24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 39:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4bb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dropper.Application.Agent Sample c8757a2fe219… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c8757a2fe219…. Malware family: Dropper.Application.Agent. Threat score 100/100. 12/26 AV engines flagged this file. 15 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c8757a2fe21956623b339c1863e6481405326e9f8771f3aea6c250f7180842e5","keywords":["Malicious","Dropper.Application.Agent","malware analysis","sandbox report","threat intelligence","c8757a2fe21956623b339c1863e6481405326e9f8771f3aea6c250f7180842e5"],"about":{"@type":"SoftwareApplication","name":"KMSPico 10.2.2.exe","applicationCategory":["peexe","executable"],"identifier":"c8757a2fe21956623b339c1863e6481405326e9f8771f3aea6c250f7180842e5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dropper.Application.Agent","antivirusDetections":{"malicious":12,"total":26},"behavioralIndicators":{"malicious":15,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tf0b,Found API call GetVersion@KERNEL32.DLL (Target: "KMSpico_patch.tmp"; Stream UID: "00044153-00002616-8781-888-0041F128") which is directly followed by "cmp bl, 04h" and "jnc 0041F171h". See related instructions: "... +14 call 004059ACh ;GetVersion +19 mov ebx, eax +21 cmp bl, 04h +24 jnc 0041F171h" ... at 00044153-00002616-8781-888-0041F128 Found API call GetVersion@KERNEL32.DLL (Target: "KMSpico_patch.tmp"; Stream UID: "00044153-00002616-8781-882-00419050") which is directly followed by "cmp ax, 0004h" and "setnb byte ptr [0049B5C4h]". See related instructions: "... +0 call 004059ACh ;GetVersion +5 and ax, 000000FFh +9 cmp ax, 0004h +13 setnb byte ptr [0049B5C4h]" ... at 00044153-00002616-8781-882-00419050 Found API call GetVersion@KERNEL32.DLL (Target: "KMSpico_patch.tmp"; Stream UID: "00044153-00002616-8781-747-0042E0AC") which is directly followed by "cmp ax, 0005h" and "jc 0042E129h". See related instructions: "... +71 xor eax, eax +73 push ebp +74 push 0042E290h +79 push dword ptr fs:[eax] +82 mov dword ptr fs:[eax], esp +85 xor ebx, ebx +87 call 004059ACh ;GetVersion +92 and ax, 000000FFh +96 cmp ax, 0005h +100 jc 0042E129h" ... at 00044153-00002616-8781-747-0042E0AC Found API call GetVersion@KERNEL32.DLL (Target: "KMSpico_patch.tmp"; Stream UID: "00044153-00002616-8781-1003-0046E38C") which is directly followed by "cmp ax, 00000601h" and "jc 0046E3D0h". See related instructions: "... +10 call 004059ACh ;GetVersion +15 xchg al, ah +17 cmp ax, 00000601h +21 jc 0046E3D0h" ... at 00044153-00002616-8781-1003-0046E38C Found API call GetVersion@KERNEL32.DLL (Target: "KMSpico_patch.tmp"; Stream UID: "00044153-00002616-8781-3071-00463044") which is directly followed by "cmp ax, 0006h" and "jnc 004630B9h". See related instructions: "... +86 call 00418328h +91 call 004059ACh ;GetVersion +96 and ax, 000000FFh +100 cmp ax, 0006h +104 jnc 004630B9h" ... at 00044153-00002616-8781-3071-00463044 Found API call GetDiskFreeSpaceA@KERNEL32.DLL (Target: "KMSpico_patch.tmp"; Stream UID: "00044153-00002616-8781-2975-00455DF8") which is directly followed by "cmp byte ptr [ebp-02h], 00h" and "je 00455EFFh". See related instructions: "... +204 call 00403738h +209 push eax +210 call 004058ECh ;GetDiskFreeSpaceA +215 neg eax +217 sbb eax, eax +219 neg eax +221 mov byte ptr [ebp-02h], al +224 cmp byte ptr [ebp-02h], 00h +228 je 00455EFFh" ... at 00044153-00002616-8781-2975-00455DF8 Found API call GetVersion@KERNEL32.DLL (Target: "KMSpico_patch.tmp"; Stream UID: "00044153-00002616-8781-2726-0042D984") which is directly followed by "cmp ax, 0006h" and "jc 0042D9DFh". See related instructions: "... +32 call 004059ACh ;GetVersion +37 and ax, 000000FFh +41 cmp ax, 0006h +45 jc 0042D9DFh" ... at 00044153-00002616-8781-2726-0042D984 Found API call GetVersion@KERNEL32.DLL (Target: "KMSpico_patch.tmp"; Stream UID: "00044153-00002616-8781-3074-0046319C") which is directly followed by "cmp ax, 0006h" and "jc 0046320Fh". See related instructions: "... +48 call 004059ACh ;GetVersion +53 and ax, 000000FFh +57 cmp ax, 0006h +61 jc 0046320Fh" ... at 00044153-00002616-8781-3074-0046319C Found API call GetVersion@KERNEL32.DLL (Target: "KMSpico_patch.tmp"; Stream UID: "00044153-00002616-8781-1119-0045CF24") which is directly followed by "cmp ax, 0005h" and "jnc 0045CF59h". See related instructions: "... +26 call 004059ACh ;GetVersion +31 and ax, 000000FFh +35 cmp ax, 0005h +39 jnc 0045CF59h" ... at 00044153-00002616-8781-1119-0045CF24 Found API call GetVersion@KERNEL32.DLL (Target: "KMSpico_patch.tmp"; Stream UID: "00044153-00002616-8781-2486-00411704") which is directly followed by "cmp ax, 0004h" and "jc 00411864h". See related instructions: "... +147 call 00403634h +152 call 004059ACh ;GetVersion +157 and ax, 000000FFh +161 cmp ax, 0004h +165 jc 00411864h" ... at 00044153-00002616-8781-2486-0041170426:T26d7,"GET http://fun.losscook.bid/h_redir.php?offer_id=4&aff_id=1462&source=803&aff_sub=577a44716bfd1&aff_sub2=215&aff_sub3=&aff_sub4=&aff_sub5=1321589991&url=http%3A%2F%2Ffun.losscook.bid/offer.php%3FaffId%3D{aff_id}%26trackingId%3D257741975%26instId%3D803%26ho_trackingid%3D{transaction_id}%26cc%3D{country_code}%26cc_typ%3Dho%26sb%3Dx86%26net%3D4.5.51209%26ie%3D8%2e0%2e7601%2e17514%26wv%3D7sp1%26db%3DInternetExplorer%26uac%3D1%26cid%3Dd41d8cd98f00b204e9800998ecf8427e%26v%3D3 HTTP/1.1 Host: fun.losscook.bid Connection: close Accept: */* User-Agent: InstallCapital" "GET http://build.zebraexpansion.bid/aff_c?offer_id=4&aff_id=1462&source=803&aff_sub=577a44716bfd1&aff_sub2=215&aff_sub3=&aff_sub4=&aff_sub5=1321589991&url=http%3A%2F%2Ffun.losscook.bid/offer.php%3FaffId%3D{aff_id}%26trackingId%3D257741975%26instId%3D803%26ho_trackingid%3D{transaction_id}%26cc%3D{country_code}%26cc_typ%3Dho%26sb%3Dx86%26net%3D4.5.51209%26ie%3D8%2e0%2e7601%2e17514%26wv%3D7sp1%26db%3DInternetExplorer%26uac%3D1%26cid%3Dd41d8cd98f00b204e9800998ecf8427e%26v%3D3 HTTP/1.1 Host: build.zebraexpansion.bid Connection: close Accept: */* User-Agent: InstallCapital" "GET http://fun.losscook.bid/offer.php?affId=1462&trackingId=257741975&instId=803&ho_trackingid=1025a7e099b6c2131530eb0b38e642&cc=DE&cc_typ=ho&sb=x86&net=4.5.51209&ie=8.0.7601.17514&wv=7sp1&db=InternetExplorer&uac=1&cid=d41d8cd98f00b204e9800998ecf8427e&v=3 HTTP/1.1 Host: fun.losscook.bid Connection: close Accept: */* User-Agent: InstallCapital" "GET /qNHR3u HTTP/1.1 Accept: */* Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: destyy.com Connection: Keep-Alive" "GET /bundles/advertisement/img/tracking.gif?test=c8d0b41478502cbfd067c67c4477a4add2f2bb48 HTTP/1.1 Accept: */* Referer: http://destyy.com/qNHR3u Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: destyy.com Connection: Keep-Alive Cookie: __cfduid=ddc98816004483bb946dcc1bc01d5a1141502724303; PHPSESSID=946ch0ksc886anbnpsa4vl4oo7; hl=en; cookies-enable=1" "GET /bundles/smeweb/img/advertisement-tracking-3838801.gif?t=1502724303 HTTP/1.1 Accept: */* Referer: http://destyy.com/qNHR3u Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: destyy.com Connection: Keep-Alive Cookie: __cfduid=ddc98816004483bb946dcc1bc01d5a1141502724303; PHPSESSID=946ch0ksc886anbnpsa4vl4oo7; hl=en; cookies-enable=1" "GET /b5/4c/45/48/be/0d/ca/35/64/1c/e2/75/9d/8f/9e/2c/logo1707.png?2017-08-09.0 HTTP/1.1 Accept: */* Referer: http://destyy.com/qNHR3u Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: static.sh.st Connection: Keep-Alive" "GET /bundles/smeweb/img/tracking-3838801.gif?t=1502724303 HTTP/1.1 Accept: */* Referer: http://destyy.com/qNHR3u Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: destyy.com Connection: Keep-Alive Cookie: __cfduid=ddc98816004483bb946dcc1bc01d5a1141502724303; PHPSESSID=946ch0ksc886anbnpsa4vl4oo7; hl=en; cookies-enable=1" "GET /js/packed/interstitial-page.js?2017-08-09.0 HTTP/1.1 Accept: */* Referer: http://destyy.com/qNHR3u Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: static.sh.st Connection: Keep-Alive" "GET /bundles/advertisement/img/ajax-loader-green.gif?2017-08-09.0 HTTP/1.1 Accept: */* Referer: http://destyy.com/qNHR3u Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: static.shorte.st Connection: Keep-Alive" "GET /mixtape/728x90-b01.jpg HTTP/1.1 Accept: */* Referer: http://destyy.com/qNHR3u Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: clkme.in Connection: Keep-Alive" "GET /pop.php HTTP/1.1 Accept: */* Referer: http://destyy.com/qNHR3u Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: ads.shorte.st Connection: Keep-Alive" "GET /bundles/smeweb/img/bg-brown.png?2017-08-09.0 HTTP/1.1 Accept: */* Referer: http://destyy.com/qNHR3u Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: static.sh.st Connection: Keep-Alive" "GET /bundles/smeweb/img/widget-sprite.png?2017-08-09.0 HTTP/1.1 Accept: */* Referer: http://destyy.com/qNHR3u Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: static.sh.st Connection: Keep-Alive" "GET /apu.php?zoneid=1241630 HTTP/1.1 Accept: */* Referer: http://destyy.com/qNHR3u Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: go.oclasrv.com Connection: Keep-Alive" "GET /apu.php?zoneid=1241630 HTTP/1.1 Accept: */* Referer: http://destyy.com/qNHR3u Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Connection: Keep-Alive Host: onclkds.com" "GET /bundles/smeweb/img/favicon.ico?2017-08-09.0 HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: static.shorte.st Connection: Keep-Alive" "GET /pp?geo=DE&zoneid=1241630&oaid=32831af59550f8773791a126788adfcc&ftz=0&aid=0&nls=0<m=1&frl=0&rtg=1 HTTP/1.1 Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */* Referer: http://destyy.com/qNHR3u Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: mt.rtmark.net Connection: Keep-Alive" "GET /5/c=10546/pe=y?http%3A%2F%2Fmt.rtmark.net%2Fltm.gif%3Fid%3Dpu_eyJ1IjoiMzI4MzFhZjU5NTUwZjg3NzM3OTFhMTI2Nzg4YWRmY2MiLCJnIjoiREUiLCJ0IjoiMjAxNy0wOC0xNFQxMDoyNToxMS42NzA1ODQ1NjYtMDU6MDAiLCJoIjoiaW5ub2xhYjAyLnJ0dHkuaW4ifQ==%26sg%3D%24%7Baud_ids%7D HTTP/1.1 Accept: */* Referer: http://mt.rtmark.net/pp?geo=DE&zoneid=1241630&oaid=32831af59550f8773791a126788adfcc&ftz=0&aid=0&nls=0<m=1&frl=0&rtg=1 Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: ad.crwdcntrl.net Connection: Keep-Alive Cookie: _cc_cc="ACZ4nGNQSE41STI0MDI0sDRIS7ZMMTZNs0g0TUtKMbEwMDZLMTVlAIKIrc8z7z79%2F5%2BfAQZkJve95mLskmX4z8jIsLQdwZ415ZUAjD0JWbwLwf7dimDvOqjLCmFOlrv0H2gFkHXZCsaazbQTympRhYkx7CRdy%2B1%2BhI3%2F%2F%2F1lR5ZbOb%2BJBUkXw5rl%2F5kZ3zHD5Wf%2BXMDCKAnn%2Fvjxlp%2FxEy%2Bcf3ZyEysy%2F%2FDiOSykOm%2FlqUdspOq5NbWHkVQ900%2Bok6pl%2BZ9CUrVcJ8M3r8kItUtk2HPu6CFmUvV8%2FGxJqpZ3DfcFmPGrZvhAhJo3RKgBALfSzXI%3D"; _cc_aud="ABR4nDWTTUhUURTH333PhRmkFmouFBe6mGCkFoGMH5C5aSsOjAXawoRSmiAoN%2BqoKLOZBFFH%2FMBExEGzRVLhF0iKNIJoBpMj6Tgz6YgmGYJfENn8Ds3i%2FuZ%2Fzv%2B8e85992maptneRx5r%2F39OTSVf45%2FHK%2FgcXY1DO6p7ANV4hnJL0P2UYOYxKq8puirvMli4T64pgVz8Q4KWQtTQN9RODZbhFVT5JeBRQJWBO1kg%2FxfOpUGU%2FV0UetYUwcuH0tkRj47rAlf2JXgg%2BAnq3LLfOJYkaamtQCxhQUgQFARwjp%2BCg6sUxLwAKzK07y%2B4WUVL1ZOobBN4SxO60wes56K%2B8uj0Yp", "GET /ltm.gif?id=pu_eyJ1IjoiMzI4MzFhZjU5NTUwZjg3NzM3OTFhMTI2Nzg4YWRmY2MiLCJnIjoiREUiLCJ0IjoiMjAxNy0wOC0xNFQxMDoyNToxMS42NzA1ODQ1NjYtMDU6MDAiLCJoIjoiaW5ub2xhYjAyLnJ0dHkuaW4ifQ==&sg=94130 46072 35038 6429 258182 44470 119030 3936 94193 3819 44779 HTTP/1.1 Accept: */* Referer: http://mt.rtmark.net/pp?geo=DE&zoneid=1241630&oaid=32831af59550f8773791a126788adfcc&ftz=0&aid=0&nls=0<m=1&frl=0&rtg=1 Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip deflate Host: mt.rtmark.net Connection: Keep-Alive"27:T42b,"guig.