24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Injector.CLML trojan Sample c2627917217f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c2627917217f…. Malware family: Injector.CLML trojan. Threat score 100/100. 24/28 AV engines flagged this file. 10 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778","keywords":["Malicious","Injector.CLML trojan","malware analysis","sandbox report","threat intelligence","c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778"],"about":{"@type":"SoftwareApplication","name":"LAPTOP-MEMORY.COM_copy_of_complaints.pdf.scr","applicationCategory":["peexe","executable"],"identifier":"c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Injector.CLML trojan","antivirusDetections":{"malicious":24,"total":28},"behavioralIndicators":{"malicious":10,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T567,Wrote 111 instructions to foreign process "c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778.exe" (UID: 00163843-00000348) Wrote 58 instructions to foreign process "c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778.exe" (UID: 00163843-00000348) Wrote 143 instructions to foreign process "c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778.exe" (UID: 00163843-00000348) Wrote 42 instructions to foreign process "c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778.exe" (UID: 00163843-00000348) Wrote 40 instructions to foreign process "c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778.exe" (UID: 00163843-00000348) Wrote 121 instructions to foreign process "c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778.exe" (UID: 00163843-00000348) Wrote 63 instructions to foreign process "c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778.exe" (UID: 00163843-00000348) Wrote 290 instructions to foreign process "c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778.exe" (UID: 00163843-00000348) Wrote 465 instructions to foreign process "c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778.exe" (UID: 00163843-00000348) Wrote 61 instructions to foreign process "c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778.exe" (UID: 00163843-00000348)26:T4fe,"" wrote 32 bytes to a foreign process "c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778.exe" (PID: 00000348) "" wrote 52 bytes to a foreign process "c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778.exe" (PID: 00000348) "" wrote 4 bytes to a foreign process "c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778.exe" (PID: 00000348) "" wrote 400 bytes to a foreign process "c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778.exe" (PID: 00000348) "" wrote 1024 bytes to a foreign process "c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778.exe" (PID: 00000348) "" wrote 89600 bytes to a foreign process "c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778.exe" (PID: 00000348) "" wrote 512 bytes to a foreign process "c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778.exe" (PID: 00000348) "" wrote 41984 bytes to a foreign process "c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778.exe" (PID: 00000348) "" wrote 1536 bytes to a foreign process "c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778.exe" (PID: 00000348)27:T4c6,"GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: ip-addr.es Cache-Control: no-cache" "GET /cgi-sys/suspendedpage.cgi?n=x36j7lkkomepwcm HTTP/1.1 Accept: */* User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: destinycruiseandtravel.com Cache-Control: no-cache Connection: Close" "GET /cgi-sys/suspendedpage.cgi?z=x36j7lkkomepwcm HTTP/1.1 Accept: */* User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: allreadytravel.com Cache-Control: no-cache Connection: Close" "GET /cgi-sys/suspendedpage.cgi?k=x36j7lkkomepwcm HTTP/1.1 Accept: */* User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: allgroupstravel.com Cache-Control: no-cache Connection: Close"28:T107c,"HTTP/1.1 200 OK Date: Thu, 29 Oct 2015 22:42:20 GMT Content-Type: text/plain;charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Last-Modified: Thu, 29 Oct 2015 22:42:20 GMT Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:00 GMT Pragma: no-cache X-XSS-Protection: 1 Server: DYNAMIC+" with no payload "POST /wp-content/plugins/si-contact-form/attachments/Xplv2F.php?v=x36j7lkkomepwcm HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 138 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: