21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 34:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T429,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample c3396b065cae… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c3396b065cae…. Threat score 100/100. 1/27 AV engines flagged this file. 6 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c3396b065cae3078ddd9f70899ae89ae21a02acdcd1667d32951f9060ea7d120","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","c3396b065cae3078ddd9f70899ae89ae21a02acdcd1667d32951f9060ea7d120"],"about":{"@type":"SoftwareApplication","name":"gpg4win-4.0.3.exe","applicationCategory":["peexe","executable"],"identifier":"c3396b065cae3078ddd9f70899ae89ae21a02acdcd1667d32951f9060ea7d120","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAABmZmZmZmZmZmZmZmYAAAAAZmZmZmZmZmZmZmZmAAAAAGZmZmZmZmZmZmZmZgAAAABmZmZmZmZmZmZmZmYAAAAAZmZmZmZmZmZmZmZmAAAAAGZmZmZmZmZmZmZmZgAAAABmZmZmZmZmZmZmZmYAAAAAZmZmZmZmZmZmZmZmAAAAAGZmZmZmZmZmZmZmZgAAAABmZmZmZmZmZmZmZmYAAAAAZmZmZmZmZmZmZmZmAAAAAGZmZmZmZmZmZmZmZgAAAABmZmZmZmZmZmZmZmYAAAAAZmZmZmZmZmZmZmZmAAAAAGZmZmZmZmZmZmZmZgAAAABmZmZmZmZmZmZmZmYAAAAAZmZmZmZmZmZmZmZmAAAAAGZmZmZmZmZmZmZmZgAAAABmZmZmZmZmZmZmZmYAAAAAAGZmZmAAAAZmZmYAAAAAAABmZmZgAAAGZmZmAAAAAAAAZmZmYAAABmZmZgAAAAAAAGZmZmAAAAZmZmYAAAAAAABmZmZgAAAGZmZmAAAAAAAAZmZmZgAAZmZmZgAAAAAAAGZmZmYAAGZmZmYAAAAAAABmZmZmYAZmZmZmAAAAAAAABmZmZmZmZmZmYAAAAAAAAAZmZmZmZmZmZmAAAAAAAAAAZmZmZmZmZmYAAAAAAAAAAAZmZmZmZmZgAAAAAAAAAAAAZmZmZmZmAAAAAAD4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/8AAA//g/wf/4P8H/+D/B//g/wf/4P8H/+D/B//gfgf/8D4P//AYD//4AB//+AAf//wAP//+AH/w==23:Tedd,"telepathy-kde.svg" has type "SVG Scalable Vector Graphics image"- Location: [%PROGRAMFILES%\Gpg4win\share\icons\breeze\apps\48\telepathy-kde.svg]- [targetUID: 00000000-00003204] "gpgsm.exe" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\GnuPG\bin\gpgsm.exe]- [targetUID: 00000000-00002064] "visibility.svg" has type "SVG Scalable Vector Graphics image"- Location: [%PROGRAMFILES%\Gpg4win\share\icons\breeze\actions\16\visibility.svg]- [targetUID: 00000000-00003204] "dialog-error.svg" has type "SVG Scalable Vector Graphics image"- Location: [%PROGRAMFILES%\Gpg4win\share\icons\breeze\status\64\dialog-error.svg]- [targetUID: 00000000-00003204] "view-certificate-server-configure.svg" has type "SVG Scalable Vector Graphics image"- Location: [%PROGRAMFILES%\Gpg4win\share\icons\breeze\actions\22\view-certificate-server-configure.svg]- [targetUID: 00000000-00003204] "dirmngr.exe" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\GnuPG\bin\dirmngr.exe]- [targetUID: 00000000-00002064] "start-here-kde.svg" has type "SVG Scalable Vector Graphics image"- Location: [%PROGRAMFILES%\Gpg4win\share\icons\breeze\places\16\start-here-kde.svg]- [targetUID: 00000000-00003204] "sha256sum.exe" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\Gpg4win\bin\sha256sum.exe]- [targetUID: 00000000-00003204] "dialog-ok-apply.svg" has type "SVG Scalable Vector Graphics image"- Location: [%PROGRAMFILES%\Gpg4win\share\icons\breeze\actions\32\dialog-ok-apply.svg]- [targetUID: 00000000-00003204] "gdk-pixbuf-query-loaders.exe" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\Gpg4win\bin\gdk-pixbuf-query-loaders.exe]- [targetUID: 00000000-00003204] "view-certificate-import.svg" has type "SVG Scalable Vector Graphics image"- Location: [%PROGRAMFILES%\Gpg4win\share\icons\breeze\actions\22\view-certificate-import.svg]- [targetUID: 00000000-00003204] "libassuan-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\GnuPG\bin\libassuan-0.dll]- [targetUID: 00000000-00003204] "emblem-unavailable.svg" has type "SVG Scalable Vector Graphics image"- Location: [%PROGRAMFILES%\Gpg4win\share\icons\breeze\emblems\8\emblem-unavailable.svg]- [targetUID: 00000000-00003204] "zlib1.