1316,"name":"WMIC.exe","command_line":"wmic /NAMESPACE:\\\\root\\SecurityCenter path AntiVirusProduct get displayName","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00008654-00001316","uid":"00008802-00001084"},{"pid":2984,"ppid":1316,"name":"WMIC.exe","command_line":"wmic /NAMESPACE:\\\\root\\SecurityCenter2 path AntiVirusProduct get displayName","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00008654-00001316","uid":"00009311-00002984"},{"pid":1752,"ppid":1316,"name":"13161408188563453102.exe","command_line":"","sha256":"fc35d3ef351e501176c2c8bd9e83715a66cd8e73abfab415e1d3ea8ff013767c","normalized_path":"%TEMP%\\13161408188563453102.exe","parent_uid":"00008654-00001316","uid":"00009990-00001752"},{"pid":1312,"ppid":1752,"name":"13161408188563453102.exe","command_line":"/_ShowProgress","sha256":"fc35d3ef351e501176c2c8bd9e83715a66cd8e73abfab415e1d3ea8ff013767c","normalized_path":"%TEMP%\\13161408188563453102.exe","parent_uid":"00009990-00001752","uid":"00010534-00001312"},{"pid":1072,"ppid":1752,"name":"regsvr32.exe","command_line":"%WINDIR%\\system32\\regsvr32.exe /s %WINDIR%\\system32\\jscript.dll","sha256":"890c1734ed1ef6b2422a9b21d6205cf91e014add8a7f41aa5a294fcf60631a7b","normalized_path":"%WINDIR%\\SysWOW64\\regsvr32.exe","parent_uid":"00009990-00001752","uid":"00010840-00001072"},{"pid":3060,"ppid":1752,"name":"regsvr32.exe","command_line":"%WINDIR%\\system32\\regsvr32.exe /s %WINDIR%\\system32\\mshtml.dll","sha256":"890c1734ed1ef6b2422a9b21d6205cf91e014add8a7f41aa5a294fcf60631a7b","normalized_path":"%WINDIR%\\SysWOW64\\regsvr32.exe","parent_uid":"00009990-00001752","uid":"00010855-00003060"},{"pid":2668,"ppid":1752,"name":"regsvr32.exe","command_line":"%WINDIR%\\system32\\regsvr32.exe /s %WINDIR%\\system32\\shdocvw.dll","sha256":"890c1734ed1ef6b2422a9b21d6205cf91e014add8a7f41aa5a294fcf60631a7b","normalized_path":"%WINDIR%\\SysWOW64\\regsvr32.exe","parent_uid":"00009990-00001752","uid":"00010877-00002668"},{"pid":2632,"ppid":1752,"name":"regsvr32.exe","command_line":"%WINDIR%\\system32\\regsvr32.exe /s %WINDIR%\\system32\\ieframe.dll","sha256":"890c1734ed1ef6b2422a9b21d6205cf91e014add8a7f41aa5a294fcf60631a7b","normalized_path":"%WINDIR%\\SysWOW64\\regsvr32.exe","parent_uid":"00009990-00001752","uid":"00010893-00002632"},{"pid":2660,"ppid":1752,"name":"regsvr32.exe","command_line":"%WINDIR%\\system32\\regsvr32.exe /s %WINDIR%\\system32\\mshtmled.dll","sha256":"890c1734ed1ef6b2422a9b21d6205cf91e014add8a7f41aa5a294fcf60631a7b","normalized_path":"%WINDIR%\\SysWOW64\\regsvr32.exe","parent_uid":"00009990-00001752","uid":"00010910-00002660"}],"all_imported_dlls":["lpk.dll","ole32.dll","uxtheme.dll","shfolder.dll","setupapi.dll","imm32.dll","rasapi32.dll","rtutils.dll","shell32.dll","apphelp.dll","msvcrt.dll","propsys.dll","System.dll","msasn1.dll","KernelBase.dll","usp10.dll","WSHTCPIP.DLL","shlwapi.dll","msctf.dll","wininet.dll","rasman.dll","NapiNSP.dll","user32.dll","comctl32.dll","version.dll","mswsock.dll","wship6.dll","cryptbase.dll","devobj.dll","dnsapi.dll","sechost.dll","oleaut32.dll","iertutil.dll","nsi.dll","nlaapi.dll","pnrpnsp.dll","clbcatq.dll","profapi.dll","SensApi.dll","winrnr.dll","cfgmgr32.dll","inetc.dll","crypt32.dll","sspicli.dll","winnsi.dll","dwmapi.dll","gdi32.dll","Wldap32.dll","ws2_32.dll","urlmon.dll","IPHLPAPI.DLL","ntdll.dll","kernel32.dll","advapi32.dll","rpcrt4.dll","ntmarta.dll","riched20.dll","rasadhlp.dll","FWPUCLNT.DLL","devrtl.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","webio.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","netprofm.dll","dhcpcsvc6.dll","npmproxy.dll","AcGenral.dll","normaliz.dll","wbemsvc.dll","ntdsapi.dll","MSOXMLMF.DLL","tiptsf.dll","dui70.dll","cryptsp.dll","userenv.dll","secur32.dll","sfc.dll","sfc_os.dll","mpr.dll","framedynos.dll","wbemprox.dll","msvcr90.dll","api-ms-win-downlevel-version-l1-1-0.dll","winhttp.dll","fastprox.dll","sxs.dll","duser.dll","api-ms-win-downlevel-user32-l1-1-0.dll","dhcpcsvc.dll","ncrypt.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","wbemcomn.dll","bcrypt.dll","_shfoldr.dll","msacm32.dll","wtsapi32.dll","msxml3.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","winmm.dll","msxml3r.dll","RstrtMgr.dll","bcryptprimitives.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","rsaenh.dll","comdlg32.dll","imageres.dll","netmsg.dll","samcli.dll","rpcss.dll","vbscript.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","RpcRtRemote.dll","wshqos.dll","ExplorerFrame.dll","olepro32.dll","jscript9.dll","UIAutomationCore.dll","msls31.dll","wow64win.dll","msimtf.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","oleacc.dll","wow64cpu.dll","powrprof.dll","jscript.dll","ieframe.dll","psapi.dll","mshtml.dll","oleaccrc.dll","mshtmled.dll","wow64.dll","winsta.dll","shdocvw.