certifiedphytoceramides.com Cache-Control: no-cache" with no payload "POST /wp-admin/network/0hQB5C.php?n=x36j7lkkomepwcm HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 138 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: destinycruiseandtravel.com Cache-Control: no-cache" with no payload "POST /wp-includes/js/tinymce/plugins/wpeditimage/fDQA4J.php?k=x36j7lkkomepwcm HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 138 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: dallasreconditionedtransformers.com Cache-Control: no-cache" with no payload "POST /uploads/3/5/4/9/3549731/header_images/ToMaE1.php?z=x36j7lkkomepwcm HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 138 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: allreadytravel.com Cache-Control: no-cache" with no payload "POST /wp-includes/images/crystal/OKhW0f.php?x=x36j7lkkomepwcm HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 138 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: breakerhub.com Cache-Control: no-cache" with no payload "POST /wp-includes/js/jquery/ui/91zpeD.php?z=x36j7lkkomepwcm HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 138 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: chuckwhitlock.com Cache-Control: no-cache" with no payload "POST /cgi-bin/1kS5Q8.php?f=x36j7lkkomepwcm HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 138 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: dallascircuitbreaker.co Cache-Control: no-cache" with no payload "POST /files/theme/XjRJIC.php?k=x36j7lkkomepwcm HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 138 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: allgroupstravel.com Cache-Control: no-cache" with no payload "POST /wp-admin/css/rfe3ai.php?o=x36j7lkkomepwcm HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 138 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: agentclicktocall.com Cache-Control: no-cache" with no payload29:T14a4,Found malicious artifacts related to "198.57.242.171" (ASN: 46606, Owner: Unified Layer): ... URL: http://benediktas.com/wp-content/plugins/facebook-button-plugin/bws_menu/css/gUd0qe.php?q=g4j1iqssp2t2rw8 (AV positives: 5/65 scanned on 10/29/2015 20:31:30) URL: http://dangerousgarciniacambogia.com/ (AV positives: 1/65 scanned on 10/29/2015 09:48:59) URL: http://benediktas.com/ (AV positives: 1/65 scanned on 10/29/2015 09:40:35) URL: http://benediktas.com/wp-content/plugins/facebook-button-plugin/bws_menu/css/gUd0qe.php?j=5uvkuerv2tvx38v (AV positives: 5/65 scanned on 10/29/2015 09:28:12) URL: http://benediktas.com/wp-content/plugins/facebook-button-plugin/bws_menu/css/gUd0qe.php?q=34892qi24wn0 (AV positives: 5/65 scanned on 10/29/2015 09:28:09) File SHA256: 6c66f3a11f7877469bcc764c8d87173708ee866eb5dfb9459f4144c4874d6c1f (AV positives: 32/48 scanned on 11/29/2013 21:12:53) Found malicious artifacts related to "108.167.140.175" (ASN: 20013, Owner: CyrusOne LLC): ... URL: http://cruiseandtravel.agency/cgi-sys/suspendedpage.cgi?z=g4j1iqssp2t2rw8 (AV positives: 2/65 scanned on 10/29/2015 20:31:31) URL: http://allgroupstravel.com/files/theme/XjRJIC.php?x=g4j1iqssp2t2rw8 (AV positives: 4/65 scanned on 10/29/2015 20:31:28) URL: http://bigboattravel.com/uploads/3/5/4/5/3545341/header_images/NthjHz.php?s=g4j1iqssp2t2rw8 (AV positives: 2/65 scanned on 10/29/2015 20:31:29) URL: http://destinycruiseandtravel.com/wp-admin/network/0hQB5C.php?e=8wxogkavgvt4 (AV positives: 2/65 scanned on 10/29/2015 18:49:09) URL: http://108.167.140.175/ (AV positives: 1/65 scanned on 10/29/2015 18:16:50) File SHA256: 82fd41785819f56dedb892aa4c1d6139dac06784610e38a22cc8d3046d580e10 (AV positives: 10/55 scanned on 10/23/2015 00:08:17) File SHA256: 49f67848fbd043ffaad7e84374412641a727dae57aa6307c759425da7090c2f7 (AV positives: 22/56 scanned on 10/22/2015 19:33:57) Found malicious artifacts related to "192.185.16.67" (ASN: 20013, Owner: CyrusOne LLC): ... URL: http://breakerhub.com/wp-includes/images/crystal/OKhW0f.php?k=g4j1iqssp2t2rw8 (AV positives: 4/65 scanned on 10/29/2015 20:31:30) URL: http://dallascircuitbreaker.com/ (AV positives: 2/65 scanned on 10/29/2015 17:42:17) URL: http://breakerhub.com/ (AV positives: 1/65 scanned on 10/29/2015 11:28:03) URL: http://dallascircuitbreaker.co/ (AV positives: 2/65 scanned on 10/29/2015 11:13:04) URL: http://progressivehealthgroup.com/wp-admin/includes/aw.rbcnetbank.com/Banking.html (AV positives: 5/65 scanned