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\GnuPG\bin\zlib1.dll]- [targetUID: 00000000-00003204] "edit-undo.svg" has type "SVG Scalable Vector Graphics image"- Location: [%PROGRAMFILES%\Gpg4win\share\icons\breeze\actions\32\edit-undo.svg]- [targetUID: 00000000-00003204] "edit-delete.svg" has type "SVG Scalable Vector Graphics image"- Location: [%PROGRAMFILES%\Gpg4win\share\icons\breeze\actions\32\edit-delete.svg]- [targetUID: 00000000-00003204] "libgthread-2.0-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\Gpg4win\bin\libgthread-2.0-0.dll]- [targetUID: 00000000-00003204] "dvipdf.svg" has type "SVG XML document"- Location: [%PROGRAMFILES%\Gpg4win\share\icons\breeze\actions\22\dvipdf.svg]- [targetUID: 00000000-00003204] "emblem-information.svg" has type "SVG Scalable Vector Graphics image"- Location: [%PROGRAMFILES%\Gpg4win\share\icons\breeze\emblems\8\emblem-information.svg]- [targetUID: 00000000-00003204] "keyboxd.exe" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%PROGRAMFILES%\GnuPG\bin\keyboxd.exe]- [targetUID: 00000000-00002064]24:Tb84,Found string "GetDiskFreeSpaceExA" (Source: c3396b065cae3078ddd9f70899ae89ae21a02acdcd1667d32951f9060ea7d120.bin, API is part of module: KERNEL32.DLL) Found string "GetUserDefaultUILanguage" (Source: c3396b065cae3078ddd9f70899ae89ae21a02acdcd1667d32951f9060ea7d120.bin, API is part of module: KERNEL32.DLL) Found string "RegDeleteKeyExA" (Source: c3396b065cae3078ddd9f70899ae89ae21a02acdcd1667d32951f9060ea7d120.bin, API is part of module: KERNEL32.DLL) Found string "RegCloseKey" (Source: c3396b065cae3078ddd9f70899ae89ae21a02acdcd1667d32951f9060ea7d120.bin, API is part of module: KERNEL32.DLL) Found string "RegCreateKeyExA" (Source: c3396b065cae3078ddd9f70899ae89ae21a02acdcd1667d32951f9060ea7d120.bin, API is part of module: KERNEL32.DLL) Found string "RegDeleteValueA" (Source: c3396b065cae3078ddd9f70899ae89ae21a02acdcd1667d32951f9060ea7d120.bin, API is part of module: KERNEL32.DLL) Found string "RegEnumValueA" (Source: c3396b065cae3078ddd9f70899ae89ae21a02acdcd1667d32951f9060ea7d120.bin, API is part of module: KERNEL32.DLL) Found string "RegOpenKeyExA" (Source: c3396b065cae3078ddd9f70899ae89ae21a02acdcd1667d32951f9060ea7d120.bin, API is part of module: KERNEL32.DLL) Found string "RegQueryValueExA" (Source: c3396b065cae3078ddd9f70899ae89ae21a02acdcd1667d32951f9060ea7d120.bin, API is part of module: KERNEL32.DLL) Found string "RegSetValueExA" (Source: c3396b065cae3078ddd9f70899ae89ae21a02acdcd1667d32951f9060ea7d120.bin, API is part of module: KERNEL32.DLL) Found string "CloseHandle" (Source: c3396b065cae3078ddd9f70899ae89ae21a02acdcd1667d32951f9060ea7d120.bin, API is part of module: KERNEL32.DLL) Found string "CompareFileTime" (Source: c3396b065cae3078ddd9f70899ae89ae21a02acdcd1667d32951f9060ea7d120.bin, API is part of module: KERNEL32.DLL) Found string "CopyFileA" (Source: c3396b065cae3078ddd9f70899ae89ae21a02acdcd1667d32951f9060ea7d120.bin, API is part of module: KERNEL32.DLL) Found