24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T482,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample ce585d3c6964… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample ce585d3c6964…. Malware family: Trojan.Generic. Threat score 85/100. 21/28 AV engines flagged this file. 9 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ce585d3c69640b084f4c0869be2f8fbbe86574e3f73c2f73da8f71cf3c3146ab","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","ce585d3c69640b084f4c0869be2f8fbbe86574e3f73c2f73da8f71cf3c3146ab"],"about":{"@type":"SoftwareApplication","name":"mppy-2.exe","applicationCategory":["peexe","executable"],"identifier":"ce585d3c69640b084f4c0869be2f8fbbe86574e3f73c2f73da8f71cf3c3146ab","additionalType":"Malicious sample"},"threatScore":85,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":21,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T572,"" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461, Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461, Subtree: 1) "" monitors "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 268435461, Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461, Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 268435461, Subtree: 1) "" monitors "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461, Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461, Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 268435461, Subtree: 1) "" monitors "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461, Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461, Subtree: 1)26:T5f7,"" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES")27:T5b8,"" wrote bytes "305D9D7560689D7570459C75" to virtual address "0x76A87008" (part of module "SHELL32.DLL") "" wrote bytes "80447275D0D87175" to virtual address "0x7541D094" (part of module "KERNELBASE.DLL") "" wrote bytes "7046247520152475" to virtual address "0x76A874E4" (part of module "SHELL32.DLL") "" wrote bytes "B0399E77" to virtual address "0x707F218C" (part of module "WINHTTP.DLL") "" wrote bytes "001BC274901EC2747023C274A027C274B028C2743026C2740025C274C0B8C274" to virtual address "0x755F7000" (part of module "WINTRUST.DLL") "" wrote bytes "F02E9D77307B9D77A0789D77" to virtual address "0x7524C008" (part of module "PROFAPI.DLL") "" wrote bytes "20152475F0472475" to virtual address "0x75516194" (part of module "CRYPT32.DLL") "" wrote bytes "207F7476D0A82C7610BF41765005417650FC4C7680104C76806F407680B62C7680B83C76E0CF4D7620033476B0FB4C76E0C79B7690A32C76" to virtual address "0x7541D1E8" (part of module "KERNELBASE.DLL") "" wrote bytes "20356A74809A6A7430856A74B0896A7450C96A7490246A74A09C6A7470206A74B0C76A74107C6A7400CA6A7420CB6A7470386A74E07B6A7430826A7400CB6A7490C76A7410C86A7490C96A74B0C96A74907C6A7470C86A7490386A74" to virtual address "0x7541D15C" (part of module "KERNELBASE.DLL") "" wrote bytes "F02E9D77307B9D7750959D77A0789D77" to virtual address "0x76A873A4" (part of module "SHELL32.DLL")28:T44c,"" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS")29:Td58,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAmVSURBVFhH1Zf5V5NnFsf7l8w5M6OgAgqKolasHctUEJcKKGBQFJDVHbu4dVrbaq1bFQyyqIQgIiCigAjKoiwhEAgi+46ENewhhAT4zOOcerRzOl2m/aX3nJznPe9539zP93vvc/PknT9dVFRWcT87Ffm9JCIiZEhlUSSmyMlMz0FZrOCHx/74iLl1g9zMh5SVVtLZ3kPfzDAmvQkTU/SPjNHS3cPz6hoyHxUQIY/840BiYm6Qk1fKyy4NlW1abmfUcSoynx0ns3EKSMAhKJ7AzzP4QlqAPK+JhtoBND0a8gueEh934/eB3M96THtbB811Q1y5XsxHB7PYfkbNgbBO9t8e4fAtHaEJ4+yPHsT3aieup8vZ9Fku55IKqalvp6e1jbSMx/8fRK5CycBAL8kFrbidyMD7ajPBcf3sl4/xaewEh26Os082wv5EcZ2sxS9GR7DciI98AL9ztWw+nEpC7gv6+0bIzvyNEDm5OfT3D3M1RcH2kyr2xfZwImGCI7eM7LsxxrH4KQ4m6tgvmxJQwwTeNBJyXcfB+GH84ozsjjbifXEQ508LOS8road/gMycgl8H8TA7i97hDr6/WYbnKRUH4/rYG2nkY9kAh2VDBESPczhmnMgsPdXN05imp2nvn+Vp57QoxQghsQaCwg1IokbwiRrF9ZiK7+VFaHq1ZNy/8/MQ8dHJtDbUcSezgc1HiwmQ9wplotbSQUIjhMooPXuitWi6pzHMTqGfMWCcmsE4bcKgN1DbM8temR7/yD58w7T4XOvHP3yETYeLSH7QQEtTDVej4/43RFGWAqW6D8fDDwiK6iAkZpj9UQYOyIdEGcS1fJj4x1NMGycZG51AO2JgRKdnZGISjX6SyWkjyhYjkrBRdl7rFY05gkTay66vunAKvkdpTRuFhXk/DSCLv41G08bXcdm4naohSCqShg9xRNpDYJT4kgg9PpFDTBmNTExPoh0XIDOzdA2KdXqKyXEDw6IcRuMUOy8N4nmlg12iD/ZcGsYjbJgNR0r56uoTOrvaiIn9iTnxMPM+itImHHzTCLrQyeHzWgKk3YTGjLAjfJwQ6QB7hCMzQuWgUD06OUVOxaxINow0XceQcEU7Ni1gZvksZhKPU1q2XBZ9cEaDy3dDeJ3UiJkhp7DpJakPsn8MoKhUUlZViSxFiePxEg5d6cbnew2BYm/7nB1gd6QWL6HG76IWk1A9NKJn2GjgQnwfXt+8pKBmEt3IDAadmIsmvYAVZfyiDZeT3XicH8D1bC+OZ16y9sBj5LIiVGUqlCXKNxAZaSm8qGvm+OfpeH5bwd6LvQRLNQRc7mXH+ZeimQYIiuxC8rUW7wv9XLyr5fNYPa6fdbH9m0ZMkyZ0YzomdKIUUyZsQpv5x8F6Vh/qwD60B6fQLjac6MZ5bymhZ+5R39ZCZsZb21KWGC/qr8Er6Ca7TrcRKNQGn9Pif6aNXd9p8DjdLu5rcD/TzdqTHawI6MQuoAPnL5tFH0wzIRqyz2RkfEzP0WtabINe8m5QD+/ubcV2XyP2h1pY4dvOSv9aJEei0fb0kBSb+gYgIjqW4c5RHLeG4/5lK+4Xm9lzvg/vbxuRCHLJV22sOdiBXVA7q0IbWBZcz8qQFrKrppgxiH4wTGI0TPO8doJFhxqxO9DG6r01vOvXyqpD3awJbMHevxX7fbXYeoeLOTPAtUjZG4CYqDi6tUOs2haN5NsevI+1IznTgeRoP2tC21l28AV2wVUs3d3FqpBGFnk3svlkIxP6KXQTJowzOpT109gf6GTl3gaW+KtZ6tcgHBDKdzaL62aW+1Vjt6eeVZvD6BhsIU761g9VQko8jS0aXAPi8DjeyLbj7WJt4r3gJux8xGd3M0v81NjsasNyV4W4X0tkco/o+EnG9XrGBnVs/LgBu8Amlmx/wVLfBuwFiKVwYLFElCCgStxv4T1/JW5BMloHWoi/k/YG4FHmI2orGgk5dR2HPTls+biOZb61WHvVYePdjJ2knoV71CzyFCp8Xln7nOaOcQyGKTEFp6nvMQp1TazyVWHjX88ybzXv+qhZ5ikS71az3LsMa59a7HY8Y98niVRXV5GRnfMGoKiomALFM6Llj1i7LRWL3QoWeVVhtV3Y7lPFQrdXL1divaOC5Z6l2PrVoe4U9pte7XsdJUodS7xesHh7PRY7awR4BUu8G1jhUc9ySS3z3MW7Hi1Yud8i/EYRT/KeiYNN6RuAV5F2P4XHRTVYbJZiIV5Y6lbG0q2NmHsI1ZIqFnioWOxRgaWriuUfqXkvsIFrd7u5ck/sDlGu+Z4vhM1q5knE6lLJYrdSFnpWYCtgFrkXsdBLgH8YSV6+mnupb6l/HTGyWGpr1Rz9IgnbDanYuilZuqEcGxeVABEuuNcLZUrhgkooqWRKzH+92AGmWSMjoya8Q0VzupRh5VLBQuGE1Y4q5goIa3cl8yVKFrhkcOp0CuUvagkXTf9D2h/H3fRM0h8pWLb2Iou25TLXXYH1VlEOpyLmOFayYIsCy20KlripEBOHKYMYPkYTwwMmfD9twmprNTabFZi7qlnsUiJAVMzfKKC3PsRu/WUeZZeTnv/sp5O/Cqn0Gq/GcsTlbKwdpJg7F2O2rgIr5yLmO+Zjs6lU2FuMpVses7OzYgbMMi0G0NioQZwRWwSoSLqpnAWuYt2qZNm6Msw3qLB2DCPiykMK1SoiIn/hnJgsj6e6Rs2hcw+wXn8T83U5/M1JWOikwMqpGPMPy5i3oYj8/AGaOiZobholM2/gP+Wy2pSL5aZnmG969fxTzJzz+fvGJD45dovyskYSMxJ/PvnrSE9PQVVUy8mvbzLH4aponmwWiKRmawqwdH7K3HV5zFufh9kHJVh8IO5vfMJihwJsNhYwx6kMsy3i4/AEi39Gc/RfQpDiOekPHv265K8jI+sBarWasIvZmK2+ypwP7vKXdYVYrM9njrMCs49ymLs6j/mbSzB3eIqFg1jXKbARzyxYLeOva89yXppFVV0TqWl3f1vy15F4N5lKRQFpyUqOHruBrf0lFjnIsLRPYM77GVisSWe+sNnKMQNLpyTM1oZhtvISB45Fk5BZSZGYLXfSf+Ec+EshjYzhYVoupaVq7qc/48L5NHb4RfH+tnBWvH+C+WuPsdHjNO4hEVw+e4+MzBIU5cVkpiYRdzPm9yV/O6SR10m4d4eH2QUoVGWoG2torq+mpaqN+ppWSssVZD0uJD7rPmHX/sC/Zv8dTwsVYlZkIU+UcyU2gsjYOG4n3SFPHOnKa9465fw54p13/g033Nlk/FtCXQAAAABJRU5ErkJggg==2a:Td58,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAmVSURBVFhH1Zf5V5NnFsf7l8w5M6OgAgqKolasHctUEJcKKGBQFJDVHbu4dVrbaq1bFQyyqIQgIiCigAjKoiwhEAgi+46ENewhhAT4zOOcerRzOl2m/aX3nJznPe9539zP93vvc/PknT9dVFRWcT87Ffm9JCIiZEhlUSSmyMlMz0FZrOCHx/74iLl1g9zMh5SVVtLZ3kPfzDAmvQkTU/SPjNHS3cPz6hoyHxUQIY/840BiYm6Qk1fKyy4NlW1abmfUcSoynx0ns3EKSMAhKJ7AzzP4QlqAPK+JhtoBND0a8gueEh934/eB3M96THtbB811Q1y5XsxHB7PYfkbNgbBO9t8e4fAtHaEJ4+yPHsT3aieup8vZ9Fku55IKqalvp6e1jbSMx/8fRK5CycBAL8kFrbidyMD7ajPBcf3sl4/xaewEh26Os082wv5EcZ2sxS9GR7DciI98AL9ztWw+nEpC7gv6+0bIzvyNEDm5OfT3D3M1RcH2kyr2xfZwImGCI7eM7LsxxrH4KQ4m6tgvmxJQwwTeNBJyXcfB+GH84ozsjjbifXEQ508LOS8road/gMycgl8H8TA7i97hDr6/WYbnKRUH4/rYG2nkY9kAh2VDBESPczhmnMgsPdXN05imp2nvn+Vp57QoxQghsQaCwg1IokbwiRrF9ZiK7+VFaHq1ZNy/8/MQ8dHJtDbUcSezgc1HiwmQ9wplotbSQUIjhMooPXuitWi6pzHMTqGfMWCcmsE4bcKgN1DbM8temR7/yD58w7T4XOvHP3yETYeLSH7QQEtTDVej4/43RFGWAqW6D8fDDwiK6iAkZpj9UQYOyIdEGcS1fJj4x1NMGycZG51AO2JgRKdnZGISjX6SyWkjyhYjkrBRdl7rFY05gkTay66vunAKvkdpTRuFhXk/DSCLv41G08bXcdm4naohSCqShg9xRNpDYJT4kgg9PpFDTBmNTExPoh0XIDOzdA2KdXqKyXEDw6IcRuMUOy8N4nmlg12iD/ZcGsYjbJgNR0r56uoTOrvaiIn9iTnxMPM+itImHHzTCLrQyeHzWgKk3YTGjLAjfJwQ6QB7hCMzQuWgUD06OUVOxaxINow0XceQcEU7Ni1gZvksZhKPU1q2XBZ9cEaDy3dDeJ3UiJkhp7DpJakPsn8MoKhUUlZViSxFiePxEg5d6cbnew2BYm/7nB1gd6QWL6HG76IWk1A9NKJn2GjgQnwfXt+8pKBmEt3IDAadmIsmvYAVZfyiDZeT3XicH8D1bC+OZ16y9sBj5LIiVGUqlCXKNxAZaSm8qGvm+OfpeH5bwd6LvQRLNQRc7mXH+ZeimQYIiuxC8rUW7wv9XLyr5fNYPa6fdbH9m0ZMkyZ0YzomdKIUUyZsQpv5x8F6Vh/qwD60B6fQLjac6MZ5bymhZ+5R39ZCZsZb21KWGC/qr8Er6Ca7TrcRKNQGn9Pif6aNXd9p8DjdLu5rcD/TzdqTHawI6MQuoAPnL5tFH0wzIRqyz2RkfEzP0WtabINe8m5QD+/ubcV2XyP2h1pY4dvOSv9aJEei0fb0kBSb+gYgIjqW4c5RHLeG4/5lK+4Xm9lzvg/vbxuRCHLJV22sOdiBXVA7q0IbWBZcz8qQFrKrppgxiH4wTGI0TPO8doJFhxqxO9DG6r01vOvXyqpD3awJbMHevxX7fbXYeoeLOTPAtUjZG4CYqDi6tUOs2haN5NsevI+1IznTgeRoP2tC21l28AV2wVUs3d3FqpBGFnk3svlkIxP6KXQTJowzOpT109gf6GTl3gaW+KtZ6tcgHBDKdzaL62aW+1Vjt6eeVZvD6BhsIU761g9VQko8jS0aXAPi8DjeyLbj7WJt4r3gJux8xGd3M0v81NjsasNyV4W4X0tkco/o+EnG9XrGBnVs/LgBu8Amlmx/wVLfBuwFiKVwYLFElCCgStxv4T1/JW5BMloHWoi/k/YG4FHmI2orGgk5dR2HPTls+biOZb61WHvVYePdjJ2knoV71CzyFCp8Xln7nOaOcQyGKTEFp6nvMQp1TazyVWHjX88ybzXv+qhZ5ikS71az3LsMa59a7HY8Y98niVRXV5GRnfMGoKiomALFM6Llj1i7LRWL3QoWeVVhtV3Y7lPFQrdXL1divaOC5Z6l2PrVoe4U9pte7XsdJUodS7xesHh7PRY7awR4BUu8G1jhUc9ySS3z3MW7Hi1Yud8i/EYRT/KeiYNN6RuAV5F2P4XHRTVYbJZiIV5Y6lbG0q2NmHsI1ZIqFnioWOxRgaWriuUfqXkvsIFrd7u5ck/sDlGu+Z4vhM1q5knE6lLJYrdSFnpWYCtgFrkXsdBLgH8YSV6+mnupb6l/HTGyWGpr1Rz9IgnbDanYuilZuqEcGxeVABEuuNcLZUrhgkooqWRKzH+92AGmWSMjoya8Q0VzupRh5VLBQuGE1Y4q5goIa3cl8yVKFrhkcOp0CuUvagkXTf9D2h/H3fRM0h8pWLb2Iou25TLXXYH1VlEOpyLmOFayYIsCy20KlripEBOHKYMYPkYTwwMmfD9twmprNTabFZi7qlnsUiJAVMzfKKC3PsRu/WUeZZeTnv/sp5O/Cqn0Gq/GcsTlbKwdpJg7F2O2rgIr5yLmO+Zjs6lU2FuMpVses7OzYgbMMi0G0NioQZwRWwSoSLqpnAWuYt2qZNm6Msw3qLB2DCPiykMK1SoiIn/hnJgsj6e6Rs2hcw+wXn8T83U5/M1JWOikwMqpGPMPy5i3oYj8/AGaOiZobholM2/gP+Wy2pSL5aZnmG969fxTzJzz+fvGJD45dovyskYSMxJ/PvnrSE9PQVVUy8mvbzLH4aponmwWiKRmawqwdH7K3HV5zFufh9kHJVh8IO5vfMJihwJsNhYwx6kMsy3i4/AEi39Gc/RfQpDiOekPHv265K8jI+sBarWasIvZmK2+ypwP7vKXdYVYrM9njrMCs49ymLs6j/mbSzB3eIqFg1jXKbARzyxYLeOva89yXppFVV0TqWl3f1vy15F4N5lKRQFpyUqOHruBrf0lFjnIsLRPYM77GVisSWe+sNnKMQNLpyTM1oZhtvISB45Fk5BZSZGYLXfSf+Ec+EshjYzhYVoupaVq7qc/48L5NHb4RfH+tnBWvH+C+WuPsdHjNO4hEVw+e4+MzBIU5cVkpiYRdzPm9yV/O6SR10m4d4eH2QUoVGWoG2torq+mpaqN+ppWSssVZD0uJD7rPmHX/sC/Zv8dTwsVYlZkIU+UcyU2gsjYOG4n3SFPHOnKa9465fw54p13/g033Nlk/FtCXQAAAABJRU5ErkJggg==2b:Td58,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAmVSURBVFhH1Zf5V5NnFsf7l8w5M6OgAgqKolasHctUEJcKKGBQFJDVHbu4dVrbaq1bFQyyqIQgIiCigAjKoiwhEAgi+46ENewhhAT4zOOcerRzOl2m/aX3nJznPe9539zP93vvc/PknT9dVFRWcT87Ffm9JCIiZEhlUSSmyMlMz0FZrOCHx/74iLl1g9zMh5SVVtLZ3kPfzDAmvQkTU/SPjNHS3cPz6hoyHxUQIY/840BiYm6Qk1fKyy4NlW1abmfUcSoynx0ns3EKSMAhKJ7AzzP4QlqAPK+JhtoBND0a8gueEh934/eB3M96THtbB811Q1y5XsxHB7PYfkbNgbBO9t8e4fAtHaEJ4+yPHsT3aieup8vZ9Fku55IKqalvp6e1jbSMx/8fRK5CycBAL8kFrbidyMD7ajPBcf3sl4/xaewEh26Os082wv5EcZ2sxS9GR7DciI98AL9ztWw+nEpC7gv6+0bIzvyNEDm5OfT3D3M1RcH2kyr2xfZwImGCI7eM7LsxxrH4KQ4m6tgvmxJQwwTeNBJyXcfB+GH84ozsjjbifXEQ508LOS8road/gMycgl8H8TA7i97hDr6/WYbnKRUH4/rYG2nkY9kAh2VDBESPczhmnMgsPdXN05imp2nvn+Vp57QoxQghsQaCwg1IokbwiRrF9ZiK7+VFaHq1ZNy/8/MQ8dHJtDbUcSezgc1HiwmQ9wplotbSQUIjhMooPXuitWi6pzHMTqGfMWCcmsE4bcKgN1DbM8temR7/yD58w7T4XOvHP3yETYeLSH7QQEtTDVej4/43RFGWAqW6D8fDDwiK6iAkZpj9UQYOyIdEGcS1fJj4x1NMGycZG51AO2JgRKdnZGISjX6SyWkjyhYjkrBRdl7rFY05gkTay66vunAKvkdpTRuFhXk/DSCLv41G08bXcdm4naohSCqShg9xRNpDYJT4kgg9PpFDTBmNTExPoh0XIDOzdA2KdXqKyXEDw6IcRuMUOy8N4nmlg12iD/ZcGsYjbJgNR0r56uoTOrvaiIn9iTnxMPM+itImHHzTCLrQyeHzWgKk3YTGjLAjfJwQ6QB7hCMzQuWgUD06OUVOxaxINow0XceQcEU7Ni1gZvksZhKPU1q2XBZ9cEaDy3dDeJ3UiJkhp7DpJakPsn8MoKhUUlZViSxFiePxEg5d6cbnew2BYm/7nB1gd6QWL6HG76IWk1A9NKJn2GjgQnwfXt+8pKBmEt3IDAadmIsmvYAVZfyiDZeT3XicH8D1bC+OZ16y9sBj5LIiVGUqlCXKNxAZaSm8qGvm+OfpeH5bwd6LvQRLNQRc7mXH+ZeimQYIiuxC8rUW7wv9XLyr5fNYPa6fdbH9m0ZMkyZ0YzomdKIUUyZsQpv5x8F6Vh/qwD60B6fQLjac6MZ5bymhZ+5R39ZCZsZb21KWGC/qr8Er6Ca7TrcRKNQGn9Pif6aNXd9p8DjdLu5rcD/TzdqTHawI6MQuoAPnL5tFH0wzIRqyz2RkfEzP0WtabINe8m5QD+/ubcV2XyP2h1pY4dvOSv9aJEei0fb0kBSb+gYgIjqW4c5RHLeG4/5lK+4Xm9lzvg/vbxuRCHLJV22sOdiBXVA7q0IbWBZcz8qQFrKrppgxiH4wTGI0TPO8doJFhxqxO9DG6r01vOvXyqpD3awJbMHevxX7fbXYeoeLOTPAtUjZG4CYqDi6tUOs2haN5NsevI+1IznTgeRoP2tC21l28AV2wVUs3d3FqpBGFnk3svlkIxP6KXQTJowzOpT109gf6GTl3gaW+KtZ6tcgHBDKdzaL62aW+1Vjt6eeVZvD6BhsIU761g9VQko8jS0aXAPi8DjeyLbj7WJt4r3gJux8xGd3M0v81NjsasNyV4W4X0tkco/o+EnG9XrGBnVs/LgBu8Amlmx/wVLfBuwFiKVwYLFElCCgStxv4T1/JW5BMloHWoi/k/YG4FHmI2orGgk5dR2HPTls+biOZb61WHvVYePdjJ2knoV71CzyFCp8Xln7nOaOcQyGKTEFp6nvMQp1TazyVWHjX88ybzXv+qhZ5ikS71az3LsMa59a7HY8Y98niVRXV5GRnfMGoKiomALFM6Llj1i7LRWL3QoWeVVhtV3Y7lPFQrdXL1divaOC5Z6l2PrVoe4U9pte7XsdJUodS7xesHh7PRY7awR4BUu8G1jhUc9ySS3z3MW7Hi1Yud8i/EYRT/KeiYNN6RuAV5F2P4XHRTVYbJZiIV5Y6lbG0q2NmHsI1ZIqFnioWOxRgaWriuUfqXkvsIFrd7u5ck/sDlGu+Z4vhM1q5knE6lLJYrdSFnpWYCtgFrkXsdBLgH8YSV6+mnupb6l/HTGyWGpr1Rz9IgnbDanYuilZuqEcGxeVABEuuNcLZUrhgkooqWRKzH+92AGmWSMjoya8Q0VzupRh5VLBQuGE1Y4q5goIa3cl8yVKFrhkcOp0CuUvagkXTf9D2h/H3fRM0h8pWLb2Iou25TLXXYH1VlEOpyLmOFayYIsCy20KlripEBOHKYMYPkYTwwMmfD9twmprNTabFZi7qlnsUiJAVMzfKKC3PsRu/WUeZZeTnv/sp5O/Cqn0Gq/GcsTlbKwdpJg7F2O2rgIr5yLmO+Zjs6lU2FuMpVses7OzYgbMMi0G0NioQZwRWwSoSLqpnAWuYt2qZNm6Msw3qLB2DCPiykMK1SoiIn/hnJgsj6e6Rs2hcw+wXn8T83U5/M1JWOikwMqpGPMPy5i3oYj8/AGaOiZobholM2/gP+Wy2pSL5aZnmG969fxTzJzz+fvGJD45dovyskYSMxJ/PvnrSE9PQVVUy8mvbzLH4aponmwWiKRmawqwdH7K3HV5zFufh9kHJVh8IO5vfMJihwJsNhYwx6kMsy3i4/AEi39Gc/RfQpDiOekPHv265K8jI+sBarWasIvZmK2+ypwP7vKXdYVYrM9njrMCs49ymLs6j/mbSzB3eIqFg1jXKbARzyxYLeOva89yXppFVV0TqWl3f1vy15F4N5lKRQFpyUqOHruBrf0lFjnIsLRPYM77GVisSWe+sNnKMQNLpyTM1oZhtvISB45Fk5BZSZGYLXfSf+Ec+EshjYzhYVoupaVq7qc/48L5NHb4RfH+tnBWvH+C+WuPsdHjNO4hEVw+e4+MzBIU5cVkpiYRdzPm9yV/O6SR10m4d4eH2QUoVGWoG2torq+mpaqN+ppWSssVZD0uJD7rPmHX/sC/Zv8dTwsVYlZkIU+UcyU2gsjYOG4n3SFPHOnKa9465fw54p13/g033Nlk/FtCXQAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"ce585d3c69640b084f4c0869be2f8fbbe86574e3f73c2f73da8f71cf3c3146ab","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":85,"unified_at_epoch_ms":1790539125505,"unified_at":"2026-09-27T19:58:45.505Z","metadata":{"hashes":{"sha256":"ce585d3c69640b084f4c0869be2f8fbbe86574e3f73c2f73da8f71cf3c3146ab","sha1":"98434a079e12d48a94a094ef04b9f31b153852f6","md5":"74fca464697b5816acfe9140ee387ecd","sha512":"8e48a14b01e0aa72b25a1b2af7c66336d129728ea7e445a57ea95aa0393d4e5a67ff3434c26a2a9ca7524303fc06ff2f404fb9adfd0801289e9b31f724a6facf","ssdeep":"3072:dlHLFNuNLrSUkYSuS0G9YeKnvuGwODGfQq93g7mC7wCipC+fU/LEfwQC:dlHPuNXGnOpmC8PBUDgC","ssdeep_chunks":["3072:dlHLFNu","3072:lHLFNuN","3072:HLFNuNL","3072:LFNuNLr","3072:FNuNLrS","3072:NuNLrSU","3072:uNLrSUk","3072:NLrSUkY","3072:LrSUkYS","3072:rSUkYSu","3072:SUkYSuS","3072:UkYSuS0","3072:kYSuS0G","3072:YSuS0G9","3072:SuS0G9Y","3072:uS0G9Ye","3072:S0G9YeK","3072:0G9YeKn","3072:G9YeKnv","3072:9YeKnvu","3072:YeKnvuG","3072:eKnvuGw","3072:KnvuGwO","3072:nvuGwOD","3072:vuGwODG","3072:uGwODGf","3072:GwODGfQ","3072:wODGfQq","3072:ODGfQq9","3072:DGfQq93","3072:GfQq93g","3072:fQq93g7","3072:Qq93g7m","3072:q93g7mC","3072:93g7mC7","3072:3g7mC7w","3072:g7mC7wC","3072:7mC7wCi","3072:mC7wCip","3072:C7wCipC","3072:7wCipC+","3072:wCipC+f","3072:CipC+fU","3072:ipC+fU/","3072:pC+fU/L","3072:C+fU/LE","3072:+fU/LEf","3072:fU/LEfw","3072:U/LEfwQ","3072:/LEfwQC","6144:dlHLFNu","6144:lHLFNuN","6144:HLFNuNL","6144:LFNuNLr","6144:FNuNLrS","6144:NuNLrSU","6144:uNLrSUk","6144:NLrSUkY","6144:LrSUkYS","6144:rSUkYSu","6144:SUkYSuS","6144:UkYSuS0","6144:kYSuS0G","6144:YSuS0G9","6144:SuS0G9Y","6144:uS0G9Ye","6144:S0G9YeK","6144:0G9YeKn","6144:G9YeKnv","6144:9YeKnvu","6144:YeKnvuG","6144:eKnvuGw","6144:KnvuGwO","6144:nvuGwOD","6144:vuGwODG","6144:uGwODGf","6144:GwODGfQ","6144:wODGfQq","6144:ODGfQq9","6144:DGfQq93","6144:GfQq93g","6144:fQq93g7","6144:Qq93g7m","6144:q93g7mC","6144:93g7mC7","6144:3g7mC7w","6144:g7mC7wC","6144:7mC7wCi","6144:mC7wCip","6144:C7wCipC","6144:7wCipC+","6144:wCipC+f","6144:CipC+fU","6144:ipC+fU/","6144:pC+fU/L","6144:C+fU/LE","6144:+fU/LEf","6144:fU/LEfw","6144:U/LEfwQ","6144:/LEfwQC","3072:dlHPuNX","3072:lHPuNXG","3072:HPuNXGn","3072:PuNXGnO","3072:uNXGnOp","3072:NXGnOpm","3072:XGnOpmC","3072:GnOpmC8","3072:nOpmC8P","3072:OpmC8PB","3072:pmC8PBU","3072:mC8PBUD","3072:C8PBUDg","3072:8PBUDgC"],"imphash":"b45bc6a70612e4c96c158dcc57baa659"},"file_info":{"file_name":"mppy-2.