on 10/29/2015 10:45:17) File SHA256: ae1987b17b81d3f285b9ddc4e3e1cbd148b80337b9dcae807679d83bd2c09628 (AV positives: 1/55 scanned on 10/29/2015 09:27:55) File SHA256: 93cd3b01d2818cc57a54107744a284c55656da30f6eedce5a4fb9e1a938909a9 (AV positives: 24/46 scanned on 10/20/2015 18:34:29) File SHA256: 1dbc3ac314ff27760adbb56068690e6bab4a48c08ded9489eb5f743e9e471e38 (AV positives: 2/54 scanned on 09/23/2014 00:41:56) File SHA256: 45257ee08c61f81b7625ba919964ab8ff5a193a9d5fd8845cd5f4163bee8d7cf (AV positives: 1/50 scanned on 06/25/2014 19:58:15) Found malicious artifacts related to "192.185.152.133" (ASN: 20013, Owner: CyrusOne LLC): ... URL: http://chuckwhitlock.com/ (AV positives: 1/65 scanned on 10/29/2015 09:45:03) URL: http://chuckwhitlock.com/wp-includes/js/jquery/ui/91zpeD.php?r=g3kugqzphqsnz (AV positives: 3/65 scanned on 10/29/2015 08:20:39) URL: http://chuckwhitlock.com/wp-includes/js/jquery/ui/91zpeD.php?b=15qkee2va7 (AV positives: 2/65 scanned on 10/28/2015 09:26:27) URL: http://intracoastalmedicine.com/administrator/backups/Absa1/Profile3.html (AV positives: 3/65 scanned on 10/08/2015 07:52:47) URL: http://palmbayholidays.com/xxx.htm (AV positives: 1/63 scanned on 09/15/2015 06:05:23) File SHA256: ae1987b17b81d3f285b9ddc4e3e1cbd148b80337b9dcae807679d83bd2c09628 (AV positives: 1/55 scanned on 10/29/2015 08:20:44) File SHA256: 6647f159a99e3fd5a88a261baab09df13d6c9d979f200a9b9c9c23e397dc60ea (AV positives: 23/55 scanned on 09/16/2014 18:31:29) Found malicious artifacts related to "192.185.5.33" (ASN: 20013, Owner: CyrusOne LLC): ... URL: http://agentclicktocall.com/wp-admin/css/rfe3ai.php?v=g4j1iqssp2t2rw8 (AV positives: 6/65 scanned on 10/29/2015 20:31:28) URL: http://colebar.com/wp-admin/css/wEHf2D.php?f=g4j1iqssp2t2rw8 (AV positives: 5/65 scanned on 10/29/2015 20:31:30) URL: http://www.boymeetsfashion.com/asb.co.nz/index.html (AV positives: 5/65 scanned on 10/29/2015 11:08:49) URL: http://boymeetsfashion.com/asb.co.nz/index.html (AV positives: 6/65 scanned on 10/29/2015 11:08:45) URL: http://agentclicktocall.com/wp-admin/css/rfe3ai.php (AV positives: 5/65 scanned on 10/29/2015 11:07:59) File SHA256: ae1987b17b81d3f285b9ddc4e3e1cbd148b80337b9dcae807679d83bd2c09628 (AV positives: 1/56 scanned on 10/29/2015 20:32:05) File SHA256: b60cc75de503681a132c1ac2d238a614c49dfa383693512679038777d55fbf38 (AV positives: 24/57 scanned on 09/27/2015 23:02:51) File SHA256: 45064245cf872efad3bfa4ecd0299698e2ca272a61cddb1ffab68251e1abd031 (AV positives: 24/57 scanned on 09/26/2015 21:58:43) File SHA256: 41162cf5329376bd3e75512fdc429eeded7694b47562874c4a1ae4708d60e74c (AV positives: 24/57 scanned on 09/26/2015 21:58:38) File SHA256: f15b97845c90fbd28e66b5489a451134e506609283339464d060a5660c91f34e (AV positives: 1/44 scanned on 02/12/2014 23:04:13)2a:T734,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAT7SURBVFhHzZZNayRFGMeXkGMugWw+iPsJPAnqKaDixU+gt1w9KCh48OIqqAdB8SKYgxchi8pmo6Ab2WhenGQ3mZkk89bv3fPePTP5+/yrqju9k9mdXmHBkD/VXVNVz+956aq6ceP//lcul0G1LAtBGCGM2ojaVCenNtrmnb9TvozNyw1CWLaNQv4+fPgI1WoVpaMjOI6DRqOJbq+PQTxCnIyRjETjMUZKE/MsLfuNOHaYjNAbJugOYvSlDcKwGEClUkGpVILruvA8D7ZADONEGUzEII1S48kEk8mlaa+eFZSAxKKBzGPLuWEUFQM4PDyEJSGPZAIBGFLt9ePGCXB5eYnJlNifRobGOZd9kawzNwUM++npKYIgQLfbVQCeHxgvprw3hgmRSsGoqOjI5MXamQtwfHyMWq0mqqNWr8ORNPT7AxXC/GKp13njWTQMwBWIhikEcHZ2Bl88pvdxHE8ZTvN95fFMgHxKBCYFaReJgO/7GEnOOGlWfp/k+XQarqVFoAoBsFCmvZr1HjcasDbvYCKFOXs8VHHKvy5ScagQAAelnuuFoQUj9X6J3v4B+ltbWaSeFq2JKcZCNZACZMbFcPqnIAzAWD5R64MPjZdpTeQh0wjQe+4Rk2eLgALIvOZTPgraoP/2O09MF0OuQ6+N/zeA3Pd9rdrl02y++BKShlWoZjj/mWpgVmFlUZCABN98i+7xAZrvvo/JaKRSk6XKPGdrmNQVAmChTG+t05/euN9H6+NPZYPqo7f9M5pvvoVIgLyN72H98CNiOQnJoEJvosi2UBHyM8zylttq04XolfP5Fwh+2kTw6z14f5cw7vXQubMJ7/YnsL77Gu7vf6o1xurs0AcRzwOeLXO3Yg7Kb7vZqSeGE4ELftuGu7FxbZ+nMa0xhoOBBlCH0hVAodOQg3jWp1IwPF4DH43PbqP53keyU44ygNQQDacAifyeincCKpa+UFIzNwKBAPAI5QRqqNox7N2/0PzqSwy5VY9HCoJGlIdsHzOaqHvAYBire0ScJHIhiYtdSHy5tajJRpzIZy40lIW42CwpQ2ZObzAE1e2L1HOMjny2nhzxcyPAQR2ZyAl5cTG1sABRBJtW3nCnN0BbrnFaA0RdAZBTdi6A6/kIOz0EmbrqPepSerE/7t/Hzs4OHjzYxd7eHg7kBrUl58KF3CEITaMcq9VT8ymuPRfAduUOGLRFERxpKTfswIs68NsaZnd3F6flCv4pHaF6do79/X08OjmRW7DclmnUGEwNBzKPcooAtGwXdScQSdVL23QDWF6ogFwxQBBbFiIM25btICCc/JYaDNsSwUxd+BHVkduVNz8CDcvBueXhvOXiTMS2ZntopCC+joyOillcYGgk9ZRwFN/Zz3EKvAhAvWWj2nRQrtsoN2xUGo56vxComi1REZCWJ0exgDBVTtBRMArIQGmDItWXtgUBak1LGT6pWUqndf1ebenIXAhE3QkFJERTQFoCYvmsGV0vGZCAqXeBcCQ97Lccd34KTspVVMTjU4mAgmAkROyrMiUGomYHqBkQwjAqOjICY4B0MafqoCIF+9Sv4LXX38Avd7dU2AmgIExblr5K0xUIqQ8