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "_shfoldr.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows" "KMSpico_patch.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "INSTALL_KMS.bat" has type "DOS batch file ASCII text with CRLF line terminators" "RegistryActivator.exe" has type "PE32 executable (console) Intel 80386 for MS Windows" "17364e4224244e99f9f910bba12790ff.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "genteert.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "is-87OC6.tmp" has type "data" "is-FNDJ9.tmp" has type "data" "is-FCNQN.tmp" has type "data" "is-TSTVG.tmp" has type "data" "is-VIDAG.tmp" has type "ASCII text with no line terminators" "is-5CR95.tmp" has type "data" "is-28DHL.tmp" has type "data" "is-DQL44.tmp" has type "data" "is-E8A7L.tmp" has type "data" "is-G6CUG.tmp" has type "data" "is-P1D7I.tmp" has type "data" "is-AP83V.tmp" has type "data" "is-MJIM1.tmp" has type "data"28:T4b5,"" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "" touched file "%WINDIR%\system32\en-US\SETUPAPI.dll.mui" "" touched file "%APPDATA%\Microsoft\Windows\SendTo\desktop.ini" "" touched file "%APPDATA%\Microsoft\Windows\Start Menu\desktop.ini" "" touched file "%APPDATA%\Microsoft\Windows\Start Menu" "" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\desktop.ini" "" touched file "C:\ProgramData\Microsoft\Windows\Start Menu" "" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs" "" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" "" touched file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs" "" touched file "%WINDIR%\Fonts\desktop.ini" "" touched file "%APPDATA%\Microsoft\Windows\Cookies\desktop.ini" "" touched file "C:\Users\crg1exE\AppData\Local\Microsoft\Windows\History\desktop.ini" "" touched file "%WINDIR%\system32\en-US\USER32.dll.mui" "" touched file "%WINDIR%\Fonts\staticcache.dat"29:T846,Pattern match: "http://ocsp2.globalsign.com/rootr306" Pattern match: "http://crl.globalsign.com/root-r3.crl0c" Pattern match: "https://www.globalsign.com/repository/0" Pattern match: "http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08" Pattern match: "http://ocsp2.globalsign.com/gscodesignsha2g30V" Pattern match: "http://crl.globalsign.com/gscodesignsha2g3.crl0" Pattern match: "http://fun.losscook.bid/h_redir.php?offer_id=4&aff_id=1462&source=803&aff_sub=577a44716bfd1&aff_sub2=215&aff_sub3=&aff_sub4=&aff_sub5=1321589991&url=http%3A%2F%2Ffun.losscook.bid/offer.php%3FaffId%3D{aff_id}%26trackingId%3D257741975%26instId%3D803%26ho_tra" Pattern match: "http://build.zebraexpansion.bid/aff_c?offer_id=4&aff_id=1462&source=803&aff_sub=577a44716bfd1&aff_sub2=215&aff_sub3=&aff_sub4=&aff_sub5=1321589991&url=http%3A%2F%2Ffun.losscook.bid/offer.php%3FaffId%3D{aff_id}%26trackingId%3D257741975%26instId%3D803%26ho_t" Pattern match: "http://fun.losscook.bid/offer.php?affId=1462&trackingId=257741975&instId=803&ho_trackingid=1025a7e099b6c2131530eb0b38e642&cc=DE&cc_typ=ho&sb=x86&net=4.5.51209&ie=8.0.7601.17514&wv=7sp1&db=InternetExplorer&uac=1&cid=d41d8cd98f00b204e9800998ecf8427e&v=3" Heuristic match: "destyy.com" Heuristic match: "static.sh.st" Heuristic match: "static.shorte.st" Heuristic match: "clkme.in" Heuristic match: "ads.shorte.st" Heuristic match: "go.oclasrv.com" Heuristic match: "onclkds.com" Heuristic match: "mt.rtmark.net" Heuristic match: "ad.crwdcntrl.net" Pattern match: "www.gstatic.com" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Pattern match: "http://destyy.com/qNHR3u" Heuristic match: "%SystemDrive%\Program Files\Bolemekof\Rabokacafuc.com" Heuristic match: "%SystemDrive%\Program Files\Bolemekof\Nadeb.com" Heuristic match: "%SystemDrive%\Program Files\Bolemekof\Sanabigakeki.nu" Heuristic match: "%SystemDrive%\Program Files\Bolemekof\Mepaholapire.net" Heuristic match: "%SystemDrive%\Program Files\Bolemekof\Damoc.com" Heuristic match: "TITLE KMSPico By TeamDaz - support@teamcrew.de" Pattern match: "www.gentee.com"2a:T5c6,"C:\c8757a2fe21956623b339c1863e6481405326e9f8771f3aea6c250f7180842e5..exe" marked "C:\Program Files\42240814082017600308906" for deletion "C:\c8757a2fe21956623b339c1863e6481405326e9f8771f3aea6c250f7180842e5..exe" marked "%TEMP%\gentee74\3default - 1.bmp" for deletion "C:\c8757a2fe21956623b339c1863e6481405326e9f8771f3aea6c250f7180842e5..exe" marked "%TEMP%\gentee74\guig.dll" for deletion "C:\c8757a2fe21956623b339c1863e6481405326e9f8771f3aea6c250f7180842e5..exe" marked "%TEMP%\gentee74\setup_temp.gea" for deletion "C:\c8757a2fe21956623b339c1863e6481405326e9f8771f3aea6c250f7180842e5..exe" marked "%TEMP%\gentee74" for deletion "C:\c8757a2fe21956623b339c1863e6481405326e9f8771f3aea6c250f7180842e5..exe" marked "%TEMP%\gentee74.tmp" for deletion "C:\c8757a2fe21956623b339c1863e6481405326e9f8771f3aea6c250f7180842e5..exe" marked "%TEMP%\~DFFD4AF8029D8DBA1A.TMP" for deletion "%PROGRAMFILES%\KMSPico 10.2.2 Final\KMSpico_patch.exe" marked "%TEMP%\is-J8VUA.tmp\KMSpico_patch.tmp" for deletion "%PROGRAMFILES%\KMSPico 10.2.2 Final\KMSpico_patch.exe" marked "%TEMP%\is-J8VUA.tmp" for deletion "%TEMP%\is-J8VUA.tmp\KMSpico_patch.tmp" marked "%TEMP%\is-1DCR5.tmp\_isetup\_RegDLL.tmp" for deletion "%TEMP%\is-J8VUA.tmp\KMSpico_patch.tmp" marked "%TEMP%\is-1DCR5.tmp\_isetup\_shfoldr.dll" for deletion "%TEMP%\is-J8VUA.tmp\KMSpico_patch.tmp" marked "%TEMP%\is-1DCR5.tmp\_isetup" for deletion "%TEMP%\is-J8VUA.tmp\KMSpico_patch.tmp" marked "%TEMP%\is-1DCR5.tmp" for deletion2b:T61b,"" opened "%TEMP%\gentee74" with delete access "" opened "C:\Program Files\42240814082017600308906" with delete access "" opened "%TEMP%\gentee74\3default - 1.bmp" with delete access "" opened "%TEMP%\gentee74\guig.dll" with delete access "" opened "%TEMP%\gentee74\setup_temp.gea" with delete access "" opened "%TEMP%\gentee74.tmp" with delete access "" opened "%TEMP%\~DFFD4AF8029D8DBA1A.TMP" with delete access "KMSpico_patch.exe" opened "%TEMP%\is-J8VUA.tmp\KMSpico_patch.tmp" with delete access "KMSpico_patch.exe" opened "%TEMP%\is-J8VUA.tmp" with delete access "KMSpico_patch.tmp" opened "C:\Program Files\Bolemekof\is-BG7I9.tmp" with delete access "KMSpico_patch.tmp" opened "C:\Program Files\Bolemekof\is-ADUO1.tmp" with delete access "KMSpico_patch.tmp" opened "C:\Program Files\Bolemekof\is-BAIG4.tmp" with delete access "KMSpico_patch.tmp" opened "C:\Program Files\Bolemekof\is-U4SGR.tmp" with delete access "KMSpico_patch.tmp" opened "C:\Program Files\Bolemekof\is-NGQTM.tmp" with delete access "KMSpico_patch.tmp" opened "C:\Program Files\Bolemekof\is-87OC6.tmp" with delete access "KMSpico_patch.tmp" opened "C:\Program Files\Bolemekof\is-COERU.tmp" with delete access "KMSpico_patch.tmp" opened "C:\Program Files\Bolemekof\is-MHNEU.tmp" with delete access "KMSpico_patch.tmp" opened "C:\Program Files\Bolemekof\is-7P333.tmp" with delete access "KMSpico_patch.tmp" opened "C:\Program Files\Bolemekof\is-988I4.tmp" with delete access2c:T502,"net.exe" wrote bytes "4053157758581677186a1677653c17770000000000bfb7750000000056ccb775000000007ccab7750000000037683b756a2c1777d62d17770000000020693b750000000029a6b77500000000a48d3b7500000000f70eb77500000000" to virtual address "0x75AE1000" (part of module "NSI.DLL") "net1.exe" wrote bytes "4053157758581677186a1677653c17770000000000bfb7750000000056ccb775000000007ccab7750000000037683b756a2c1777d62d17770000000020693b750000000029a6b77500000000a48d3b7500000000f70eb77500000000" to virtual address "0x75AE1000" (part of module "NSI.DLL") "RegistryActivator.exe" wrote bytes "7739137779a81777be721777d62d17771de2127705a21777c868167757d11d77bee31277616f1777684115770050157700000000ad3758758b2d5875b641587500000000" to virtual address "0x74CA1000" (part of module "WSHIP6.DLL") "RegistryActivator.exe" wrote bytes "4053157758581677186a1677653c17770000000000bfb7750000000056ccb775000000007ccab7750000000037683b756a2c1777d62d17770000000020693b750000000029a6b77500000000a48d3b7500000000f70eb77500000000" to virtual address "0x75AE1000" (part of module "NSI.DLL") "RegistryActivator.exe" wrote bytes "92e6127779a81777be721777d62d17771de2127705a21777bee31277616f1777684115770050157700000000ad3758758b2d5875b641587500000000" to virtual address "0x747D1000" (part of module "WSHTCPIP.DLL")2d:Tad5,Found malicious artifacts related to "54.239.168.179" (ASN: , Owner: ): ... URL: http://ab36c812bb87eaa149e0381c8a2ae5518.profile.fra50.cloudfront.net/ (AV positives: 1/65 scanned on 10/03/2015 11:11:30) URL: http://a66b227615d42fe38527bfc489c35e0c3.profile.fra50.cloudfront.net/ (AV positives: 1/63 scanned on 08/31/2015 10:55:02) URL: http://a3c85c7787a8e2aabe21eb3156a39f902.profile.fra50.cloudfront.net/ (AV positives: 1/63 scanned on 07/21/2015 16:24:09) URL: http://ae6da23a536f26f768f0cd0f72825e001.profile.fra50.cloudfront.net/ (AV positives: 1/63 scanned on 06/17/2015 01:40:05) File SHA256: 7b5340ce2e3ab41b75fe93eb59bd29f096c23521671849e5d8e6fb87f4239a63 (AV positives: 53/65 scanned on 08/11/2017 15:57:28) File SHA256: 1b945be7b28cb5f00dde5c5318d8d43bbe44a7321ca6996db237d03cf8d1000f (AV positives: 40/64 scanned on 08/10/2017 19:37:41) File SHA256: 0fbd6cf34ed2cc9f707d7c49c63f0ba7bcc1d036f0bee5e8be0b140090e5b478 (AV positives: 23/64 scanned on 08/10/2017 07:43:24) File SHA256: e5e2ddc5f470183f4491a7478ee273d887177b9d2f4cc39b46140fed521467db (AV positives: 36/65 scanned on 08/08/2017 16:50:04) File SHA256: c5f2d43dc6f7b1594bf8904183984fb8fc00af06c5e39bffd68f6680c01fda08 (AV positives: 7/64 scanned on 08/07/2017 18:18:52) File SHA256: 9c32dbbc6de23916ce5c723451720e8d08f0f1ae1710c557a77915145d583f94 (Scanned on 03/14/2016 00:18:55) File SHA256: 1dda6c1c9b37022e6c908bb5a36313b38c87f88d2424e101c732a715a990b209 (Scanned on 12/16/2015 04:51:55) Found malicious artifacts related to "52.208.119.205" (ASN: , Owner: ): ... File SHA256: 9aac6fb784183c52a6034c031c979b8f0bdf3a1dc1b7ae86bb06824df4e5aa46 (AV positives: 28/65 scanned on 08/14/2017 15:18:21) File SHA256: 90907d160c57606e2dd3ddc8bf874935de2b04a417a4a51308ab68cd6de55e0f (AV positives: 20/64 scanned on 08/14/2017 14:49:53) File SHA256: f48c03a08a42946256dd0ab9f7fe8520b110306726f7c4246f55433ed982f3e5 (AV positives: 21/64 scanned on 08/14/2017 14:48:28) File SHA256: 6b9dca0be41beb84b35b89d315adb51a292edcd1e066b0690ce376d7c7d6bc59 (AV positives: 49/65 scanned on 08/14/2017 14:43:20) File SHA256: 7de0eb810f530aa0007278d3e75746d82a077424e8b8d830f89c0c696c9cf1d2 (AV positives: 41/65 scanned on 08/14/2017 13:05:19) File SHA256: bb7ea0d5a2bc9fc76ca2c0bdddcfc557e87969a6bac3ef7d7630fc68019d308f (Scanned on 08/12/2017 17:56:32) File SHA256: bd62b9bba747279ec6f621dedeb1e9795390007708366ad6263e0ddb15489a08 (Scanned on 08/12/2017 00:36:57) File SHA256: d4517db9854035174645c1677292d2215f8fc4a23cca156d68f07d23e2c5cba2 (Scanned on 08/11/2017 02:28:01) File SHA256: 019cc084fde217f09b2801a8bc0cd020751b1c7d880d2a7afbfff475e13de1c5 (Scanned on 08/10/2017 17:42:39) File SHA256: dea3e8fda00c890a8b7e365eef0c05a28d8c901cd9251415c6fa61703a2e8955 (Scanned on 08/10/2017 11:17:45)2e:Tad5,Found malicious artifacts related to "54.239.168.179" (ASN: , Owner: ): ... URL: http://ab36c812bb87eaa149e0381c8a2ae5518.profile.fra50.cloudfront.net/ (AV positives: 1/65 scanned on 10/03/2015 11:11:30) URL: http://a66b227615d42fe38527bfc489c35e0c3.profile.fra50.cloudfront.net/ (AV positives: 1/63 scanned on 08/31/2015 10:55:02) URL: http://a3c85c7787a8e2aabe21eb3156a39f902.profile.fra50.cloudfront.net/ (AV positives: 1/63 scanned on 07/21/2015 16:24:09) URL: http://ae6da23a536f26f768f0cd0f72825e001.profile.fra50.cloudfront.net/ (AV positives: 1/63 scanned on 06/17/2015 01:40:05) File SHA256: 7b5340ce2e3ab41b75fe93eb59bd29f096c23521671849e5d8e6fb87f4239a63 (AV positives: 53/65 scanned on 08/11/2017 15:57:28) File SHA256: 1b945be7b28cb5f00dde5c5318d8d43bbe44a7321ca6996db237d03cf8d1000f (AV positives: 40/64 scanned on 08/10/2017 19:37:41) File SHA256: 0fbd6cf34ed2cc9f707d7c49c63f0ba7bcc1d036f0bee5e8be0b140090e5b478 (AV positives: 23/64 scanned on 08/10/2017 07:43:24) File SHA256: e5e2ddc5f470183f4491a7478ee273d887177b9d2f4cc39b46140fed521467db (AV positives: 36/65 scanned on 08/08/2017 16:50:04) File SHA256: c5f2d43dc6f7b1594bf8904183984fb8fc00af06c5e39bffd68f6680c01fda08 (AV positives: 7/64 scanned on 08/07/2017 18:18:52) File SHA256: 9c32dbbc6de23916ce5c723451720e8d08f0f1ae1710c557a77915145d583f94 (Scanned on 03/14/2016 00:18:55) File SHA256: 1dda6c1c9b37022e6c908bb5a36313b38c87f88d2424e101c732a715a990b209 (Scanned on 12/16/2015 04:51:55) Found malicious artifacts related to "52.208.119.205" (ASN: , Owner: ): ... File SHA256: 9aac6fb784183c52a6034c031c979b8f0bdf3a1dc1b7ae86bb06824df4e5aa46 (AV positives: 28/65 scanned on 08/14/2017 15:18:21) File SHA256: 90907d160c57606e2dd3ddc8bf874935de2b04a417a4a51308ab68cd6de55e0f (AV positives: 20/64 scanned on 08/14/2017 14:49:53) File SHA256: f48c03a08a42946256dd0ab9f7fe8520b110306726f7c4246f55433ed982f3e5 (AV positives: 21/64 scanned on 08/14/2017 14:48:28) File SHA256: 6b9dca0be41beb84b35b89d315adb51a292edcd1e066b0690ce376d7c7d6bc59 (AV positives: 49/65 scanned on 08/14/2017 14:43:20) File SHA256: 7de0eb810f530aa0007278d3e75746d82a077424e8b8d830f89c0c696c9cf1d2 (AV positives: 41/65 scanned on 08/14/2017 13:05:19) File SHA256: bb7ea0d5a2bc9fc76ca2c0bdddcfc557e87969a6bac3ef7d7630fc68019d308f (Scanned on 08/12/2017 17:56:32) File SHA256: bd62b9bba747279ec6f621dedeb1e9795390007708366ad6263e0ddb15489a08 (Scanned on 08/12/2017 00:36:57) File SHA256: d4517db9854035174645c1677292d2215f8fc4a23cca156d68f07d23e2c5cba2 (Scanned on 08/11/2017 02:28:01) File SHA256: 019cc084fde217f09b2801a8bc0cd020751b1c7d880d2a7afbfff475e13de1c5 (Scanned on 08/10/2017 17:42:39) File SHA256: dea3e8fda00c890a8b7e365eef0c05a28d8c901cd9251415c6fa61703a2e8955 (Scanned on 08/10/2017 11:17:45)2f:T409,Spawned process "" (UID: 00039844-00003764) Spawned process "net.exe" with commandline "session" (UID: 00040960-00001160) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 session" (UID: 00040968-00003884) Spawned process "cmd.exe" with commandline ""cmd /c ""%PROGRAMFILES%\KMSPico 10.2.2 Final\INSTALL_KMS.bat"""" (UID: 00041059-00004060) Spawned process "schtasks.exe" with commandline ""schtasks /create /tn "FreeAntiVirus" /tr "%WINDIR%\explorer.exe ""http://destyy.com/qNHR3u""" /sc DAILY"" (UID: 00041075-00001412) Spawned process "explorer.exe" with commandline """http://destyy.com/qNHR3u"" (UID: 00041094-00004032), Spawned process "RegistryActivator.exe" (UID: 00041114-00002336), Spawned process "KMSpico_patch.exe" (UID: 00043351-00002240), Spawned process "KMSpico_patch.tmp" with commandline "/SL5="$201D8,974546,54272,%PROGRAMFILES%\KMSPico 10.2.2 Final\KMSpico_patch.exe"" (UID: 00044153-00002616), Spawned process "17364e4224244e99f9f910bba12790ff.exe" (UID: 00052607-00003160)30:T5ac,GET /5/c=10546/pe=y?http%3A%2F%2Fmt.rtmark.net%2Fltm.gif%3Fid%3Dpu_eyJ1IjoiMzI4MzFhZjU5NTUwZjg3NzM3OTFhMTI2Nzg4YWRmY2MiLCJnIjoiREUiLCJ0IjoiMjAxNy0wOC0xNFQxMDoyNToxMS42NzA1ODQ1NjYtMDU6MDAiLCJoIjoiaW5ub2xhYjAyLnJ0dHkuaW4ifQ==%26sg%3D%24%7Baud_ids%7D HTTP/1.1 Accept: */* Referer: http://mt.rtmark.net/pp?geo=DE&zoneid=1241630&oaid=32831af59550f8773791a126788adfcc&ftz=0&aid=0&nls=0<m=1&frl=0&rtg=1 Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: ad.crwdcntrl.net Connection: Keep-Alive Cookie: _cc_cc="ACZ4nGNQSE41STI0MDI0sDRIS7ZMMTZNs0g0TUtKMbEwMDZLMTVlAIKIrc8z7z79%2F5%2BfAQZkJve95mLskmX4z8jIsLQdwZ415ZUAjD0JWbwLwf7dimDvOqjLCmFOlrv0H2gFkHXZCsaazbQTympRhYkx7CRdy%2B1%2BhI3%2F%2F%2F1lR5ZbOb%2BJBUkXw5rl%2F5kZ3zHD5Wf%2BXMDCKAnn%2Fvjxlp%2FxEy%2Bcf3ZyEysy%2F%2FDiOSykOm%2FlqUdspOq5NbWHkVQ900%2Bok6pl%2BZ9CUrVcJ8M3r8kItUtk2HPu6CFmUvV8%2FGxJqpZ3DfcFmPGrZvhAhJo3RKgBALfSzXI%3D"; _cc_aud="ABR4nDWTTUhUURTH333PhRmkFmouFBe6mGCkFoGMH5C5aSsOjAXawoRSmiAoN%2BqoKLOZBFFH%2FMBExEGzRVLhF0iKNIJoBpMj6Tgz6YgmGYJfENn8Ds3i%2FuZ%2Fzv%2B8e85992maptneRx5r%2F39OTSVf45%2FHK%2FgcXY1DO6p7ANV4hnJL0P2UYOYxKq8puirvMli4T64pgVz8Q4KWQtTQN9RODZbhFVT5JeBRQJWBO1kg%2FxfOpUGU%2FV0UetYUwcuH0tkRj47rAlf2JXgg%2BAnq3LLfOJYkaamtQCxhQUgQFARwjp%2BCg6sUxLwAKzK07y%2B4WUVL1ZOobBN4SxO60wes56K%2B8uj0Yp31:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A//////////////////////////////////////////////////////////////////////iI//////////////////93d4iIj//////////////4///4d4iIj///////////j4h/iIiId4iI/////////4+HeIiIiIiHiIj///////j//4iIiIiIiId4iP/////4///4iIiIiIiIiHiP////j///+I//+IiIiIiIeP///4////iIiIiIiIiIiIj///////+IiIiIiIiIiHeI///4///4iIiIiIiIiIh3iP//+P//iIiIiIiIeIiIiI///////4iIEREReIeIiIiP//////+IgRERERGIiIiI////////iBEZmZEReHiIiP///4///4GRmZmZmReIiI////+PiPhRmZmZmZkReIj//////4eHmZmZmZmZkRiI////////iZmZmZmZmZkXj////////4l5mZmZmZmZlf////////+Hh5mZmZmZmZH/////////94d5mYiZmZmX//////////d3iJ+J+ZmZmP//////////mZmXh3mZmY////////////d3eZmZmZf/////////////h3eZmZeP///////////////4iIj///////////////////////////////////////////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==32:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==33:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==34:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==35:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==36:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAd3dwAAAAAAAAAAAAAACHd4h3d3cAAAAAAAAAAAAAd4iIiHd3AAAAAAAAAAAAB4iIiIh3d3MAAAAAAAAAAIeIiIiId3d3MzMAAAAAAAB4iIiIiId4d3d3MgAAAAAAeIiIh3eIiHd3dzMAAAAAAHiIiHd3iIiHd3czAAAAAAB4iIh3d4iIh3d3cwAAAAAAd4iIiIiIiId3dzMAAAAAAHeIiIiIiIh3d3czAAAAAAAHd3eIiIiIczMzMwAAAAAAB3d3iIiIhzMzMzMAAAAAAAB3d3iIh3czMzMzAAAAAAAzd3d3d3d3d3czMwAAAAADMzd3d3d3d3d3d3czMAAAAzM3d3d3d3d3d3d3czAAAAB3dzMzd3d3d3d3d3cwAAAAN3czMzMzMzMzM3h3MAAAAHN3MzMzMzMzMzN3cwAAAAACdzMzMzM3d3d3d3AAAAAAAAIzMzMzMzMzM3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD+AP//+AA///gAP//wAAD/4AAAf+AAAD/gAAA/4AAAf+AAAH/gAAB/4AAAf/AAAH/wAAA/+AAAP+AAAA/AAAAPwAAAD+AAAA/gAAAP4AAAH/AAAD/8AAB//////////////////////////////////////////////////////w==37:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4iI5gAAAAAAAAePjwAAB4iIiOZoAAAAAAAH+PgHAHiIiI5miIAAAAAAB4+PCHB4iIiGaI/wAAAAAAf4+AeHiIiIho///wAAAAAHj48Id4iIiAD/+IgAAAAAB/j4B4eIiIAAB3eIAAAAAAePjwh3d3dwAAiHdwAAAAAH+PgHh/+I7gCI+IgAAAAAB///CHf47md4iI+IAAAAAAf//weHfuZ3iIiI8AAAAAAH//8IeH5meIiIiICIiIAAB///CIiHZ3iIiIgAAAiHAAf//wiIgHd4iIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH9ERERERET4cAAAAAd3dwB/TohmZszE+HAAAAAAf//wf0/ohmZsxPhwAAAAAAd3dw9O/ohmZsT4cAAAAAAAAAB/T+/ohmZk+HAAAAAAAAAAf07+/ohmZPhwAAAAAAAAAH9I7+/ohmT4cAAAAAAAAAB/SI7+/ohk+HAAAAAAAAAAf0iI7+/ohPhwAAAAAAAAAH9ERERERET4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==38:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A//////////////////////////////////////////////////////////////////////iI//////////////////93d4iIj//////////////4///4d4iIj///////////j4h/iIiId4iI/////////4+HeIiIiIiHiIj///////j//4iIiIiIiId4iP/////4///4iIiIiIiIiHiP////j///+I//+IiIiIiIeP///4////iIiIiIiIiIiIj///////+IiIiIiIiIiHeI///4///4iIiIiIiIiIh3iP//+P//iIiIiIiIeIiIiI///////4iIEREReIeIiIiP//////+IgRERERGIiIiI////////iBEZmZEReHiIiP///4///4GRmZmZmReIiI////+PiPhRmZmZmZkReIj//////4eHmZmZmZmZkRiI////////iZmZmZmZmZkXj////////4l5mZmZmZmZlf////////+Hh5mZmZmZmZH/////////94d5mYiZmZmX//////////d3iJ+J+ZmZmP//////////mZmXh3mZmY////////////d3eZmZmZf/////////////h3eZmZeP///////////////4iIj///////////////////////////////////////////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"c8757a2fe21956623b339c1863e6481405326e9f8771f3aea6c250f7180842e5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791346164710,"unified_at":"2026-10-07T04:09:24.710Z","metadata":{"hashes":{"sha256":"c8757a2fe21956623b339c1863e6481405326e9f8771f3aea6c250f7180842e5","sha1":"eb0fa5bee85ab6fac27e2185e16e6ed2a4bffbe1","md5":"bf628f9bbc7257e0370e396c372a14e7","sha512":"799d8a0b7c4ea6a8c1dfbd39445b5a9070533d3876c561e0e0b29bf4127fdd9af8167ee7373cbe0bfea4b58029d4ba45f745dbfcecde7268e4ed194e5487a9fc","ssdeep":"49152:KQa/QX8o70u70KWnx7/kaiaPOy/9FD/nzCRh2m7Tvq2TdbIC7kfst:KQa4XZorx7MkzrD/nM8m7pdbIC70st","ssdeep_chunks":["49152:KQa/QX8","49152:Qa/QX8o","49152:a/QX8o7","49152:/QX8o70","49152:QX8o70u","49152:X8o70u7","49152:8o70u70","49152:o70u70K","49152:70u70KW","49152:0u70KWn","49152:u70KWnx","49152:70KWnx7","49152:0KWnx7/","49152:KWnx7/k","49152:Wnx7/ka","49152:nx7/kai","49152:x7/kaia","49152:7/kaiaP","49152:/kaiaPO","49152:kaiaPOy","49152:aiaPOy/","49152:iaPOy/9","49152:aPOy/9F","49152:POy/9FD","49152:Oy/9FD/","49152:y/9FD/n","49152:/9FD/nz","49152:9FD/nzC","49152:FD/nzCR","49152:D/nzCRh","49152:/nzCRh2","49152:nzCRh2m","49152:zCRh2m7","49152:CRh2m7T","49152:Rh2m7Tv","49152:h2m7Tvq","49152:2m7Tvq2","49152:m7Tvq2T","49152:7Tvq2Td","49152:Tvq2Tdb","49152:vq2TdbI","49152:q2TdbIC","49152:2TdbIC7","49152:TdbIC7k","49152:dbIC7kf","49152:bIC7kfs","49152:IC7kfst","98304:KQa/QX8","98304:Qa/QX8o","98304:a/QX8o7","98304:/QX8o70","98304:QX8o70u","98304:X8o70u7","98304:8o70u70","98304:o70u70K","98304:70u70KW","98304:0u70KWn","98304:u70KWnx","98304:70KWnx7","98304:0KWnx7/","98304:KWnx7/k","98304:Wnx7/ka","98304:nx7/kai","98304:x7/kaia","98304:7/kaiaP","98304:/kaiaPO","98304:kaiaPOy","98304:aiaPOy/","98304:iaPOy/9","98304:aPOy/9F","98304:POy/9FD","98304:Oy/9FD/","98304:y/9FD/n","98304:/9FD/nz","98304:9FD/nzC","98304:FD/nzCR","98304:D/nzCRh","98304:/nzCRh2","98304:nzCRh2m","98304:zCRh2m7","98304:CRh2m7T","98304:Rh2m7Tv","98304:h2m7Tvq","98304:2m7Tvq2","98304:m7Tvq2T","98304:7Tvq2Td","98304:Tvq2Tdb","98304:vq2TdbI","98304:q2TdbIC","98304:2TdbIC7","98304:TdbIC7k","98304:dbIC7kf","98304:bIC7kfs","98304:IC7kfst","49152:KQa4XZo","49152:Qa4XZor","49152:a4XZorx","49152:4XZorx7","49152:XZorx7M","49152:Zorx7Mk","49152:orx7Mkz","49152:rx7Mkzr","49152:x7MkzrD","49152:7MkzrD/","49152:MkzrD/n","49152:kzrD/nM","49152:zrD/nM8","49152:rD/nM8m","49152:D/nM8m7","49152:/nM8m7p","49152:nM8m7pd","49152:M8m7pdb","49152:8m7pdbI","49152:m7pdbIC","49152:7pdbIC7","49152:pdbIC70","49152:dbIC70s","49152:bIC70st"],"imphash":"d221b1dc8c3a08622f6512e7876527c8"},"file_info":{"file_name":"KMSPico 10.2.2.