string "CreateDirectoryA" (Source: c3396b065cae3078ddd9f70899ae89ae21a02acdcd1667d32951f9060ea7d120.bin, API is part of module: KERNEL32.DLL) Found string "CreateFileA" (Source: c3396b065cae3078ddd9f70899ae89ae21a02acdcd1667d32951f9060ea7d120.bin, API is part of module: KERNEL32.DLL) Found string "CreateProcessA" (Source: c3396b065cae3078ddd9f70899ae89ae21a02acdcd1667d32951f9060ea7d120.bin, API is part of module: KERNEL32.DLL) Found string "CreateThread" (Source: c3396b065cae3078ddd9f70899ae89ae21a02acdcd1667d32951f9060ea7d120.bin, API is part of module: KERNEL32.DLL) Found string "DeleteFileA" (Source: c3396b065cae3078ddd9f70899ae89ae21a02acdcd1667d32951f9060ea7d120.bin, API is part of module: KERNEL32.DLL) Found string "ExitProcess" (Source: c3396b065cae3078ddd9f70899ae89ae21a02acdcd1667d32951f9060ea7d120.bin, API is part of module: KERNEL32.DLL) Found string "ExpandEnvironmentStringsA" (Source: c3396b065cae3078ddd9f70899ae89ae21a02acdcd1667d32951f9060ea7d120.bin, API is part of module: KERNEL32.DLL)25:Ta97,Antivirus vendors marked dropped file "telepathy-kde.svg" as clean (type is "SVG Scalable Vector Graphics image") Antivirus vendors marked dropped file "gpgsm.exe" as clean (type is "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows"), Antivirus vendors marked dropped file "visibility.svg" as clean (type is "SVG Scalable Vector Graphics image"), Antivirus vendors marked dropped file "dialog-error.svg" as clean (type is "SVG Scalable Vector Graphics image"), Antivirus vendors marked dropped file "view-certificate-server-configure.svg" as clean (type is "SVG Scalable Vector Graphics image"), Antivirus vendors marked dropped file "dirmngr.exe" as clean (type is "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows"), Antivirus vendors marked dropped file "dialog-ok-apply.svg" as clean (type is "SVG Scalable Vector Graphics image"), Antivirus vendors marked dropped file "gdk-pixbuf-query-loaders.exe" as clean (type is "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows"), Antivirus vendors marked dropped file "view-certificate-import.svg" as clean (type is "SVG Scalable Vector Graphics image"), Antivirus vendors marked dropped file "libassuan-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"), Antivirus vendors marked dropped file "emblem-unavailable.svg" as clean (type is "SVG Scalable Vector Graphics image"), Antivirus vendors marked dropped file "zlib1.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"), Antivirus vendors marked dropped file "edit-undo.svg" as clean (type is "SVG Scalable Vector Graphics image"), Antivirus vendors marked dropped file "edit-delete.svg" as clean (type is "SVG Scalable Vector Graphics image"), Antivirus vendors marked dropped file "libgthread-2.0-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"), Antivirus vendors marked dropped file "dvipdf.svg" as clean (type is "SVG XML document"), Antivirus vendors marked dropped file "emblem-information.svg" as clean (type is "SVG Scalable Vector Graphics image"), Antivirus vendors marked dropped file "libpangoft2-1.0-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "gpg-wks-client.exe" as clean (type is "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows"), Antivirus vendors marked dropped file "libKF5ConfigCore.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows")26:T442,"Nullsoft Install System v3.04-1