DcSFFWjNShSsgWWQMUEtgCGUJyN1723j5lVfxwq1b10Fu3ryJxcVFrK2tYX19/bmIa0sEsLq6OjsSKysrCoKDnocWFhawtLSE5eXlDOBf45qzMv90aKwAAAAASUVORK5CYII=1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790332892168,"unified_at":"2026-09-25T10:41:32.168Z","metadata":{"hashes":{"sha256":"c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778","sha1":"ba2433ca85077b7709bf123180e4e8fdb42b41fd","md5":"fc5e5a5c1ca5a77622663e621ccc14c2","sha512":"dc549188c308cfaa3a1f591a6e1831dfa371ac51130c0922641fa406053bdec4bdf8a5e549d08186e583b2504e84ce55472b38043cc61d6aa3956f59ba4b39ce","ssdeep":"6144:RKvQk5hf5qYg9aW3TZCNC0pyKvmBqdV9wgOTw7:RKvQk5R5J+n0NQKvm0dVagN7","ssdeep_chunks":["6144:RKvQk5h","6144:KvQk5hf","6144:vQk5hf5","6144:Qk5hf5q","6144:k5hf5qY","6144:5hf5qYg","6144:hf5qYg9","6144:f5qYg9a","6144:5qYg9aW","6144:qYg9aW3","6144:Yg9aW3T","6144:g9aW3TZ","6144:9aW3TZC","6144:aW3TZCN","6144:W3TZCNC","6144:3TZCNC0","6144:TZCNC0p","6144:ZCNC0py","6144:CNC0pyK","6144:NC0pyKv","6144:C0pyKvm","6144:0pyKvmB","6144:pyKvmBq","6144:yKvmBqd","6144:KvmBqdV","6144:vmBqdV9","6144:mBqdV9w","6144:BqdV9wg","6144:qdV9wgO","6144:dV9wgOT","6144:V9wgOTw","6144:9wgOTw7","12288:RKvQk5h","12288:KvQk5hf","12288:vQk5hf5","12288:Qk5hf5q","12288:k5hf5qY","12288:5hf5qYg","12288:hf5qYg9","12288:f5qYg9a","12288:5qYg9aW","12288:qYg9aW3","12288:Yg9aW3T","12288:g9aW3TZ","12288:9aW3TZC","12288:aW3TZCN","12288:W3TZCNC","12288:3TZCNC0","12288:TZCNC0p","12288:ZCNC0py","12288:CNC0pyK","12288:NC0pyKv","12288:C0pyKvm","12288:0pyKvmB","12288:pyKvmBq","12288:yKvmBqd","12288:KvmBqdV","12288:vmBqdV9","12288:mBqdV9w","12288:BqdV9wg","12288:qdV9wgO","12288:dV9wgOT","12288:V9wgOTw","12288:9wgOTw7","6144:RKvQk5R","6144:KvQk5R5","6144:vQk5R5J","6144:Qk5R5J+","6144:k5R5J+n","6144:5R5J+n0","6144:R5J+n0N","6144:5J+n0NQ","6144:J+n0NQK","6144:+n0NQKv","6144:n0NQKvm","6144:0NQKvm0","6144:NQKvm0d","6144:QKvm0dV","6144:Kvm0dVa","6144:vm0dVag","6144:m0dVagN","6144:0dVagN7"],"imphash":"4f6d3ce4807b6ce7dd9295ab736f0ec8"},"file_info":{"file_name":"LAPTOP-MEMORY.COM_copy_of_complaints.pdf.scr","file_type":["peexe","executable"],"file_type_id":"exe","file_size":232450,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499297207000,"last_seen":1677389756000,"last_multi_scan":1677389756000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":24,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":6,"suspicious_count":11,"malicious_count":10,"total":27},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.mC6T","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Cryptolocker","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/Win32.Androm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Injector.clfo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Crypt.19","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.AppWizard-8338497-1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Spy.Zbot.CMP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Farfli.U.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Crypt.19 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Injector.CLML trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!AAC614E553B1768F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0055e3991 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Inject.vkro","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"PWS-FCEJ!FC5E5A5C1CA5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.TrjGen.dykczi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Agent-APFO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_HP.F1512D12","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_HP.F1512D12","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Inject3.MTD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Inject","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Adware.Agent.Win32.83389","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Injector.CLML trojan","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"destinycruiseandtravel.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"62.146.87.170:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\_!MSFTHISTORY!