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1984662,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1502725105000,"last_seen":1661247784000,"last_multi_scan":1661247784000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["backdoor"]},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":32,"suspicious_count":20,"malicious_count":15,"total":67},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Dropped:Application.Agent.AYD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Adload.CI.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0050ff1e1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Dropper.Win32.Agent.bjtbah","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.erotbt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"TrojanDropper.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.InstallCore.EMV","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanDropper.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Dropper.Application.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00041114-00002336-49749-74-00BB0838\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00041114-00002336-49749-111-00BAD963\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00041114-00002336-49749-757-00BAD7FC\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00041114-00002336-49749-1094-00BADAE2\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00052607-00003160-62185-388-23412C65\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00052607-00003160-62185-390-23412C88\n SetUnhandledExceptionFilter@KERNEL32.dll at 15655-1674-0040DAE2\n SetUnhandledExceptionFilter@KERNEL32.dll at 15655-1181-0040D7FC\n SetUnhandledExceptionFilter@KERNEL32.dll at 23811-936-23412C65","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".reloc\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00041114-00002336-49749-21-00BADD36\n GetSystemTime@KERNEL32.DLL at 00043351-00002240-58806-165-0040102C\n GetSystemTime@KERNEL32.DLL at 00043351-00002240-58806-240-004026C4\n GetSystemTime@KERNEL32.DLL at 00043351-00002240-3276-194-0040102C\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00044153-00002616-8781-75-00457848\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00044153-00002616-8781-835-0045892C\n GetSystemTime@KERNEL32.DLL at 00044153-00002616-8781-784-00402778\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00044153-00002616-8781-866-00457804\n GetLocalTime@KERNEL32.DLL at 00044153-00002616-8781-3190-0046F190\n GetLocalTime@KERNEL32.DLL at 00044153-00002616-8781-3183-0046EBE4\n GetSystemTime@KERNEL32.DLL at 00044153-00002616-8781-2210-004010B4\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00052607-00003160-62185-380-234127E4","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00043351-00002240-58806-95-00405CE4\n GetVersion@KERNEL32.DLL at 00044153-00002616-8781-888-0041F128\n GetVersionExA@KERNEL32.DLL at 00044153-00002616-8781-876-0044F6E4\n GetVersion@KERNEL32.DLL at 00044153-00002616-8781-882-00419050\n GetVersionExA@KERNEL32.DLL at 00044153-00002616-8781-853-00483828\n GetVersionExA@KERNEL32.DLL at 00044153-00002616-8781-874-0044FBFC\n GetVersion@KERNEL32.DLL at 00044153-00002616-8781-747-0042E0AC\n GetVersionExA@KERNEL32.DLL at 00044153-00002616-8781-863-0044B614\n GetVersion@KERNEL32.DLL at 00044153-00002616-8781-1003-0046E38C\n GetVersion@KERNEL32.DLL at 00044153-00002616-8781-3071-00463044\n GetVersion@KERNEL32.DLL at 00044153-00002616-8781-2726-0042D984\n GetVersion@KERNEL32.DLL at 00044153-00002616-8781-3074-0046319C\n GetVersion@KERNEL32.DLL at 00044153-00002616-8781-1119-0045CF24\n GetVersionExA@KERNEL32.DLL at 00044153-00002616-8781-915-00409078\n GetVersion@KERNEL32.DLL at 00044153-00002616-8781-2486-00411704","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetUserDefaultLCID@KERNEL32.DLL at 00052607-00003160-62185-412-23413878\n EnumSystemLocalesW@KERNEL32.DLL at 00052607-00003160-62185-461-234178EF\n EnumSystemLocalesW@KERNEL32.DLL at 00052607-00003160-62185-411-2341380C\n EnumSystemLocalesW@KERNEL32.DLL at 00052607-00003160-62185-458-23417832\n GetUserDefaultLCID@KERNEL32.DLL at 00052607-00003160-62185-466-23417DA2\n EnumSystemLocalesW@KERNEL32.DLL at 00052607-00003160-62185-459-23417872","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00044153-00002616-8781-2975-00455DF8","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$25","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00041114-00002336-49749-1151-00BB52E0\n GetProcessHeap@KERNEL32.DLL at 00052607-00003160-4797-72-2340E075\n GetProcessHeap@KERNEL32.dll at 15655-1736-004152E0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"17364e4224244e99f9f910bba12790ff.exe\" queries volume information of \"C:\\\" at 00052607-00003160-0000010C-125381397","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"17364e4224244e99f9f910bba12790ff.exe\" queries volume information of \"C:\\\" at 00052607-00003160-0000010C-125381397","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"RegistryActivator.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"RegistryActivator.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"\"; Value: \"00000000010000006000000043003A005C00500072006F006700720061006D002000460069006C00650073005C0049006E007400650072006E006500740020004500780070006C006F007200650072005C0049004500580050004C004F00520045002E004500580045000000\")\n \"KMSpico_patch.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\BOLEMEKOF_IS1\")\n \"KMSpico_patch.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\BOLEMEKOF_IS1\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"fun.losscook.bid\"\n \"build.zebraexpansion.bid\"\n \"destyy.com\"\n \"static.sh.st\"\n \"static.shorte.st\"\n \"clkme.in\"\n \"ads.shorte.st\"\n \"go.oclasrv.com\"\n \"onclkds.com\"\n \"mt.rtmark.net\"\n \"ad.crwdcntrl.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"54.239.168.179:80\"\n \"52.208.119.205:80\"\n \"104.18.35.25:80\"\n \"216.58.207.138:443\"\n \"78.140.188.188:80\"\n \"78.140.188.189:80\"\n \"216.58.207.132:443\"\n \"216.58.207.131:443\"\n \"130.211.7.168:80\"\n \"78.140.191.114:80\"\n \"188.72.202.144:80\"\n \"185.49.145.151:80\"\n \"54.77.251.202:80\"\n \"2.18.165.47:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeA@KERNEL32.DLL at 00044153-00002616-8781-835-0045892C\n CreateNamedPipeA@KERNEL32.DLL at 00052607-00003160-4797-131-23402B35\n CreateNamedPipeA@KERNEL32.DLL at 00052607-00003160-4797-516-2340454A\n CreateNamedPipeA@KERNEL32.dll at 23811-1002-2340454A","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\genteert.dll\"\n \"\" created file \"%TEMP%\\gentee74.tmp\"\n \"\" created file \"%TEMP%\\gentee74\\guig.dll\"\n \"\" created file \"%TEMP%\\gentee74\\setup_temp.gea\"\n \"\" created file \"%TEMP%\\gentee74\\3default - 1.bmp\"\n \"\" created file \"%TEMP%\\~DFFD4AF8029D8DBA1A.TMP\"\n \"KMSpico_patch.exe\" created file \"%TEMP%\\is-J8VUA.tmp\\KMSpico_patch.tmp\"\n \"KMSpico_patch.tmp\" created file \"%TEMP%\\is-1DCR5.tmp\\_isetup\\_RegDLL.tmp\"\n \"KMSpico_patch.tmp\" created file \"%TEMP%\\is-1DCR5.tmp\\_isetup\\_shfoldr.dll\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\ci600308906\"\n \"ci600308906\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!crg1exe!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!crg1exe!appdata!roaming!microsoft!windows!cookies!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!crg1exe!appdata!local!microsoft!windows!history!history.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!crg1exe!appdata!roaming!microsoft!windows!ietldcache!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"\n \"Local\\c:!users!crg1exe!appdata!roaming!microsoft!windows!cookies!\"\n \"Local\\_!MSFTHISTORY!_\"\n \"Local\\c:!users!crg1exe!appdata!roaming!microsoft!windows!ietldcache!\"\n \"Local\\c:!users!crg1exe!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\c:!users!crg1exe!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\!IETld!Mutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"guig.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"_shfoldr.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"), Antivirus vendors marked dropped file \"genteert.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$26","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 6DC90000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"explorer.exe\" (UID: 00041094-00004032) was launched with new environment variables: \"SESSIONNAME=\"Console\"\"\n Process \"explorer.exe\" (UID: 00041094-00004032) was launched with missing environment variables: \"PROMPT, MpConfig_ProductUserAppDataPath, MpConfig_ProductAppDataPath, MpConfig_ProductPath, MpConfig_ProductCodeName, MpConfig_ReportingGUID\"\n Process \"KMSpico_patch.exe\" (UID: 00043351-00002240) was launched with new environment variables: \"PROMPT=\"$P$G\", MpConfig_ProductUserAppDataPath=\"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows Defender\", MpConfig_ProductAppDataPath=\"%ALLUSERSPROFILE%\\Microsoft\\Windows Defender\", MpConfig_ProductPath=\"C:\\Program Files\\Windows Defender\", MpConfig_ProductCodeName=\"AntiSpyware\", MpConfig_ReportingGUID=\"D9765A22-4A32-46A9-92CB-043F61DC4FA2\"\"\n Process \"KMSpico_patch.exe\" (UID: 00043351-00002240) was launched with missing environment variables: \"SESSIONNAME\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"\"cmd /c \"\"%PROGRAMFILES%\\KMSPico 10.2.2 Final\\INSTALL_KMS.bat\"\"\"\" on 2017-8-14.08:24:43.240","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"Shell_TrayWnd\"\n \"KMSpico_patch.tmp\" searching for class \"Shell_TrayWnd\"\n \"17364e4224244e99f9f910bba12790ff.exe\" searching for class \"456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"net.exe\" with commandline \"session\" (UID: 00040960-00001160)\n Spawned process \"net1.exe\" with commandline \"%WINDIR%\\system32\\net1 session\" (UID: 00040968-00003884)\n Spawned process \"cmd.exe\" with commandline \"\"cmd /c \"\"%PROGRAMFILES%\\KMSPico 10.2.2 Final\\INSTALL_KMS.bat\"\"\"\" (UID: 00041059-00004060)\n Spawned process \"schtasks.exe\" with commandline \"\"schtasks /create /tn \"FreeAntiVirus\" /tr \"%WINDIR%\\explorer.exe \"\"http://destyy.com/qNHR3u\"\"\" /sc DAILY\"\" (UID: 00041075-00001412)\n Spawned process \"explorer.exe\" with commandline \"\"\"http://destyy.com/qNHR3u\"\" (UID: 00041094-00004032), Spawned process \"RegistryActivator.exe\" (UID: 00041114-00002336), Spawned process \"KMSpico_patch.exe\" (UID: 00043351-00002240), Spawned process \"KMSpico_patch.tmp\" with commandline \"/SL5=\"$201D8,974546,54272,%PROGRAMFILES%\\KMSPico 10.2.2 Final\\KMSpico_patch.exe\"\" (UID: 00044153-00002616), Spawned process \"17364e4224244e99f9f910bba12790ff.exe\" (UID: 00052607-00003160)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"RegistryActivator.exe\" connecting to \"\\ThemeApiPort\"\n \"KMSpico_patch.exe\" connecting to \"\\ThemeApiPort\"\n \"KMSpico_patch.tmp\" connecting to \"\\ThemeApiPort\"\n \"17364e4224244e99f9f910bba12790ff.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.DLL at 00044153-00002616-8781-433-00455588","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$27","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$28","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$29","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"iZ,(za\"\n \"\"{^we\", \"w]}4om8{4|yn\", \"Mksmwy\", \"\"{^we\"\n \"w]}4om8{4|yn\"\n \"stoxtwNskwgm<\"\n \"o7tuk]u\"\n \"'R##3#3cSSScss3s#csFf62\"&r#$DR\"'B###rEC#ScsSCScbS\"&#&#\"'GG'\"\n \"'R##3#3cSSScss3s#csFf62\"&r#$DR\"'B###rEC#ScsSCScbS\"&#&#\"'GG'\"\n \"wm:ov|8MuM}5;\"","origin":"Network Traffic","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"RegistryActivator.exe\" opened \"\\Device\\KsecDD\"\n \"KMSpico_patch.tmp\" opened \"\\Device\\KsecDD\"\n \"17364e4224244e99f9f910bba12790ff.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"KMSpico_patch.exe\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"c8757a2fe21956623b339c1863e6481405326e9f8771f3aea6c250f7180842e5..exe.bin\" was detected as \"Microsoft visual C++ 5.0\"\n \"guig.dll\" was detected as \"Microsoft visual C++ 6.0 DLL\"\n \"KMSpico_patch.exe\" was detected as \"Borland Delphi 4.0\"\n \"RegistryActivator.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"17364e4224244e99f9f910bba12790ff.exe\" was detected as \"Microsoft visual C++ 8\"\n \"genteert.dll\" was detected as \"Microsoft visual C++ 6.0 DLL\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00039844-00003764-00000105-93045680\n \"RegistryActivator.exe\" at 00041114-00002336-00000105-95243293\n \"17364e4224244e99f9f910bba12790ff.exe\" at 00052607-00003160-00000105-124244739","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"\" queried SystemProcessInformation at 00039844-00003764-00000105-92986297\n \"\" queried SystemProcessInformation at 00039844-00003764-00000105-92988813\n \"\" queried SystemProcessInformation at 00039844-00003764-00000105-92988918\n \"KMSpico_patch.tmp\" queried SystemProcessInformation at 00044153-00002616-00000105-115084206\n \"KMSpico_patch.tmp\" queried SystemProcessInformation at 00044153-00002616-00000105-115084356\n \"17364e4224244e99f9f910bba12790ff.exe\" queried SystemProcessInformation at 00052607-00003160-00000105-125422946\n \"17364e4224244e99f9f910bba12790ff.exe\" queried SystemProcessInformation at 00052607-00003160-00000105-127859609\n \"17364e4224244e99f9f910bba12790ff.exe\" queried SystemProcessInformation at 00052607-00003160-00000105-127869203\n \"17364e4224244e99f9f910bba12790ff.exe\" queried SystemProcessInformation at 00052607-00003160-00000105-127873890","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 40 calls to GetProcAddress@KERNEL32.DLL at 00041114-00002336-49749-1122-00BACB76\n Found 10 calls to GetProcAddress@KERNEL32.DLL at 00044153-00002616-8781-888-0041F128\n Found 47 calls to GetProcAddress@KERNEL32.DLL at 00044153-00002616-8781-862-0044B668\n Found 36 calls to GetProcAddress@KERNEL32.dll at 15655-1376-0040CBCB","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".gentee with unusual entropies 7.80984424634","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"schtasks.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"explorer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"RegistryActivator.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"KMSpico_patch.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"17364e4224244e99f9f910bba12790ff.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"explorer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"RegistryActivator.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"17364e4224244e99f9f910bba12790ff.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"2/65 reputation engines marked \"http://destyy.com\" as malicious (3% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00043351-00002240-58806-76-00409BEC\n FindResourceA@KERNEL32.DLL at 00044153-00002616-8781-651-0040AFD8\n FindResourceA@KERNEL32.DLL at 00044153-00002616-8781-672-0040D210\n FindResourceExA@KERNEL32.DLL at 00052607-00003160-4797-51-234061E4","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%APPDATA%\\Microsoft\\Windows\\SendTo\\Desktop.ini\"\n \"\" read file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\n \"\" read file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\"\n \"\" read file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\n \"\" read file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"guig.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"_shfoldr.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"\n \"KMSpico_patch.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"RegistryActivator.exe\" has type \"PE32 executable (console) Intel 80386 for MS Windows\"\n \"17364e4224244e99f9f910bba12790ff.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"genteert.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"17364e4224244e99f9f910bba12790ff.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"4.0.1.2\"\n \"1.0.0.1\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$2a","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2b","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"_shfoldr.dll\" claimed CRC 36336 while the actual is CRC 37203\n \"KMSpico_patch.exe\" claimed CRC 1320017490 while the actual is CRC 36336\n \"RegistryActivator.exe\" claimed CRC 256213 while the actual is CRC 1251412\n \"17364e4224244e99f9f910bba12790ff.exe\" claimed CRC 367246 while the actual is CRC 747581","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetFileAttributesA\n LoadLibraryA\n GetModuleFileNameA\n GetStartupInfoA\n GetFileSize\n CreateDirectoryA\n DeleteFileA\n GetProcAddress\n GetTempPathA\n GetModuleHandleA\n WriteFile\n CreateFileA\n VirtualAlloc\n OpenProcessToken\n LoadLibraryExA\n Sleep\n SetSecurityDescriptorDacl\n RegOpenKeyA\n RegCloseKey\n RegCreateKeyExA\n GetVersionExA\n GetFileAttributesW\n LockResource\n CreateDirectoryW\n FindResourceExW\n RegOpenKeyExA\n VirtualProtect\n GetCommandLineA\n CreateProcessA\n FindResourceA\n GetCommandLineW\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n FindFirstFileExA\n FindNextFileA\n TerminateProcess\n GetModuleHandleW\n IsDebuggerPresent\n GetModuleHandleExW\n CreateFileW\n WSAStartup (Ordinal #115)\n RegCreateKeyA\n FindResourceExA\n OutputDebugStringW\n GetModuleFileNameW\n LoadLibraryW\n GetComputerNameA\n FindWindowA\n GetWindowThreadProcessId\n SetKeyboardState\n GetTickCount\n FindFirstFileA\n ExitThread","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2c","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"net.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"RegistryActivator.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"KMSpico_patch.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET TROJAN Backdoor User-Agent (InstallCapital)\" (SID: 2022246, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"50/64 Antivirus vendors marked sample as malicious (78% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"50/64 Antivirus vendors marked sample as malicious (78% detection rate)\n 7/39 Antivirus vendors marked sample as malicious (17% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"43/84 Antivirus vendors marked dropped file \"KMSpico_patch.exe\" as malicious (classified as \"Application.GenericKD\" with 51% detection rate)\n 31/65 Antivirus vendors marked dropped file \"RegistryActivator.exe\" as malicious (classified as \"Application.Agent\" with 47% detection rate)\n 61/86 Antivirus vendors marked dropped file \"17364e4224244e99f9f910bba12790ff.exe\" as malicious (classified as \"Trojan.Generic\" with 70% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"31/65 Antivirus vendors marked spawned process \"RegistryActivator.exe\" (PID: 2336) as malicious (classified as \"Application.Agent\" with 47% detection rate)\n 43/84 Antivirus vendors marked spawned process \"KMSpico_patch.exe\" (PID: 2240) as malicious (classified as \"Application.GenericKD\" with 51% detection rate)\n 61/86 Antivirus vendors marked spawned process \"17364e4224244e99f9f910bba12790ff.exe\" (PID: 3160) as malicious (classified as \"Trojan.Generic\" with 70% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"malicious","category":"Installation/Persistance","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at 70980000","origin":"Loaded Module","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"malicious","category":"Installation/Persistance","name":"Scans for the windows taskbar (often used for explorer injection)","description":"\"\" searching for class \"Shell_TrayWnd\"\n \"KMSpico_patch.tmp\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":5,"id":"api-17","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"malicious","category":"Installation/Persistance","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"\"schtasks /create /tn \"FreeAntiVirus\" /tr \"%WINDIR%\\explorer.exe \"\"http://destyy.com/qNHR3u\"\"\" /sc DAILY\"\" (UID: 00041075-00001412)","origin":"Monitored Target","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\net.exe\" (Handle: 480)\n \"\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\net.exe\" (Handle: 480)\n \"\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\net.exe\" (Handle: 480)\n \"KMSpico_patch.exe\" wrote 1500 bytes to a remote process \"%TEMP%\\is-J8VUA.tmp\\KMSpico_patch.tmp\" (Handle: 188)\n \"KMSpico_patch.exe\" wrote 4 bytes to a remote process \"%TEMP%\\is-J8VUA.tmp\\KMSpico_patch.tmp\" (Handle: 188)\n \"KMSpico_patch.exe\" wrote 