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"WebInstaller[1].exe","sha256":"bc657ebd6bf63fe477a808e99b6b6feba7f678a5c2e43f1c085e5f7461c4f4fd","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"131019492407640000.exe","sha256":"bc657ebd6bf63fe477a808e99b6b6feba7f678a5c2e43f1c085e5f7461c4f4fd","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"name":"inetc.dll","sha256":"67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"System.dll","sha256":"44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"JDownloader2Setup[1].exe","sha256":"eaeb47d999f52f4e3b724c26aa7efb8f05f01985fdfd6eb3f3a47baadb63dd36","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"131793429004410464.exe","sha256":"bc657ebd6bf63fe477a808e99b6b6feba7f678a5c2e43f1c085e5f7461c4f4fd","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"name":"13179343920441046443.exe","sha256":"eaeb47d999f52f4e3b724c26aa7efb8f05f01985fdfd6eb3f3a47baadb63dd36","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"name":"nsExec.dll","sha256":"030bcfa82e3bb424835a5fa53a3ff17ab08557d3bbeea4815313036fc4bdafe1","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"is-RLSLB.tmp","sha256":"0107efdcbff25b3ce574d00901e97accc57931973701e3938cb2e4958d12f917","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"name":"13179343920441046443.tmp","sha256":"0e19765b89a1a29afee09810dcb3ec5cc7c66053947be8f1aebdbb7c801dfeaf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"name":"is-2R4MU.tmp","sha256":"f16510a076ecf1f8a9cf177eb426022c9f80ffface293f608327f458fcfefd9f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"name":"is-GFM0E.tmp","sha256":"608868fa6de12f3b905934cdc449dfa04540d0fdc30bf7043bc3ad6131d0ba89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"name":"is-OIP05.tmp","sha256":"db79ba66efa9f651355ed9f3fc934de981b655221985ce722d265442742af4b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"name":"is-PSV60.tmp","sha256":"01be07b9aa6fe89927913d51c9422d76c1027089f827595fdacc5a48c08590e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"name":"is-QFAPO.tmp","sha256":"1959fe54b043b007940690d2eed7e6f58445373d4b5352701f4d58032a3cbbb3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"name":"is-VEKU3.tmp","sha256":"7ceb5987fa8301d045845025e9f03506ad3a69a5613248d3fac261e6f3d94ffe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"name":"unins000.dat","sha256":"edc734406fec440d1a4a19ea763d571495b601c0635fe07960b9ea8e41d5fa40","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"name":"131614080500634531.exe","sha256":"bc657ebd6bf63fe477a808e99b6b6feba7f678a5c2e43f1c085e5f7461c4f4fd","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"name":"13161408188563453102.exe","sha256":"fc35d3ef351e501176c2c8bd9e83715a66cd8e73abfab415e1d3ea8ff013767c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"name":"00027063.log","sha256":"b0b25da60c3283c465a559f65e59003b9d64a6adf36eb45561f194e4f14ff081","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"name":"0002711F.log","sha256":"a30829bdf6d12698af7b0d65ac966a3e4758021356b5d6c0e5899faea53a615c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"name":"0002712E.log","sha256":"1d67f478d6580cc0f7cb3e4b712c5d152825377eb0819d14bd316bfbe2bfa17a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"name":"ie6_main.css","sha256":"40d6ba9c336bef314352aac5a6f75695708efcf2381d165927e48a86fd718db3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"name":"main.css","sha256":"aeda82b1a14c52b444d992bf25c719228dfc90ab60fd05e9387f7882a0837f42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"name":"browse.css","sha256":"5ef48a8c8c3771b4f233314d50dd3b5afdcd99dd4b74a9745c8fe7b22207056d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"name":"button.css","sha256":"8e806f5b94fc294e918503c8053ef1284e4f4b1e02c7da4f4635e33ec33e0534","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"name":"checkbox.css","sha256":"b09504c1bf0486d3ec46500592b178a3a6c39284672af8815c3687cc3d29560d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"name":"button-bg.png","sha256":"2693930c474fe640e2fe8d6ef98abe2ecd303d2392c3d8b2e006e8942ba8f534","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"name":"progress-bg-corner.png","sha256":"86b6e6826bcde2955d64d4600a4e01693522c1fddf156ce31c4ba45b3653a7bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"name":"progress-bg.png","sha256":"c1cf449536bc2778e27348e45f0f53d04c284109199fb7a9af7a61016b91f8bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"name":"progress-bg2.png","sha256":"ab4eeb3ea1eef4e84cb61eccb0ba0998b32108d70b3902df3619f4d9393f74c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"name":"progress-bar.css","sha256":"48eb110422c375476da8f24a3b2b5c0ea2cdb09d90f7ac95d98d2c1bc8fb61e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"name":"csshover3.htc","sha256":"e37e99ddfc73ac7ba774e23736b2ef429d9a0cb8c906453c75b14c029bdd5493","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"name":"form.bmp.Mask","sha256":"27dd029405cbfb0c3bf8bac517be5db9aa83e981b1dc2bd5c5d6c549fa514101","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"name":"BG.jpg","sha256":"8c307c6d43800820bf012a99c63455de9c4947270f91a398aae102b8700a7e90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"name":"131723475561423408.exe","sha256":"bc657ebd6bf63fe477a808e99b6b6feba7f678a5c2e43f1c085e5f7461c4f4fd","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"13172347695339945651.exe","sha256":"eaeb47d999f52f4e3b724c26aa7efb8f05f01985fdfd6eb3f3a47baadb63dd36","