_\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00163843-00000348)\n Spawned process \"explorer.exe\" (UID: 00168343-00002516)\n Spawned process \"svchost.exe\" with commandline \"-k netsvcs\" (UID: 00172218-00001152)\n Spawned process \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00174234-00002408)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"6c7f9cdd.exe\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows\"\n \"CabB721.tmp\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"TarB722.tmp\" has type \"data\"\n \"CabB7A0.tmp\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"TarB7A1.tmp\" has type \"data\"\n \"94308059B57B3142E455B38A6EB92015\" has type \"data\"\n \"CabCCDF.tmp\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"TarCCE0.tmp\" has type \"data\"\n \"SCHEDLGU.TXT\" has type \"Little-endian UTF-16 Unicode text, with CRLF, CR line terminators\"\n \"setupact.log\" has type \"ASCII text, with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"\" queried SystemProcessInformation at 00159156-00002080-7746FDA0-163734","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"6c7f9cdd.exe\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"explorer.exe\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\", Key: \"6C7F9CD\", Value: \"C:\\6c7f9cdd\\6c7f9cdd.exe\")\n \"explorer.exe\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\", Key: \"*C7F9CD\", Value: \"C:\\6c7f9cdd\\6c7f9cdd.exe\")\n \"explorer.exe\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\", Key: \"6C7F9CDD\", Value: \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\6c7f9cdd.exe\")\n \"explorer.exe\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\", Key: \"*C7F9CDD\", Value: \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\6c7f9cdd.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"10.126.7.151\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 62.146.87.170 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":10,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"svchost.exe\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"svchost.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"svchost.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")\n \"svchost.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"svchost.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"recvfrom (Ordinal #17)\n closesocket (Ordinal #3)\n bind (Ordinal #2)\n send (Ordinal #19)\n socket (Ordinal #23)\n connect (Ordinal #4)\n recv (Ordinal #16)\n WSAStartup (Ordinal #115)\n accept (Ordinal #1)\n listen (Ordinal #13)\n sendto (Ordinal #20)\n GetStartupInfoA\n GetModuleHandleA\n GetModuleFileNameW\n CreateFileW\n CreateThread","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000407\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"$25","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/55 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00168343-00002516)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$26","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by Ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00174234-00002408)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"svchost.exe\" had access to \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00159156-00002080)\n Spawned process \"\" (UID: 00163843-00000348)\n Spawned process \"explorer.exe\" (UID: 00168343-00002516)\n Spawned process \"svchost.exe\" with commandline \"-k netsvcs\" (UID: 00172218-00001152)\n Spawned process \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00174234-00002408)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$27","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"$28","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to suppress failures during boot (often used to hide system changes)","description":"Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00146812-00003080)","origin":"Monitored Target","relevance":8,"id":"target-6","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$29","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ip-addr.es\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"Deletes volume snapshots (often used by Ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Injects into explorer"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"name":"Spyware/Leak","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":60,"dropped_files_count":0,"extracted_files_count":11,"files_written_count":69,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":7,"dns_resolutions_count":11,"contacted_urls_count":14,"http_requests_count":14},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5c9a3c540288381a301ac18f","environment_id":100,"environment_description":"Windows 7 32 bit","state":"ERROR","error_type":"The