32 bytes to a remote process \"%TEMP%\\is-J8VUA.tmp\\KMSpico_patch.tmp\" (Handle: 188)\n \"KMSpico_patch.exe\" wrote 52 bytes to a remote process \"%TEMP%\\is-J8VUA.tmp\\KMSpico_patch.tmp\" (Handle: 188)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"malicious","category":"Network Related","name":"Contacts very many different hosts","description":"Contacted 14 (or more) hosts in at least 3 different countries","origin":"Network Traffic","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: InstallCapital\n Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2d","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$2e","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00044153-00002616-8781-95-004555D0","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2f","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 14 domains and 14 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]}]},"activity":{"stats":{"process_count":10,"spawned_processes_count":10,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":18,"imported_dlls_count":110,"dropped_files_count":0,"extracted_files_count":27,"files_written_count":94,"files_deleted_count":0,"registry_keys_created_count":12,"registry_keys_modified_count":0,"registry_keys_deleted_count":6,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":18,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":14,"dns_resolutions_count":14,"contacted_urls_count":19,"http_requests_count":19},"behavior_tags":["backdoor"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5991c00c7ca3e11f9010fb18","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["EU","NLD","USA"],"submit_name":"KMSPico 10.2.2.exe","analysis_start_time":"2017-08-14T17:22:18+00:00","indicators_count":{"informative":32,"suspicious":28,"malicious":17},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"54.239.168.179","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"address":"52.208.119.205","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"address":"104.18.35.25","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"address":"216.58.207.138","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"address":"78.140.188.188","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"address":"78.140.188.189","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"address":"216.58.207.132","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"address":"216.58.207.131","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"address":"130.211.7.168","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"address":"78.140.191.114","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"address":"188.72.202.144","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"address":"185.49.145.151","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"address":"54.77.251.202","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"address":"2.18.165.47","port":443,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]}],"dns_resolutions":[{"domain":"clkme.in","address":"130.211.7.168","country":"United States","registrar_name":"Instra Corporation Pty Ltd. (R104-AFIN)","registrar_organization":"Red Sky Sp. z o.o.","registrar_name_servers":"NS-CLOUD-B1.GOOGLEDOMAINS.COM","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"domain":"ads.shorte.st","address":"78.140.188.188","country":"Netherlands","registrar_name":"Instra Corporation Pty Ltd","registrar_name_servers":"ns3.atomdns.net","registrar_creation_date":"2013-04-18T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"domain":"mt.rtmark.net","address":"185.49.145.151","country":"Netherlands","registrar_name":"URL SOLUTIONS INC.","registrar_organization":"GLOBAL DOMAIN PRIVACY SERVICES INC","registrar_name_servers":"NS-1195.AWSDNS-21.ORG","registrar_creation_date":"2014-10-29T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"domain":"destyy.com","address":"104.18.35.25","country":"United States","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"domain":"ad.crwdcntrl.net","address":"54.77.251.202","country":"United States","registrar_name":"GODADDY.COM, LLC","registrar_organization":"Lotame Solutions, Inc.","registrar_name_servers":"NS1.P14.DYNECT.NET","registrar_creation_date":"2006-11-21T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"domain":"onclkds.com","address":"188.72.202.144","country":"Netherlands","registrar_name":"URL SOLUTIONS INC.","registrar_organization":"GLOBAL DOMAIN PRIVACY SERVICES INC","registrar_name_servers":"NS-1423.AWSDNS-49.ORG","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"domain":"build.zebraexpansion.bid","address":"52.208.119.205","country":"United States","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"domain":"go.oclasrv.com","address":"78.140.191.114","country":"Netherlands","registrar_name":"URL SOLUTIONS INC.","registrar_organization":"GLOBAL DOMAIN PRIVACY SERVICES INC","registrar_name_servers":"NS-1183.AWSDNS-19.ORG","registrar_creation_date":"2013-10-01T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"domain":"static.sh.st","address":"78.140.188.188","country":"Netherlands","registrar_name":"ST Registry","registrar_name_servers":"ns3.atomdns.net","registrar_creation_date":"2013-07-01T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"domain":"www.gstatic.com","address":"66.102.1.94","country":"United States","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"domain":"fonts.googleapis.com","address":"66.102.1.95","country":"United States","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"domain":"static.shorte.st","address":"78.140.188.189","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"domain":"fun.losscook.bid","address":"54.239.168.179","country":"United States","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"domain":"fonts.gstatic.com","address":"66.102.1.94","country":"United States","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]}],"http_requests":[{"host":"fun.losscook.bid","host_ip":"54.239.168.179:80","url":"http://fun.losscook.bid/h_redir.php?offer_id=4&aff_id=1462&source=803&aff_sub=577a44716bfd1&aff_sub2=215&aff_sub3=&aff_sub4=&aff_sub5=1321589991&url=http%3A%2F%2Ffun.losscook.bid/offer.php%3FaffId%3D{aff_id}%26trackingId%3D257741975%26instId%3D803%26ho_trackingid%3D{transaction_id}%26cc%3D{country_code}%26cc_typ%3Dho%26sb%3Dx86%26net%3D4.5.51209%26ie%3D8%2e0%2e7601%2e17514%26wv%3D7sp1%26db%3DInternetExplorer%26uac%3D1%26cid%3Dd41d8cd98f00b204e9800998ecf8427e%26v%3D3","method":"GET","response_code":"302","response_phrase":"Moved Temporarily","header":"GET http://fun.losscook.bid/h_redir.php?offer_id=4&aff_id=1462&source=803&aff_sub=577a44716bfd1&aff_sub2=215&aff_sub3=&aff_sub4=&aff_sub5=1321589991&url=http%3A%2F%2Ffun.losscook.bid/offer.php%3FaffId%3D{aff_id}%26trackingId%3D257741975%26instId%3D803%26ho_trackingid%3D{transaction_id}%26cc%3D{country_code}%26cc_typ%3Dho%26sb%3Dx86%26net%3D4.5.51209%26ie%3D8%2e0%2e7601%2e17514%26wv%3D7sp1%26db%3DInternetExplorer%26uac%3D1%26cid%3Dd41d8cd98f00b204e9800998ecf8427e%26v%3D3 HTTP/1.1\nHost: fun.losscook.bid\nConnection: close\nAccept: */*\nUser-Agent: InstallCapital","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"host":"build.zebraexpansion.bid","host_ip":"52.208.119.205:80","url":"http://build.zebraexpansion.bid/aff_c?offer_id=4&aff_id=1462&source=803&aff_sub=577a44716bfd1&aff_sub2=215&aff_sub3=&aff_sub4=&aff_sub5=1321589991&url=http%3A%2F%2Ffun.losscook.bid/offer.php%3FaffId%3D{aff_id}%26trackingId%3D257741975%26instId%3D803%26ho_trackingid%3D{transaction_id}%26cc%3D{country_code}%26cc_typ%3Dho%26sb%3Dx86%26net%3D4.5.51209%26ie%3D8%2e0%2e7601%2e17514%26wv%3D7sp1%26db%3DInternetExplorer%26uac%3D1%26cid%3Dd41d8cd98f00b204e9800998ecf8427e%26v%3D3","method":"GET","response_code":"302","response_phrase":"Found","header":"GET http://build.zebraexpansion.bid/aff_c?offer_id=4&aff_id=1462&source=803&aff_sub=577a44716bfd1&aff_sub2=215&aff_sub3=&aff_sub4=&aff_sub5=1321589991&url=http%3A%2F%2Ffun.losscook.bid/offer.php%3FaffId%3D{aff_id}%26trackingId%3D257741975%26instId%3D803%26ho_trackingid%3D{transaction_id}%26cc%3D{country_code}%26cc_typ%3Dho%26sb%3Dx86%26net%3D4.5.51209%26ie%3D8%2e0%2e7601%2e17514%26wv%3D7sp1%26db%3DInternetExplorer%26uac%3D1%26cid%3Dd41d8cd98f00b204e9800998ecf8427e%26v%3D3 HTTP/1.1\nHost: build.zebraexpansion.bid\nConnection: close\nAccept: */*\nUser-Agent: InstallCapital","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"host":"fun.losscook.bid","host_ip":"54.239.168.179:80","url":"http://fun.losscook.bid/offer.php?affId=1462&trackingId=257741975&instId=803&ho_trackingid=1025a7e099b6c2131530eb0b38e642&cc=DE&cc_typ=ho&sb=x86&net=4.5.51209&ie=8.0.7601.17514&wv=7sp1&db=InternetExplorer&uac=1&cid=d41d8cd98f00b204e9800998ecf8427e&v=3","method":"GET","response_code":"200","response_phrase":"OK","header":"GET http://fun.losscook.bid/offer.php?affId=1462&trackingId=257741975&instId=803&ho_trackingid=1025a7e099b6c2131530eb0b38e642&cc=DE&cc_typ=ho&sb=x86&net=4.5.51209&ie=8.0.7601.17514&wv=7sp1&db=InternetExplorer&uac=1&cid=d41d8cd98f00b204e9800998ecf8427e&v=3 HTTP/1.1\nHost: fun.losscook.bid\nConnection: close\nAccept: */*\nUser-Agent: InstallCapital","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"host":"destyy.com","host_ip":"104.18.35.25:80","url":"/qNHR3u","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /qNHR3u HTTP/1.1\nAccept: */*\nAccept-Language: en-us\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nAccept-Encoding: gzip, deflate\nHost: destyy.