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"13172347695339945651.tmp","sha256":"0e19765b89a1a29afee09810dcb3ec5cc7c66053947be8f1aebdbb7c801dfeaf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"path":"MountPointManager","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"path":"%SAMPLEDIR%\\","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"path":"C:\\Install_JDownloader.exe","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%TEMP%\\nsnAC0.tmp","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QA0UPEJW\\WebInstaller[1].exe","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"path":"%TEMP%\\131019492407640000.exe","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"path":"C:\\InstallJDownloader.exe_.exe","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\WebInstaller[1].exe","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"path":"%TEMP%\\nstC6C2.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000010.db","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%TEMP%\\nskD1ED.tmp","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"path":"%TEMP%\\nskD23C.tmp\\nsExec.dll","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"path":"%WINDIR%\\System32\\wbem\\WMIC.exe","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%WINDIR%\\System32\\wbem\\xsl-mappings.xml","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%WINDIR%\\System32\\wbem\\texttable.xsl","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%WINDIR%\\System32\\msxml3.dll\\1","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%WINDIR%\\System32\\msxml3.dll","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%WINDIR%\\System32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%TEMP%\\nskD23C.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\JDownloader2Setup[1].exe","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%WINDIR%\\AppPatch\\AcGenral.dll","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%WINDIR%\\system32\\en\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"path":"%WINDIR%\\System32\\netmsg.dll","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%TEMP%\\13179343920441046443.exe","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"path":"%LOCALAPPDATA%\\Programs","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%LOCALAPPDATA%\\Programs\\Common","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%WINDIR%\\System32\\shfolder.dll","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%WINDIR%\\System32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%WINDIR%\\system32\\en\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"path":"%PROGRAMFILES%\\Lutul\\Refokop.exe","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"path":"%PROGRAMFILES%\\Lutul","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"path":"%TEMP%\\is-2QRR8.tmp\\13179343920441046443.tmp","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"path":"%PROGRAMFILES%\\Lutul\\unins000.dat","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"path":"%TEMP%\\nskD23C.tmp\\inetc.dll","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"path":"C:\\abad3a6610dae56190a29bab54952ce4920c81db9176155b08f656788ddc0099.exe","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\WebInstaller[1].exe","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%TEMP%\\nsd4AA.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%TEMP%\\nsq1851.tmp","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%TEMP%\\nsw190E.tmp\\nsExec.dll","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%WINDIR%\\SysWOW64\\wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%WINDIR%\\SysWOW64\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%WINDIR%\\SysWOW64\\wbem\\xsl-mappings.xml","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%WINDIR%\\SysWOW64\\wbem\\texttable.xsl","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%WINDIR%\\SysWOW64\\msxml3.dll\\1","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%WINDIR%\\SysWOW64\\msxml3.dll","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%WINDIR%\\SysWOW64\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%TEMP%\\nsw190E.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\JDownloader2Setup[1].exe","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%TEMP%\\inH15985961345","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%TEMP%\\INH159~1\\css","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%TEMP%\\INH159~1\\css\\sdk-ui","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%TEMP%\\INH159~1\\css\\sdk-ui\\images","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%TEMP%\\INH159~1\\images","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%TEMP%\\INH159~1\\locale","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"pipe\\0J1Q1F2W1G1I1F1T1Q1P1CtB","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%TEMP%\\in0DB19A7D","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%TEMP%\\in0DB19A7D\\43F4AA3C.tmp","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%TEMP%\\131614~2.EXE","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%TEMP%\\inH15985961345\\bootstrap_38771.html","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%TEMP%\\13161408188563453102.exe","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%WINDIR%\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\comctl32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\jscript9.