requested environment ID \"100\" and file type \"exe\" have no available execution environment","verdict":"undetected","submit_name":"IMBADESIGN.COM_copy_of_complaints.pdf.scr","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"5632a0450e316d072a329d44","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"HW32.Packed","contacted_countries":["DEU","USA"],"submit_name":"LAPTOP-MEMORY.COM_copy_of_complaints.pdf.scr","analysis_start_time":"2015-10-29T17:40:25+00:00","indicators_count":{"informative":5,"suspicious":14,"malicious":8},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"5632a0450e316d072a329d42","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":95,"malware_family":"HW32.Packed","contacted_countries":["DEU","FRA","USA"],"submit_name":"LAPTOP-MEMORY.COM_copy_of_complaints.pdf.scr","analysis_start_time":"2015-10-29T17:40:40+00:00","indicators_count":{"informative":6,"suspicious":15,"malicious":13},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"62.146.87.170","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"address":"188.165.164.184","port":80,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"address":"198.57.242.171","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"address":"108.167.140.175","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"address":"192.185.16.67","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"address":"192.185.152.133","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"address":"192.185.5.33","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]}],"dns_resolutions":[{"domain":"destinycruiseandtravel.com","address":"108.167.140.175","country":"United States","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"domain":"allreadytravel.com","address":"108.167.140.175","country":"United States","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"domain":"dallasreconditionedtransformers.com","address":"192.185.16.67","country":"United States","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"domain":"package.avira.com","address":"62.146.87.170","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"domain":"ip-addr.es","address":"188.165.164.184","country":"France","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"domain":"chuckwhitlock.com","address":"192.185.152.133","country":"United States","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"domain":"certifiedphytoceramides.com","address":"198.57.242.171","country":"United States","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"domain":"dallascircuitbreaker.co","address":"192.185.16.67","country":"United States","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"domain":"allgroupstravel.com","address":"108.167.140.175","country":"United States","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"domain":"agentclicktocall.com","address":"192.185.5.33","country":"United States","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"domain":"breakerhub.com","address":"192.185.16.67","country":"United States","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]}],"http_requests":[{"host":"ip-addr.es","host_ip":"188.165.164.184:80","url":"/","method":"GET","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"host":"","host_ip":"192.168.56.11:49160","url":"","method":"","response_code":"200","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"host":"certifiedphytoceramides.com","host_ip":"198.57.242.171:80","url":"/wp-content/plugins/si-contact-form/attachments/Xplv2F.php?v=x36j7lkkomepwcm","method":"POST","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"host":"destinycruiseandtravel.com","host_ip":"108.167.140.175:80","url":"/wp-admin/network/0hQB5C.php?n=x36j7lkkomepwcm","method":"POST","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"host":"destinycruiseandtravel.com","host_ip":"108.167.140.175:80","url":"/cgi-sys/suspendedpage.cgi?n=x36j7lkkomepwcm","method":"GET","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"host":"dallasreconditionedtransformers.com","host_ip":"192.185.16.67:80","url":"/wp-includes/js/tinymce/plugins/wpeditimage/fDQA4J.php?k=x36j7lkkomepwcm","method":"POST","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"host":"allreadytravel.com","host_ip":"108.167.140.175:80","url":"/uploads/3/5/4/9/3549731/header_images/ToMaE1.php?z=x36j7lkkomepwcm","method":"POST","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"host":"allreadytravel.com","host_ip":"108.167