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"host":"destyy.com","host_ip":"104.18.35.25:80","url":"/bundles/advertisement/img/tracking.gif?test=c8d0b41478502cbfd067c67c4477a4add2f2bb48","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /bundles/advertisement/img/tracking.gif?test=c8d0b41478502cbfd067c67c4477a4add2f2bb48 HTTP/1.1\nAccept: */*\nReferer: http://destyy.com/qNHR3u\nAccept-Language: en-US\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nAccept-Encoding: gzip, deflate\nHost: destyy.com\nConnection: Keep-Alive\nCookie: __cfduid=ddc98816004483bb946dcc1bc01d5a1141502724303; PHPSESSID=946ch0ksc886anbnpsa4vl4oo7; hl=en; cookies-enable=1","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"host":"destyy.com","host_ip":"104.18.35.25:80","url":"/bundles/smeweb/img/advertisement-tracking-3838801.gif?t=1502724303","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /bundles/smeweb/img/advertisement-tracking-3838801.gif?t=1502724303 HTTP/1.1\nAccept: */*\nReferer: http://destyy.com/qNHR3u\nAccept-Language: en-US\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nAccept-Encoding: gzip, deflate\nHost: destyy.com\nConnection: Keep-Alive\nCookie: __cfduid=ddc98816004483bb946dcc1bc01d5a1141502724303; PHPSESSID=946ch0ksc886anbnpsa4vl4oo7; hl=en; cookies-enable=1","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"host":"static.sh.st","host_ip":"78.140.188.188:80","url":"/b5/4c/45/48/be/0d/ca/35/64/1c/e2/75/9d/8f/9e/2c/logo1707.png?2017-08-09.0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /b5/4c/45/48/be/0d/ca/35/64/1c/e2/75/9d/8f/9e/2c/logo1707.png?2017-08-09.0 HTTP/1.1\nAccept: */*\nReferer: http://destyy.com/qNHR3u\nAccept-Language: en-US\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nAccept-Encoding: gzip, deflate\nHost: static.sh.st\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"host":"destyy.com","host_ip":"104.18.35.25:80","url":"/bundles/smeweb/img/tracking-3838801.gif?t=1502724303","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /bundles/smeweb/img/tracking-3838801.gif?t=1502724303 HTTP/1.1\nAccept: */*\nReferer: http://destyy.com/qNHR3u\nAccept-Language: en-US\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nAccept-Encoding: gzip, deflate\nHost: destyy.com\nConnection: Keep-Alive\nCookie: __cfduid=ddc98816004483bb946dcc1bc01d5a1141502724303; PHPSESSID=946ch0ksc886anbnpsa4vl4oo7; hl=en; cookies-enable=1","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"host":"static.sh.st","host_ip":"78.140.188.188:80","url":"/js/packed/interstitial-page.js?2017-08-09.0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /js/packed/interstitial-page.js?2017-08-09.0 HTTP/1.1\nAccept: */*\nReferer: http://destyy.com/qNHR3u\nAccept-Language: en-US\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nAccept-Encoding: gzip, deflate\nHost: static.sh.st\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"host":"static.shorte.st","host_ip":"78.140.188.189:80","url":"/bundles/advertisement/img/ajax-loader-green.gif?2017-08-09.0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /bundles/advertisement/img/ajax-loader-green.gif?2017-08-09.0 HTTP/1.1\nAccept: */*\nReferer: http://destyy.com/qNHR3u\nAccept-Language: en-US\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nAccept-Encoding: gzip, deflate\nHost: static.shorte.st\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"host":"clkme.in","host_ip":"130.211.7.168:80","url":"/mixtape/728x90-b01.jpg","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /mixtape/728x90-b01.jpg HTTP/1.1\nAccept: */*\nReferer: http://destyy.com/qNHR3u\nAccept-Language: en-US\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nAccept-Encoding: gzip, deflate\nHost: clkme.in\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"host":"ads.shorte.st","host_ip":"78.140.188.188:80","url":"/pop.php","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /pop.php HTTP/1.1\nAccept: */*\nReferer: http://destyy.com/qNHR3u\nAccept-Language: en-US\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nAccept-Encoding: gzip, deflate\nHost: ads.shorte.st\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"host":"static.sh.st","host_ip":"78.140.188.188:80","url":"/bundles/smeweb/img/bg-brown.png?2017-08-09.0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /bundles/smeweb/img/bg-brown.png?2017-08-09.0 HTTP/1.1\nAccept: */*\nReferer: http://destyy.com/qNHR3u\nAccept-Language: en-US\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nAccept-Encoding: gzip, deflate\nHost: static.sh.st\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"host":"static.sh.st","host_ip":"78.140.188.188:80","url":"/bundles/smeweb/img/widget-sprite.png?2017-08-09.0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /bundles/smeweb/img/widget-sprite.png?2017-08-09.0 HTTP/1.1\nAccept: */*\nReferer: http://destyy.com/qNHR3u\nAccept-Language: en-US\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nAccept-Encoding: gzip, deflate\nHost: static.sh.st\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"host":"go.oclasrv.com","host_ip":"78.140.191.114:80","url":"/apu.php?zoneid=1241630","method":"GET","response_code":"302","response_phrase":"Moved Temporarily","header":"GET /apu.php?zoneid=1241630 HTTP/1.1\nAccept: */*\nReferer: http://destyy.com/qNHR3u\nAccept-Language: en-US\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nAccept-Encoding: gzip, deflate\nHost: go.oclasrv.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"host":"static.shorte.st","host_ip":"78.140.188.189:80","url":"/bundles/smeweb/img/favicon.ico?2017-08-09.0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /bundles/smeweb/img/favicon.ico?2017-08-09.0 HTTP/1.1\nAccept: */*\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: static.shorte.st\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"host":"mt.rtmark.net","host_ip":"185.49.145.151:80","url":"/pp?geo=DE&zoneid=1241630&oaid=32831af59550f8773791a126788adfcc&ftz=0&aid=0&nls=0<m=1&frl=0&rtg=1","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /pp?geo=DE&zoneid=1241630&oaid=32831af59550f8773791a126788adfcc&ftz=0&aid=0&nls=0<m=1&frl=0&rtg=1 HTTP/1.1\nAccept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*\nReferer: http://destyy.com/qNHR3u\nAccept-Language: en-US\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nAccept-Encoding: gzip, deflate\nHost: mt.rtmark.net\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"host":"ad.crwdcntrl.net","host_ip":"54.77.251.202:80","url":"/5/c=10546/pe=y?http%3A%2F%2Fmt.rtmark.net%2Fltm.gif%3Fid%3Dpu_eyJ1IjoiMzI4MzFhZjU5NTUwZjg3NzM3OTFhMTI2Nzg4YWRmY2MiLCJnIjoiREUiLCJ0IjoiMjAxNy0wOC0xNFQxMDoyNToxMS42NzA1ODQ1NjYtMDU6MDAiLCJoIjoiaW5ub2xhYjAyLnJ0dHkuaW4ifQ==%26sg%3D%24%7Baud_ids%7D","method":"GET","response_code":"302","response_phrase":"Found","header":"$30","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"host":"mt.rtmark.net","host_ip":"185.49.145.151:80","url":"/ltm.gif?id=pu_eyJ1IjoiMzI4MzFhZjU5NTUwZjg3NzM3OTFhMTI2Nzg4YWRmY2MiLCJnIjoiREUiLCJ0IjoiMjAxNy0wOC0xNFQxMDoyNToxMS42NzA1ODQ1NjYtMDU6MDAiLCJoIjoiaW5ub2xhYjAyLnJ0dHkuaW4ifQ==&sg=94130,46072,35038,6429,258182,44470,119030,3936,94193,3819,44779","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /ltm.gif?id=pu_eyJ1IjoiMzI4MzFhZjU5NTUwZjg3NzM3OTFhMTI2Nzg4YWRmY2MiLCJnIjoiREUiLCJ0IjoiMjAxNy0wOC0xNFQxMDoyNToxMS42NzA1ODQ1NjYtMDU6MDAiLCJoIjoiaW5ub2xhYjAyLnJ0dHkuaW4ifQ==&sg=94130,46072,35038,6429,258182,44470,119030,3936,94193,3819,44779 HTTP/1.1\nAccept: */*\nReferer: http://mt.rtmark.net/pp?geo=DE&zoneid=1241630&oaid=32831af59550f8773791a126788adfcc&ftz=0&aid=0&nls=0<m=1&frl=0&rtg=1\nAccept-Language: en-US\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nAccept-Encoding: gzip, deflate\nHost: mt.rtmark.net\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}],"processes":[{"pid":3764,"ppid":0,"name":"c8757a2fe21956623b339c1863e6481405326e9f8771f3aea6c250f7180842e5..exe","command_line":"","sha256":"c8757a2fe21956623b339c1863e6481405326e9f8771f3aea6c250f7180842e5","normalized_path":"C:\\c8757a2fe21956623b339c1863e6481405326e9f8771f3aea6c250f7180842e5..exe","uid":"00039844-00003764","icon":"$31"},{"pid":1160,"ppid":3764,"name":"net.exe","command_line":"session","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00039844-00003764","uid":"00040960-00001160","icon":"$32"},{"pid":3884,"ppid":1160,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 session","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00040960-00001160","uid":"00040968-00003884","icon":"$33"},{"pid":4060,"ppid":3764,"name":"cmd.exe","command_line":"\"cmd /c \"\"%PROGRAMFILES%\\KMSPico 10.2.2 Final\\INSTALL_KMS.bat\"\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00039844-00003764","uid":"00041059-00004060","icon":"$34"},{"pid":1412,"ppid":4060,"name":"schtasks.exe","command_line":"\"schtasks /create /tn \"FreeAntiVirus\" /tr \"%WINDIR%\\explorer.exe \"\"http://destyy.com/qNHR3u\"\"\" /sc DAILY\"","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00041059-00004060","uid":"00041075-00001412","icon":"$35"},{"pid":2336,"ppid":4060,"name":"RegistryActivator.exe","command_line":"","sha256":"9894bbf57c38ae2290583fb9f262d87e72840716455cb6a106d75abc89913801","normalized_path":"%PROGRAMFILES%\\KMSPico 10.2.2 Final\\RegistryActivator.exe","parent_uid":"00041059-00004060","uid":"00041114-00002336","icon":"$36"},{"pid":2240,"ppid":4060,"name":"KMSpico_patch.exe","command_line":"","sha256":"c334acd435f7aabaa4ee4372c74d5f7e4dea5d5998b1ad69cbf31f1a72afb3fd","normalized_path":"%PROGRAMFILES%\\KMSPico 10.2.2 Final\\KMSpico_patch.exe","parent_uid":"00041059-00004060","uid":"00043351-00002240","icon":"$37"},{"pid":2616,"ppid":2240,"name":"KMSpico_patch.tmp","command_line":"/SL5=\"$201D8,974546,54272,%PROGRAMFILES%\\KMSPico 10.2.2 Final\\KMSpico_patch.exe\"","sha256":"97108defbfb4a6ffe7a98209a1ea69b400dc8903524b16594649ce819eb82d8e","normalized_path":"%TEMP%\\is-J8VUA.tmp\\KMSpico_patch.tmp","parent_uid":"00043351-00002240","uid":"00044153-00002616","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB7klEQVR42u2XzYrqMBiG5w5FdOeleBsiWLs8unfhHYg7F4J/iHjc+DszbRfaf/ue8yV0qh2DTeLs5oMXWmjyPGnyFfr29lu/lavpdIr9fo/T6YTD4VAw/PntdovhcIhSqQRlgdlshiRJoFJRFIHGk0SlUoGyQBAEbEISSZIrrldRYsRxFqrVaoXlconJZIJyuQxNATE4D08FNpu/2O127H48HqNWq0FZoMiqs0RsDK1+vV6za9u2MRgMUK1WISXg+75QQARPBebzObrdP//TRafTQa/XQ7/ff5WAGE4HkJLW8XhkMqPRiEloCsRCeArOEiIMw7tOWiwWOgLPV30LTwV4aJ4El8tFVUAHHrCQgOM4sgIee4XPX3kemoGpkyg0j+PYcgKelxeIlOBB4LNviaaAHDwT8F8hoAdPBeiDJCngsoGiFhOD7wXoMFMn2bYlL0ADi5zy/J7fwrlALC/gunkBNTh1k6ZAKA3nAt5XNATiAm0mXvmtgGUpCFALFjnlIjCFuom6yLI+dQSKwL+DeVwdgfBpiz2CcwH3K4oCFzawyCl/vPoXCejClQTov+B8PrP953AvJ+B+C20ZST9KGEb4+HiXE/iJKixQr9fRbDZhmm202zyGkV4bdzEMSuthWi0e0zTRaDTU/5R+uv4BptK4NzAQLaQAAAAASUVORK5CYII="},{"pid":3160,"ppid":4060,"name":"17364e4224244e99f9f910bba12790ff.exe","command_line":"","sha256":"97652a68015e89f83ec20484c5e9a73d329e1a2f78db0cc61333e2d219e27e55","normalized_path":"%PROGRAMFILES%\\KMSPico 10.2.2 