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":214368,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499297769000,"last_seen":1677392511000,"last_multi_scan":1677392511000}},"detections":{"summary":{"verdict":"malicious","score":85,"tags":null},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":6,"suspicious_count":13,"malicious_count":9,"total":28},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Cridex","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Worm/Win32.Cridex","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.270175","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2590512","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.ZGXY-5065","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2590512 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Dridex.P trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Worm.Win32.Cridex.qtl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.xa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Cridex.efgrxs","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Dridex-FQ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Worm/W32.Cridex.214368","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TSPY_DRIDEX.XYU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TSPY_DRIDEX.XYU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.FMW","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Malware-Cryptor.Drixed","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Dridex.Win32.179","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"timeGetSystemTime@WINMM.dll at 36916-298-00409B4D\n timeGetSystemTime@WINMM.DLL at 00281781-00003860-49615-103-00409B4D\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00281781-00003860-55698-215-00408EAF","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"85.25.199.246:543\"\n \"65.55.252.43:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys","description":"RegisterHotKey@USER32.dll at 36916-221-00402A7E\n RegisterHotKey@USER32.dll at 36916-345-0040DEDB\n RegisterHotKey@USER32.dll at 36916-283-004085B8\n RegisterHotKey@USER32.DLL at 00281781-00003860-49615-28-00402A7E\n RegisterHotKey@USER32.DLL at 00281781-00003860-49615-88-004085B8\n RegisterHotKey@USER32.DLL at 00281781-00003860-49615-150-0040DEDB","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-15","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Global\\2d8add534d493db59d1e7081f0bdf538\"\n \"Global\\dfc056cf7f3802738d85c6db691985bc\"\n \"Global\\872812cf4fbc6000ae6b918467ab144b\"\n \"Global\\d7f675de1a5e334bccddbbbf7d8aa856\"\n \"Global\\753310ad3064c440e9bce7921ba91672\"\n \"Global\\9488692beb9575ce493b9fbed252cf38\"\n \"Global\\6a3e567dcd4fd0541a5987418fc89c54\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"C:\\WINDOWS\\SYSTEM32\\NCRYPTSSLP.DLL\" at base 72480000\n \"\" loaded module \"C:\\WINDOWS\\SYSTEM32\\RSAENH.DLL\" at base 748B0000\n \"\" loaded module \"PSAPI.DLL\" at base 75D30000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"LookupAccountNameW@ADVAPI32.dll at 36916-303-0040A2AB\n LookupAccountNameW@ADVAPI32.DLL at 00281781-00003860-49615-108-0040A2AB","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"\" queried SystemProcessInformation at 00281781-00003860-77A8A1F0-297436\n \"\" queried SystemProcessInformation at 00281781-00003860-77A8A1F0-297503\n \"\" queried SystemProcessInformation at 00281781-00003860-77A8A1F0-297520\n \"\" queried SystemProcessInformation at 00281781-00003860-77A8A1F0-297645\n \"\" queried SystemProcessInformation at 00281781-00003860-77A8A1F0-297774\n \"\" queried SystemProcessInformation at 00281781-00003860-77A8A1F0-297826\n \"\" queried SystemProcessInformation at 00281781-00003860-77A8A1F0-297879\n \"\" queried SystemProcessInformation at 00281781-00003860-77A8A1F0-297933\n \"\" queried SystemProcessInformation at 00281781-00003860-77A8A1F0-297988\n \"\" queried SystemProcessInformation at 00281781-00003860-77A8A1F0-298044","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to block user input","description":"BlockInput@USER32.DLL at 00281781-00003860-49615-23-00401EAD\n BlockInput@USER32.DLL at 00281781-00003860-49615-113-0040D2E1","origin":"Hybrid Analysis Technology","relevance":7,"id":"stream-26","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")\n \"taskhostex.exe\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\", Key: \"INSTALLDATE\")\n \"taskhostex.exe\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\", Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.dll at 36916-207-0040195D\n InternetReadFileExW@WININET.dll at 36916-222-00402AC8\n InternetReadFileExW@WININET.dll at 36916-346-0040E245\n InternetReadFile@WININET.DLL at 00281781-00003860-49615-14-0040195D\n InternetReadFileExW@WININET.DLL at 00281781-00003860-49615-29-00402AC8\n InternetReadFileExW@WININET.DLL at 00281781-00003860-49615-151-0040E245","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"$25","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-3415856703-3035846784-2657674405-1001\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00281781-00003860-55698-76-00407C0B\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00281781-00003860-55698-100-00407E06\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00281781-00003860-55698-68-004015C8","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetKeyboardState@USER32.dll at 36916-317-0040B65C\n GetAsyncKeyState@USER32.dll at 36916-968-0040E3ED\n GetAsyncKeyState@USER32.dll at 36916-289-00408B35\n GetAsyncKeyState@USER32.DLL at 00281781-00003860-49615-94-00408B35\n GetKeyboardState@USER32.DLL at 00281781-00003860-49615-122-0040B65C\n GetAsyncKeyState@USER32.DLL at 