.140.175:80","url":"/cgi-sys/suspendedpage.cgi?z=x36j7lkkomepwcm","method":"GET","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"host":"breakerhub.com","host_ip":"192.185.16.67:80","url":"/wp-includes/images/crystal/OKhW0f.php?x=x36j7lkkomepwcm","method":"POST","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"host":"chuckwhitlock.com","host_ip":"192.185.152.133:80","url":"/wp-includes/js/jquery/ui/91zpeD.php?z=x36j7lkkomepwcm","method":"POST","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"host":"dallascircuitbreaker.co","host_ip":"192.185.16.67:80","url":"/cgi-bin/1kS5Q8.php?f=x36j7lkkomepwcm","method":"POST","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"host":"allgroupstravel.com","host_ip":"108.167.140.175:80","url":"/files/theme/XjRJIC.php?k=x36j7lkkomepwcm","method":"POST","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"host":"allgroupstravel.com","host_ip":"108.167.140.175:80","url":"/cgi-sys/suspendedpage.cgi?k=x36j7lkkomepwcm","method":"GET","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"host":"agentclicktocall.com","host_ip":"192.185.5.33:80","url":"/wp-admin/css/rfe3ai.php?o=x36j7lkkomepwcm","method":"POST","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}],"processes":[{"pid":2592,"ppid":0,"name":"c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778.exe","command_line":"","normalized_path":"","uid":"00135312-00002592","icon":"$2a"},{"pid":2280,"ppid":0,"name":"c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778.exe","command_line":"","normalized_path":"","uid":"00138125-00002280"},{"pid":2808,"ppid":0,"name":"explorer.exe","command_line":"","normalized_path":"","uid":"00140109-00002808"},{"pid":2856,"ppid":0,"name":"vssadmin.exe","command_line":"Delete Shadows /All /Quiet","normalized_path":"","uid":"00144031-00002856"},{"pid":1980,"ppid":0,"name":"bcdedit.exe","command_line":"bcdedit /set {default} recoveryenabled No","normalized_path":"","uid":"00145187-00001980"},{"pid":3080,"ppid":0,"name":"bcdedit.exe","command_line":"bcdedit /set {default} bootstatuspolicy ignoreallfailures","normalized_path":"","uid":"00146812-00003080"}],"all_imported_dlls":["netutils.dll","COMCTL32.DLL","KERNELBASE.dll","MSCTF.dll","ole32.dll","slc.dll","SspiCli.dll","WS2_32.dll","ADVAPI32.dll","VssTrace.DLL","VERSION.dll","SETUPAPI.dll","OLEAUT32.dll","ODBC32.dll","PSAPI.DLL","SHLWAPI.dll","DEVOBJ.dll","PROPSYS.dll","sechost.dll","wininet.dll","RpcRtRemote.dll","LPK.dll","wkscli.dll","gdiplus.dll","VSSAPI.DLL","RPCRT4.dll","MFC42.DLL","rsaenh.dll","DUI70.dll","CRYPTBASE.dll","uxtheme.dll","NSI.dll","srvcli.dll","NETAPI32.dll","CRYPTSP.dll","shell32.dll","GDI32.dll","kernel32.dll","UxTheme.dll","POWRPROF.dll","IMM32.DLL","msvcrt.dll","ntdll.dll","odbcint.dll","DUser.dll","Secur32.dll","CLBCatQ.DLL","USP10.dll","USER32.dll","dwmapi.dll","ws2_32.dll","IMM32.dll","EXPLORERFRAME.dll","SHELL32.dll","ATL.DLL","CFGMGR32.dll","MPR.dll","apphelp.dll","SSPICLI.DLL","vss_ps.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"6c7f9cdd.exe","sha256":"c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"name":"94308059B57B3142E455B38A6EB92015","sha256":"8659d6ae684c4acbd716723aa6acdb28e610de7ff21c9164e22ad449528db9ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"name":"CabB721.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"name":"CabB7A0.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"name":"CabCCDF.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"name":"TarB722.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"name":"TarB7A1.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"name":"TarCCE0.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"name":"SCHEDLGU.TXT","sha256":"6d708285a02d3480e266d7cf8e201a946f22298cc3c88d8160913ebf2aaf3b76","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"name":"setupact.log","sha256":"66eb51c62e5147e614f00e63293e9cc9e8f3ce0c6fd60eef61a7caab3cdaf992","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"name":"52b5d952.exe","sha256":"c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%LOCALAPPDATA%\\CSIDL_","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%WINDIR%\\explorer.exe\\","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"C:\\myapp.exe","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%LOCALAPPDATA%\\CSIDL_X","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%WINDIR%\\syswow64\\explorer.exe","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