Final\\17364e4224244e99f9f910bba12790ff.exe","parent_uid":"00041059-00004060","uid":"00052607-00003160"},{"pid":4032,"ppid":0,"name":"explorer.exe","command_line":"\"\"http://destyy.com/qNHR3u\"","sha256":"0a8ce026714e03e72c619307bd598add5f9b639cfd91437cb8d9c847bf9f6894","normalized_path":"%WINDIR%\\explorer.exe","uid":"00041094-00004032","icon":"$38"}],"all_imported_dlls":["ktmw32.dll","WSHTCPIP.DLL","GdiPlus.dll","advapi32.dll","xmllite.dll","winhttp.dll","webio.dll","rasadhlp.dll","ncrypt.dll","oleaccrc.dll","actxprxy.dll","kernel32.dll","gdi32.dll","mpr.dll","winsta.dll","logoncli.dll","crypt32.dll","odbcint.dll","slc.dll","msctf.dll","uxtheme.dll","devobj.dll","iertutil.dll","samcli.dll","netapi32.dll","ole32.dll","sechost.dll","oleaut32.dll","ntmarta.dll","odbc32.dll","psapi.dll","browcli.dll","IPHLPAPI.DLL","duser.dll","msasn1.dll","wtsapi32.dll","wbemprox.dll","powrprof.dll","oleacc.dll","genteert.dll","srvcli.dll","winbrand.dll","mswsock.dll","bcryptprimitives.dll","winmm.dll","msxml3r.dll","ieframe.dll","msvfw32.dll","lpk.dll","dwmapi.dll","samlib.dll","msvcrt.dll","rpcss.dll","setupapi.dll","Wldap32.dll","nsi.dll","dsrole.dll","netmsg.dll","taskschd.dll","dnsapi.dll","FWPUCLNT.DLL","_shfoldr.dll","sfc.dll","devrtl.dll","RpcRtRemote.dll","wbemsvc.dll","fastprox.dll","rpcrt4.dll","cryptbase.dll","winnsi.dll","ntdsapi.dll","wship6.dll","bcrypt.dll","urlmon.dll","wininet.dll","ntdll.dll","imm32.dll","version.dll","comctl32.dll","clbcatq.dll","propsys.dll","comdlg32.dll","tapi32.dll","wkscli.dll","cfgmgr32.dll","riched20.dll","ExplorerFrame.dll","imageres.dll","netutils.dll","RstrtMgr.dll","sfc_os.dll","KernelBase.dll","shell32.dll","dui70.dll","rsaenh.dll","tiptsf.dll","avicap32.dll","userenv.dll","user32.dll","sspicli.dll","apphelp.dll","ws2_32.dll","shfolder.dll","wbemcomn.dll","secur32.dll","msxml3.dll","usp10.dll","shlwapi.dll","profapi.dll","cryptsp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"17364e4224244e99f9f910bba12790ff.exe","sha256":"97652a68015e89f83ec20484c5e9a73d329e1a2f78db0cc61333e2d219e27e55","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"KMSpico_patch.exe","sha256":"c334acd435f7aabaa4ee4372c74d5f7e4dea5d5998b1ad69cbf31f1a72afb3fd","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"RegistryActivator.exe","sha256":"9894bbf57c38ae2290583fb9f262d87e72840716455cb6a106d75abc89913801","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"guig.dll","sha256":"624f4c25504ba431f450d8ecee2e2d0a4d87b95f7fa0b72db43f057ca021c328","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"genteert.dll","sha256":"54c0da1735bb1cb02b60c321de938488345f8d1d26bf389c8cb2acad5d01b831","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"_shfoldr.dll","sha256":"9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"INSTALL_KMS.bat","sha256":"79351b2f356e6269bae9adcad8dc350c595e2d9f3f1580104dd9df777ffa5df7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"is-02692.tmp","sha256":"873a0bba4287275c7960abcbab2b3a9ebad4382ae8d7f875314b984789ee8a35","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"is-08JDT.tmp","sha256":"56ff0404df506c25741750a2173600172185a20e064bf84b92a45bc807e10b1b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"is-0BNVA.tmp","sha256":"a0ee22c98f3bf204e341f9aa956a13b5fa6ab909cdf24a3d7ea1be3600dc55f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"is-0HN6I.tmp","sha256":"e089c15701840c1f91d69fe1ddfcd680b82e8b4bcb5c281a01a25057561d533f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"is-0U182.tmp","sha256":"58d1b8e78de7b9176d7d9a0b732917333808928f47b87147b7d3320360866ae2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"is-16ILI.tmp","sha256":"c96899b3bb893a8cbca860e8460f2b2224f918606a3b2f3c7176f646fc6cb81b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"is-1QIUF.tmp","sha256":"445c521bddd9f457e4e8d6d6de5f0b0df9389494d3fd9b59848c55eb68f4cdfa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"is-1RNC0.tmp","sha256":"79c7406a1c233fa032cc827c93749b3c8b2f5dedb7ba817b5835007625417c25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"is-1UJEF.tmp","sha256":"c46992b4d1313c932a9ea9d2a8ed1bc05f2c75695f185549c557b0247767fae4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"is-28DHL.tmp","sha256":"3b36a238a51fc94c860d90caa653910373fa48697c8c87bd34a87f11b6b8a007","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"is-29KTF.tmp","sha256":"438cd42516a4bfc9cf41e611a4ff18b52cd4c7fdf7bd233f8bce915eb9b34d60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"is-2Q4GJ.tmp","sha256":"72619df357fbbece24543db629f043dadc00cd12fe0e6c8ef1077851ea0c7e0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"is-38VK9.tmp","sha256":"b44024519978218aa2151a4f95e1d52958e6d7c49e5de9f5be0b8c8c1ae09749","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"is-3V83O.tmp","sha256":"134745d94157bcc8a1c1095cd2abfba6389b10b44b1416283d1af371a6baafc6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"is-410HO.tmp","sha256":"6e3a06c3f638e02f56403773200df5d8d0f19f76fdc5f1b33ff2c0214eb30578","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"is-4D7GQ.tmp","sha256":"4966ab2b728a576d388c3952faf58835eea8eaa52ecb4dfe9bc1a731c5f05602","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"is-59L7R.tmp","sha256":"af78dfd27a8550a93af263d654dcc9fdc262237588d53a8d9ee473836481484f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"is-5CR95.tmp","sha256":"288be827d21ac7c0913ac8ec24acccd45400cdd30cabbcc846a99fe7ef558382","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"is-5F46E.tmp","sha256":"5298ca51b4da4c633ae672f912cb6bd9b2f8c977fcecbeca7d8d1ea488e9674a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"is-5IDVI.tmp","sha256":"bdf9b892486418110801c6d3b11a0e10a5e9b942ad0e04b1f8fcfcf5ef79af8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\SendTo\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%PUBLIC%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%PUBLIC%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%WINDIR%\\Fonts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%PUBLIC%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%PUBLIC%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%PUBLIC%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%USERPROFILE%\\Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"C:\\Users\\Public","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%PUBLIC%\\Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"C:\\Users\\crg1exE","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%WINDIR%\\system32\\en-US\\NETMSG.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"C:\\c8757a2fe21956623b339c1863e6481405326e9f8771f3aea6c250f7180842e5..exe","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%WINDIR%\\system32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%WINDIR%\\system32\\en-US\\schtasks.exe.mui","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%PROGRAMFILES%\\KMSPico 10.2.2 Final\\RegistryActivator.exe","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\IEXPLORE.EXE","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en-US\\IEXPLORE.EXE.mui","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%WINDIR%\\system32\\en-US\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%WINDIR%\\en-US\\explorer.exe.mui","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%WINDIR%\\system32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%WINDIR%\\system32\\netmsg.dll","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%WINDIR%\\system32\\en-US\\netmsg.dll.mui","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%WINDIR%\\system32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%WINDIR%\\system32\\en-US\\imageres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%WINDIR%\\system32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%PROGRAMFILES%\\Bolemekof\\Baherobu.exe","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%PROGRAMFILES%\\Bolemekof\\Guhogekocag.exe","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%PROGRAMFILES%\\Bolemekof\\Kamot.exe","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%PROGRAMFILES%\\Bolemekof\\Bokosike.exe","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%PROGRAMFILES%\\Bolemekof\\Gefanapemi.exe","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%PROGRAMFILES%\\Bolemekof","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%TEMP%\\is-J8VUA.tmp\\KMSpico_patch.tmp","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%PROGRAMFILES%\\KMSPico 10.2.2 Final\\KMSpico_patch.exe","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%PROGRAMFILES%\\Bolemekof\\unins000.dat","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%PROGRAMFILES%\\KMSPico 10.2.2 Final\\INSTALL_KMS.bat","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%WINDIR%\\system32\\en-US\\odbcint.dll.mui","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%WINDIR%\\system32\\en-US\\MSVFW32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%WINDIR%\\system32\\en-US\\AVICAP32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%PROGRAMFILES%\\KMSPico 10.2.2 Final\\{9C48D902-47EA-E56E-7176-27D9B6B280F1}","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%PROGRAMFILES%\\KMSPico 10.2.2 Final\\setup.dat","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%PROGRAMFILES%\\KMSPico 10.2.2 Final\\17364e4224244e99f9f910bba12790ff.exe","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"path":"%TEMP%\\iiobhjkz.dat","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\BOLEMEKOF_IS1\\","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"key":"HKCU\\U\\","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\IETLD\\","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\BROWSEREMULATION\\","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\REGFILESHASH\\REGFILESHASH","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\REGFILES0000\\REGFILES0000","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\ci600308906","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"ci600308906","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"Local\\c:!users!crg1exe!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"Local\\c:!users!crg1exe!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"Local\\c:!users!crg1exe!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"Local\\c:!users!crg1exe!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!crg1exe!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!crg1exe!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!crg1exe!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!crg1exe!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5991c00c7ca3e11f9010fb18"}]}]}},"report_ids":{"sandbox_job_ids":["5991c00c7ca3e11f9010fb18"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Dropper.Application.Agent Sample c8757a2fe219… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c8757a2fe219…. Malware family: Dropper.Application.Agent. Threat score 100/100. 12/26 AV engines flagged this file. 15 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c8757a2fe21956623b339c1863e6481405326e9f8771f3aea6c250f7180842e5"}],["$","meta","4",{"property":"og:title","content":"Malicious Dropper.Application.Agent Sample c8757a2fe219… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c8757a2fe219…. Malware family: Dropper.Application.Agent. Threat score 100/100. 12/26 AV engines flagged this file. 15 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c8757a2fe21956623b339c1863e6481405326e9f8771f3aea6c250f7180842e5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Dropper.Application.Agent Sample c8757a2fe219… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c8757a2fe219…. Malware family: Dropper.Application.Agent. Threat score 100/100. 12/26 AV engines flagged this file. 15 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L39","11",{}]]