00281781-00003860-49615-283-0040E3ED","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"suspicious","category":"System Security","name":"Alters Software Policy Settings","description":"$26","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-3415856703-3035846784-2657674405-1001\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-3415856703-3035846784-2657674405-1001\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-3415856703-3035846784-2657674405-1001\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-3415856703-3035846784-2657674405-1001\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\", Value: \"01000000\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CreateProcessAsUserA\n RegCreateKeyExA\n RegEnumKeyExW\n RegDeleteKeyW\n StartServiceA\n RegCloseKey\n OpenProcessToken\n CreateServiceA\n LookupAccountNameW\n RegEnumKeyA\n RegOpenKeyW\n RegCreateKeyA\n RegOpenKeyExW\n StartServiceCtrlDispatcherA\n RegCreateKeyExW\n CreateFileA\n GetModuleHandleA\n GetStartupInfoA\n GetUrlCacheEntryInfoExA\n InternetReadFile\n InternetOpenW\n InternetQueryOptionW\n InternetCrackUrlW\n InternetReadFileExW\n HttpSendRequestW\n InternetOpenA\n InternetQueryDataAvailable\n InternetOpenUrlA\n HttpSendRequestA\n GetUrlCacheEntryInfoA\n HttpQueryInfoA\n InternetConnectW\n InternetQueryOptionA\n GetUrlCacheEntryInfoExW\n InternetCloseHandle\n InternetCrackUrlA\n GetUrlCacheEntryInfoW\n InternetConnectA\n GetUpdateRgn\n SetKeyboardState\n SetWindowsHookExW\n SetWindowsHookExA\n FindWindowA\n SetWindowsHookA\n FindWindowExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$27","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"malicious","category":"Environment Awareness","name":"Contains ability to check the local/global descriptor table","description":"sldt word ptr [edi+1bc323f1h] at 36916-940-00409898\n sldt word ptr [edi+1bc323f1h] at 00281781-00003860-49615-255-00409898","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-25","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"malicious","category":"General","name":"Sample was identified as malicious by at least one Antivirus engine","description":"31/56 Antivirus vendors marked sample as malicious (55% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00004695 bytes of memory in \"explorer.exe\" (Protection: \"execute/read/write\")\n \"\" allocated 00303616 bytes of memory in \"explorer.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"Explorer.EXE\" (UID: 00297500-00001364)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 303616 bytes to a foreign process \"explorer.exe\" (PID: 00001364)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"malicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 65.55.252.43 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":7,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop","description":"CreateWindowStationA@USER32.dll at 36916-262-00406143\n SwitchDesktop@USER32.dll at 36916-345-0040DEDB\n CreateWindowStationA@USER32.DLL at 00281781-00003860-49615-68-00406143\n SwitchDesktop@USER32.DLL at 00281781-00003860-49615-150-0040DEDB","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-8","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"malicious","category":"System Security","name":"Alters System Certificates Settings","description":"$28","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDialogWndProc_A@NTDLL.DLL at 00281781-00003860-49615-23-00401EAD\n NtdllDialogWndProc_W@NTDLL.DLL at 00281781-00003860-49615-257-00409CF7\n NtdllDialogWndProc_A@NTDLL.DLL at 00281781-00003860-49615-84-00407BF5\n NtdllDialogWndProc_W@NTDLL.DLL at 00281781-00003860-49615-46-00404317","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Contains ability to create/switch the desktop"}],"sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":27,"imported_dlls_count":253,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":14,"files_deleted_count":0,"registry_keys_created_count":123,"registry_keys_modified_count":0,"registry_keys_deleted_count":3,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":126,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"55b3c7610e316d01260ac325","environment_id":3,"environment_description":"Windows 8.1 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":85,"malware_family":"Trojan.GenericKD","contacted_countries":["DEU","USA"],"submit_name":"1.exe","analysis_start_time":"2015-07-25T12:41:12+00:00","indicators_count":{"informative":6,"suspicious":13,"malicious":12},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"55b15ef20e316dc04442388e","environment_id":5,"environment_description":"W7 32 bit 'Stealthy Mode' with 'DNS Spoof'","state":"SUCCESS","verdict":"malicious","threat_score":81,"malware_family":"Trojan.GenericKD","contacted_countries":["DEU","FRA","RUS"],"submit_name":"mppy.exe","analysis_start_time":"2015-07-23T16:39:12+00:00","indicators_count":{"informative":9,"suspicious":21,"malicious":10},"tags":["Network Traffic","Extracted Files","Simulated