"path":"C:\\6c7f9cdd","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"path":"C:\\6c7f9cdd\\6c7f9cdd.exe","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"path":"%APPDATA%\\6c7f9cdd.exe","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\6c7f9cdd.exe","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"path":"%WINDIR%\\syswow64\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"path":"%WINDIR%\\syswow64\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"\\Device\\NetBT_Tcpip6_{85C6619C-A5E8-4995-B351-1F8B696A9C13}","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"path":"\\Device\\NetBT_Tcpip6_{99EEFFB2-AB17-4BFC-9BBC-D2001E0C4FC5}","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"path":"\\Device\\NetBT_Tcpip6_{C23E0E89-6218-47AD-AAA6-4A30095E2323}","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"path":"\\Device\\NetBT_Tcpip_{99EEFFB2-AB17-4BFC-9BBC-D2001E0C4FC5}","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"path":"%TEMP%\\CabB721.tmp","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"path":"%TEMP%\\TarB722.tmp","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"path":"%TEMP%\\CabB7A0.tmp","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"path":"%TEMP%\\TarB7A1.tmp","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{85C6619C-A5E8-4995-B351-1F8B696A9C13}","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{99EEFFB2-AB17-4BFC-9BBC-D2001E0C4FC5}","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C23E0E89-6218-47AD-AAA6-4A30095E2323}","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"},{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%TEMP%\\CabCCDF.tmp","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"path":"%TEMP%\\TarCCE0.tmp","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"path":"%WINDIR%\\explorer.exe","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"C:\\52b5d952","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"C:\\52b5d952\\52b5d952.exe","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%APPDATA%\\52b5d952.exe","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\52b5d952.exe","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%WINDIR%\\system32\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%WINDIR%\\system32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%WINDIR%\\system32\\bcdedit.exe","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%TEMP%\\Cab5951.tmp","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%TEMP%\\Tar5962.tmp","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%TEMP%\\Cab5992.tmp","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%TEMP%\\Tar59A2.tmp","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%WINDIR%\\system32\\en-US\\WINHTTP.dll.mui","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%TEMP%\\Cab6E93.tmp","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]},{"path":"%TEMP%\\Tar6E94.tmp","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":[{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\WINDOWS DEFENDER\\WINDOWS DEFENDER","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d44"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\WINDOWS DEFENDER\\WINDOWS DEFENDER","sources":[{"report_type":"sandbox","report_id":"5632a0450e316d072a329d42"}]}]},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5632a0450e316d072a329d44","5632a0450e316d072a329d42"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Injector.CLML trojan Sample c2627917217f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c2627917217f…. Malware family: Injector.CLML trojan. Threat score 100/100. 24/28 AV engines flagged this file. 10 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778"}],["$","meta","4",{"property":"og:title","content":"Malicious Injector.CLML trojan Sample c2627917217f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c2627917217f…. Malware family: Injector.CLML trojan. Threat score 100/100. 24/28 AV engines flagged this file. 10 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c2627917217f04ba7e04b0727fd3db0d660c743c5dc76472572beb0c6c4cc778"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Injector.CLML trojan Sample c2627917217f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c2627917217f…. Malware family: Injector.CLML trojan. Threat score 100/100. 24/28 AV engines flagged this file. 10 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]