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\regsvr32.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"%TEMP%\\nsw190E.tmp\\inetc.dll","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"path":"C:\\Install JDownloader.exe","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\WebInstaller[1].exe","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%TEMP%\\nsp6582.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%TEMP%\\nsf79D0.tmp","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"C:\\Users\\WMU1qV0","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%TEMP%\\nsx7A17.tmp\\nsExec.dll","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%TEMP%\\nsx7A17.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%WINDIR%\\System32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\BPL0BFI3\\JDownloader2Setup[1].exe","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%TEMP%\\is-BBKEJ.tmp","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%WINDIR%\\System32\\en-US\\netmsg.dll.mui","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%TEMP%\\13172347695339945651.exe","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%TEMP%\\is-UNDBO.tmp","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%TEMP%\\is-UNDBO.tmp\\_isetup","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%TEMP%\\is-UNDBO.tmp\\_isetup\\_shfoldr.dll","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"path":"%WINDIR%\\System32\\en-US\\imageres.dll.mui","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{BEC4C9B2-A5E5-4548-AC4C-9A076EC5B199}\\","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{BEC4C9B2-A5E5-4548-AC4C-9A076EC5B199}\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\LUTUL_IS1\\","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{33AAD629-D83F-4FBC-8D2F-FD1B2305E4FB}\\","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{33AAD629-D83F-4FBC-8D2F-FD1B2305E4FB}\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\INSTALL JDOWNLOADER_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\INSTALL JDOWNLOADER_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CACHE\\","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{BEC4C9B2-A5E5-4548-AC4C-9A076EC5B199}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\0A-00-27-00-00-00\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{33AAD629-D83F-4FBC-8D2F-FD1B2305E4FB}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"56df4f9daac2edf3159a275e"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"}]},{"name":"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"5b7c48eb7ca3e141ca3ec448"},{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"name":"!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"5a6a950b7ca3e1666f41ec67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!wmu1qv0!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!wmu1qv0!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!wmu1qv0!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!wmu1qv0!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"Local\\c:!users!wmu1qv0!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"Local\\c:!users!wmu1qv0!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"Local\\c:!users!wmu1qv0!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"Local\\c:!users!wmu1qv0!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"576e169faac2ed5d44dafc52"}]}]}},"report_ids":{"sandbox_job_ids":["5b7c48eb7ca3e141ca3ec448","5a6a950b7ca3e1666f41ec67","576e169faac2ed5d44dafc52","56614a030e316d344978d975","56df4f9daac2edf3159a275e"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Appwork.A potentially unwanted application Sample abad3a6610da… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample abad3a6610da…. Malware family: Appwork.A potentially unwanted application. Threat score 100/100. 8/24 AV engines flagged this file. 22 malicious and 30 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/abad3a6610dae56190a29bab54952ce4920c81db9176155b08f656788ddc0099"}],["$","meta","4",{"property":"og:title","content":"Malicious Appwork.A potentially unwanted application Sample abad3a6610da… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample abad3a6610da…. Malware family: Appwork.A potentially unwanted application. Threat score 100/100. 8/24 AV engines flagged this file. 22 malicious and 30 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/abad3a6610dae56190a29bab54952ce4920c81db9176155b08f656788ddc0099"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Appwork.A potentially unwanted application Sample abad3a6610da… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample abad3a6610da…. Malware family: Appwork.A potentially unwanted application. Threat score 100/100. 8/24 AV engines flagged this file. 22 malicious and 30 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]