analysis"],"is_in_unified_schema":true},{"id":"55b0df150e316dd2797efa7a","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":85,"malware_family":"UDS:DangerousObject.Multi","contacted_countries":["DEU","RUS"],"submit_name":"mppy-2.exe","analysis_start_time":"2015-07-23T08:10:45+00:00","indicators_count":{"informative":9,"suspicious":24,"malicious":15},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"85.25.199.246","port":543,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"address":"65.55.252.43","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}],"processes":[{"pid":3860,"ppid":0,"name":"ce585d3c69640b084f4c0869be2f8fbbe86574e3f73c2f73da8f71cf3c3146ab","command_line":"","normalized_path":"","uid":"00281781-00003860","icon":"$29"},{"pid":1364,"ppid":0,"name":"Explorer.EXE","command_line":"","normalized_path":"","uid":"00297500-00001364","icon":"$2a"},{"pid":1020,"ppid":0,"name":"taskhostex.exe","command_line":"","normalized_path":"","uid":"00317718-00001020","icon":"$2b"}],"all_imported_dlls":["globinputhost.dll","Windows.Globalization.dll","user32.dll","DEVOBJ.dll","Bcp47Langs.dll","WINSTA.dll","Windows.Security.Authentication.OnlineId.dll","LINKINFO.dll","WSClient.dll","twinui.dll","schannel.DLL","WINMMBASE.dll","KERNELBASE.dll","Windows.UI.Search.dll","windowscodecs.dll","davclnt.dll","DPAPI.DLL","wlidprov.dll","ole32.dll","WorkFoldersShell.dll","SETUPAPI.dll","OLEAUT32.dll","SYNCENG.dll","wbemcomn.dll","tquery.dll","browcli.dll","gameux.dll","clbcatq.dll","MSACM32.dll","Msi.dll","WSShared.dll","NTASN1.dll","DAVHLPR.dll","dwmapi.dll","DNSAPI.dll","rasadhlp.dll","explorerframe.dll","wpdshserviceobj.dll","srvcli.dll","searchfolder.dll","RASAPI32.dll","MSASN1.dll","UIAnimation.dll","prnfldr.dll","UIRibbonRes.dll","MsftEdit.dll","AuthBroker.dll","stobject.dll","winhttp.dll","Windows.UI.Xaml.dll","wpncore.dll","CRYPTSP.dll","SqmApi.dll","WTSAPI32.dll","NSI.dll","iertutil.dll","Windows.UI.dll","InputSwitch.dll","mssprxy.dll","wercplsupport.dll","SAMLIB.dll","AVRT.dll","MsCtfMonitor.dll","imapi2.dll","ntlanman.dll","OLEACC.dll","Windows.Networking.Connectivity.dll","POWRPROF.dll","IPHLPAPI.DLL","cscapi.dll","ElsLad.dll","tiptsf.dll","NETMSG.DLL","D3D10Warp.dll","SettingSync.dll","AUDIOSES.DLL","CHARTV.dll","Syncreg.dll","StructuredQuery.dll","profapi.dll","syncui.dll","dfscli.dll","windows.immersiveshell.serviceprovider.dll","msiltcfg.dll","uxtheme.dll","SspiCli.dll","ntmarta.dll","UIAutomationCore.DLL","twinui.appcore.dll","dxp.dll","SHELL32.dll","USER32.dll","PackageStateRoaming.dll","WS2_32.dll","PSAPI.DLL","nlaapi.dll","msi.dll","bcrypt.dll","msxml6.dll","zipfldr.dll","ntshrui.dll","HID.DLL","DevDispItemProvider.dll","ncrypt.dll","MMDevApi.dll","netprofm.dll","PlaySndSrv.dll","apphelp.dll","ntdll.dll","Actioncenter.dll","ATL.DLL","WININET.dll","fdwcn.dll","NetworkExplorer.dll","VBoxMRXNP.dll","RPCRT4.dll","SLC.dll","USERENV.dll","ondemandconnroutehelper.dll","IMM32.DLL","BatMeter.dll","MSIMG32.dll","wkscli.dll","wwanapi.dll","dwrite.dll","FirewallAPI.dll","wincorlib.DLL","UxTheme.dll","SETTINGSYNCPOLICY.dll","ESENT.dll","VERSION.dll","mswsock.dll","wwapi.dll","dhcpcsvc6.DLL","pnidui.dll","taskschd.dll","IDStore.dll","PortableDeviceApi.dll","SettingSyncCore.dll","TWINAPI.dll","WinTypes.dll","PortableDeviceTypes.dll","SHLWAPI.dll","WSCAPI.dll","werconcpl.dll","framedynos.dll","SndVolSSO.DLL","WLDP.DLL","wevtapi.dll","gdiplus.dll","profext.dll","actxprxy.dll","dcomp.dll","XmlLite.dll","NInput.dll","hcproviders.dll","fastprox.dll","rasman.dll","d2d1.dll","authui.dll","SyncCenter.dll","ADVAPI32.dll","MSVCRT.dll","samcli.dll","MSCTF.dll","hgcpl.dll","wbemsvc.dll","msvcrt.dll","DUser.dll","twinapi.appcore.dll","CRYPTBASE.dll","FunDisc.dll","PROPSYS.dll","msauserext.dll","provsvc.dll","sqmapi.dll","MSUTB.dll","CRYPT32.dll","EhStorShell.dll","es.dll","shcore.dll","rsaenh.dll","midimap.dll","BluetoothApis.dll","sxs.dll","SHCORE.dll","MLANG.dll","fdWNet.dll","SettingMonitor.dll","cfgmgr32.dll","EhStorAPI.dll","IconCodecService.dll","SHDOCVW.dll","dxgi.dll","wer.dll","fwpuclnt.dll","combase.dll","PhotoMetadataHandler.dll","lockscreencn.dll","sechost.dll","Comctl32.dll","ieframe.dll","WINMM.dll","npmproxy.dll","elscore.dll","dlnashext.dll","GDI32.dll","Secur32.dll","IMM32.dll","wscinterop.dll","fdproxy.dll","ksuser.dll","WINNSI.DLL","ieproxy.dll","thumbcache.dll","Windows.UI.Immersive.dll","wininet.dll","TimeBrokerClient.dll","MPR.dll","KERNEL32.DLL","WINTRUST.dll","ncryptsslp.dll","drprov.dll","wlanapi.dll","dhcpcsvc.DLL","atlthunk.dll","wpnprv.dll","shacct.dll","dtsh.dll","advapi32.dll","urlmon.dll","AltTab.dll","Windows.Globalization.Fontgroups.dll","Windows.Networking.Sockets.PushEnabledApplication.dll","WSSync.dll","AepRoam.dll","SkydriveShell.dll","DUI70.dll","wcnapi.dll","NetworkStatus.dll","NetworkItemFactory.dll","wbemprox.dll","MrmCoreR.dll","netutils.dll","sppc.dll","d3d11.dll","bcryptPrimitives.dll","WINBRAND.dll","kernel.appcore.dll","PlayToDevice.dll","srchadmin.dll","powrprof.dll","gpapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\counters.dat","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"path":"C:\\Users\\Payload","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"path":"%WINDIR%\\System32\\en-US\\wshqos.dll.mui","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"path":"%WINDIR%\\system32\\en-US\\mswsock.dll.mui","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"path":"%WINDIR%\\system32\\en-US\\CRYPT32.dll.mui","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.3G2\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.3GP\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.3GP2\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.3GPP\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AAC\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.ADT\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.ADTS\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AIF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AIFC\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AIFF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.ASF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.ASX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AU\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AU3\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AVI\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.BMP\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.CAB\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.CDXML\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.CONTACT\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.CSS\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.CSV\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.DDS\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.DLL\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.DOC\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.DOCM\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.DOCX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.DOT\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.DOTM\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.DOTX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.DWFX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.EASMX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.EDRWX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.EMF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.EPRTX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.EXE\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.FON\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.GIF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.HTM\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.HTML\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.ICO\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.INI\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.JFIF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.JPE\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.JPEG\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.JPG\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.JTX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.JXR\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.LNK\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.M1V\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.M2T\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.M2TS\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.M2V\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.M3U\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.M4A\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.M4V\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MHT\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MHTML\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MID\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MIDI\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MOD\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MOV\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MP2\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MP2V\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MP3\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MP4\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MP4V\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MPA\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MPE\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MPEG\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MPG\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MPV2\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MSG\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MTS\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.OCX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.ODT\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.OTF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.OXPS\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.PANO\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.PNG\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.POT\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.POTM\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.POTX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.PPAM\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.PPSM\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.PPSX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.PPT\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.PPTM\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.PPTX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.PS1XML\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.PSSC\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.RLE\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.RMI\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.RTF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.SCF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.SEARCH-MS\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.SHTML\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.SLDM\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.SLDX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.SND\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.SYS\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{67F37430-EA76-CB34-6689-DB43EB1AE1A4}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{67F37430-EA76-CB34-6689-DB43EB1AE1A4}\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{0E605FF9-B0DF-BE8C-F68D-8EF690B399F6}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{0E605FF9-B0DF-BE8C-F68D-8EF690B399F6}\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{8A55EDB0-1B25-33CB-4CE0-10032C18ADFF}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{8A55EDB0-1B25-33CB-4CE0-10032C18ADFF}\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{AF9A5843-281F-31EA-F74B-2F39B46D2B8E}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{AF9A5843-281F-31EA-F74B-2F39B46D2B8E}\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{FFA1E008-CEB2-D28C-AC99-EC132B47AFED}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{FFA1E008-CEB2-D28C-AC99-EC132B47AFED}\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{3362FCEB-3A85-2490-B261-8B1DE2825568}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{824FD106-33FA-A153-BAD5-736A9C506BA5}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{E6AB5E45-651B-8432-534F-AAB82F0A9C63}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{6381CD2F-3EF8-BA2B-C43B-F8B65ABE80A7}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{7F63368B-5ED4-4938-6A61-FDC090A2FD67}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{1B2864C1-ADDC-9A79-0CCD-F2B04FB91414}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{1B2864C1-ADDC-9A79-0CCD-F2B04FB91414}\\","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{6381CD2F-3EF8-BA2B-C43B-F8B65ABE80A7}\\SHELLFOLDER\\01D0C7017703FF91\\01D0C7017703FF91","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\2d8add534d493db59d1e7081f0bdf538","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\dfc056cf7f3802738d85c6db691985bc","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\872812cf4fbc6000ae6b918467ab144b","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\d7f675de1a5e334bccddbbbf7d8aa856","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\753310ad3064c440e9bce7921ba91672","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\9488692beb9575ce493b9fbed252cf38","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\6a3e567dcd4fd0541a5987418fc89c54","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\8975d785de650484624534b902b8c579","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\c76acad260fdd96be193e291b021e4ab","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\44af98afa230dd1d507a0472eb26e0be","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\c83363c5947c85a11e4e1931298c1207","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\dfd61937e928f92a8ce5abfadf4027c7","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\dae8b9eb7eadfd0105837ebcbddb6876","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\caeeb5b1b8b8f0c7fbe5e5a8e66fb0fa","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\e89f0d550caad795ef77e6105e11334e","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\2306ef1d61165f6903e3e822f8fee3ca","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\cdba1aaecbb1a7b4d4e05d7e9156f406","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\6ce006564659ce1369a320a6f783d1cd","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\43f9b8cbb7c1fe7453fd16fe758e8851","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\9e28a2eb86d31001707756389f159fd1","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\897ab8a05b45285941c73f2a494b0e23","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\48b1851f485f5dda7e10940dae304b6c","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\64158004381d6035951f057508669f7f","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\feac55a17d78526df5451adabe1eff7a","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]},{"name":"Global\\e3060d23dcae52c31fb0847e45b0ec56","sources":[{"report_type":"sandbox","report_id":"55b3c7610e316d01260ac325"}]}]}},"report_ids":{"sandbox_job_ids":["55b3c7610e316d01260ac325","55b0df150e316dd2797efa7a","55b15ef20e316dc04442388e"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample ce585d3c6964… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ce585d3c6964…. Malware family: Trojan.Generic. Threat score 85/100. 21/28 AV engines flagged this file. 9 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ce585d3c69640b084f4c0869be2f8fbbe86574e3f73c2f73da8f71cf3c3146ab"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample ce585d3c6964… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ce585d3c6964…. Malware family: Trojan.Generic. Threat score 85/100. 21/28 AV engines flagged this file. 9 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ce585d3c69640b084f4c0869be2f8fbbe86574e3f73c2f73da8f71cf3c3146ab"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample ce585d3c6964… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ce585d3c6964…. Malware family: Trojan.Generic. Threat score 85/100. 21/28 AV engines flagged this file. 9 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]