23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 22:T49a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample d314aac126e2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d314aac126e2…. Malware family: Trojan.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d314aac126e2bc980573d830b421f88759d8232eae1ff3b1021e038df65b6ab1","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","d314aac126e2bc980573d830b421f88759d8232eae1ff3b1021e038df65b6ab1"],"about":{"@type":"SoftwareApplication","name":"Mix-Server's x32.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"d314aac126e2bc980573d830b421f88759d8232eae1ff3b1021e038df65b6ab1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":11,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T6bc,"" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\8990487b8c05ada1e1febe7dcb6c0410\System.Windows.Forms.ni.dll.aux" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\24db7e31c7ba5b0e824e2f521c0914bc\System.Drawing.ni.dll.aux" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\7152ca3b4e8d992fb4be5317321c2ee5\System.Configuration.ni.dll.aux" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\870a651e78e8d414b516df1ecae18884\System.Xml.ni.dll.aux" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config" "" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "" touched file "C:\Windows\System32\rsaenh.dll" "" touched file "C:\Windows\System32\tzres.dll" "" touched file "C:\Windows\System32\en-US\tzres.dll.mui"25:T9c1,"" wrote bytes "77397c7779a88077be728077d62d80771de27b7705a28077c8687f7757d18677bee37b77616f807768417e7700507e7700000000ad37a3768b2da376b641a37600000000" to virtual address "0x75331000" (part of module "WSHIP6.DLL") "" wrote bytes "db4dec6b00000000" to virtual address "0x000D2000" (part of module "MIX-SERVER_S X32.EXE") "" wrote bytes "92e67b7779a88077be728077d62d80771de27b7705a28077bee37b77616f807768417e7700507e7700000000ad37a3768b2da376b641a37600000000" to virtual address "0x74E61000" (part of module "WSHTCPIP.DLL") "" wrote bytes "40537e7758587f77186a7f77653c80770000000000bf93770000000056cc9377000000007cca93770000000037689b756a2c8077d62d80770000000020699b750000000029a6937700000000a48d9b7500000000f70e937700000000" to virtual address "0x779D1000" (part of module "NSI.DLL") "" wrote bytes "6d3ea491" to virtual address "0x6B1F2024" (part of module "CLR.DLL") "iexplore.exe" wrote bytes "e9e89a4dfc" to virtual address "0x7640E30C" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9b94343fc" to virtual address "0x76423B9B" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9652b54fc" to virtual address "0x7640ADF9" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e955a524fb" to virtual address "0x776F3EAE" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "e9efb924fe" to virtual address "0x7481388E" (part of module "COMCTL32.DLL") "iexplore.exe" wrote bytes "e937f25ffc" to virtual address "0x7645E963" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9395430fb" to virtual address "0x777593FC" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "e96ff15ffc" to virtual address "0x7645E9C9" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9b29686fc" to virtual address "0x760B9D0B" (part of module "OLE32.DLL") "iexplore.exe" wrote bytes "e9c20a61fc" to virtual address "0x7644D274" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9e9f05ffc" to virtual address "0x7645E9ED" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e99cf35ffc" to virtual address "0x7645E869" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e98b8e36fb" to virtual address "0x776F5DEE" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "e92e0d61fc" to virtual address "0x7644CF42" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9fda436fb" to virtual address "0x776F4731" (part of module "OLEAUT32.DLL")26:T66c,Found malicious artifacts related to "91.217.9.221": ... URL: http://pussyhunters.ru/9ffe829a59e4e4690c241b747b005b3c(C).exe (AV positives: 7/67 scanned on 04/11/2018 17:54:11) URL: http://pussyhunters.ru/NfYDB5mhJxMi50z6/NfYDB5mhJxMi50z6(C).exe (AV positives: 7/67 scanned on 04/11/2018 17:10:06) URL: http://pussyhunters.ru/2e8384d7a437e06b7651a6aafb904a72(C).exe (AV positives: 6/67 scanned on 04/11/2018 16:41:43) URL: http://pussyhunters.ru/pIrtJ2BxEMc8ai7H/pIrtJ2BxEMc8ai7H(C).exe (AV positives: 5/67 scanned on 04/11/2018 14:50:19) URL: http://pussyhunters.ru/05e288241f878797ec61b645a29d6a9b(C).exe (AV positives: 6/67 scanned on 04/11/2018 14:42:53) File SHA256: 1163ce7ec190bf767801e94817c07c19768bfacda7118070fa4a65e8bcbc9417 (AV positives: 43/67 scanned on 04/11/2018 10:09:03) File SHA256: a6f9ea78c62e55bdac3748efc9798ac787247d4bda680a0563a299f8d723f791 (AV positives: 12/59 scanned on 04/08/2018 06:40:22) File SHA256: 1fde5d3209c5019bcaf7571232fa5dd003bdb9963f365a9b38ecb67991b2c743 (AV positives: 36/65 scanned on 04/07/2018 04:25:55) File SHA256: b315944e3f28b619a4a39930aa6c5689d81ae8e146c6e7da4a38bd40f211f270 (AV positives: 49/65 scanned on 04/03/2018 13:52:50) File SHA256: ffd7e469dc591674470cc08d1c3c9ac212cc8766a21c53c47777c61887710c92 (Date: 03/31/2018 16:09:04) File SHA256: 024c5e34c027cebf73ba9f645d9251cca5b88bfd9ac192780c912c6016fc63af (AV positives: 18/66 scanned on 03/29/2018 05:55:02) File SHA256: aa922ff61a486a57f549c5ddf9a794b92eae49cb4179cdbe257d04681fd97c58 (Date: 03/26/2018 10:08:30) File SHA256: 0ec78eaff7edb1d71baf6254fb9280300bcbacd7da2d7c1974bd0984d0f2eb95 (Date: 03/26/2018 06:43:27)27:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////////8f////D////wP///8h////MH///zwf//8+B///P4P//z/g//8/+D//P/wP/z//B/8//8H/P/+D/z/+B/8//B//P/B//z/B//8/A///Pg///zg///8w////Af///wf///8P////f///////////////////w==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"d314aac126e2bc980573d830b421f88759d8232eae1ff3b1021e038df65b6ab1","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790351348497,"unified_at":"2026-09-25T15:49:08.497Z","metadata":{"hashes":{"sha256":"d314aac126e2bc980573d830b421f88759d8232eae1ff3b1021e038df65b6ab1","sha1":"1eb90df8cf09f08463e8274fe2aa9d252654f525","md5":"4053daea9296d6dfb85fd6c6d2c7adf8","sha512":"db0c6869702f77f4c51ca96db20413733074a5b82d7953ae933a5dc626c7ae22aaaab907efada677b547cce5efc0be7a0f836cdc3496101a075411c0bc0d060d","ssdeep":"768:Z3Wj+wLpaxPLNuS6EQUzuoZduY9ewkt5txJ749WQ:Z3WDAxxYUzz/AP3J749Z","ssdeep_chunks":["768:Z3Wj+wL","768:3Wj+wLp","768:Wj+wLpa","768:j+wLpax","768:+wLpaxP","768:wLpaxPL","768:LpaxPLN","768:paxPLNu","768:axPLNuS","768:xPLNuS6","768:PLNuS6E","768:LNuS6EQ","768:NuS6EQU","768:uS6EQUz","768:S6EQUzu","768:6EQUzuo","768:EQUzuoZ","768:QUzuoZd","768:UzuoZdu","768:zuoZduY","768:uoZduY9","768:oZduY9e","768:ZduY9ew","768:duY9ewk","768:uY9ewkt","768:Y9ewkt5","768:9ewkt5t","768:ewkt5tx","768:wkt5txJ","768:kt5txJ7","768:t5txJ74","768:5txJ749","768:txJ749W","768:xJ749WQ","1536:Z3Wj+wL","1536:3Wj+wLp","1536:Wj+wLpa","1536:j+wLpax","1536:+wLpaxP","1536:wLpaxPL","1536:LpaxPLN","1536:paxPLNu","1536:axPLNuS","1536:xPLNuS6","1536:PLNuS6E","1536:LNuS6EQ","1536:NuS6EQU","1536:uS6EQUz","1536:S6EQUzu","1536:6EQUzuo","1536:EQUzuoZ","1536:QUzuoZd","1536:UzuoZdu","1536:zuoZduY","1536:uoZduY9","1536:oZduY9e","1536:ZduY9ew","1536:duY9ewk","1536:uY9ewkt","1536:Y9ewkt5","1536:9ewkt5t","1536:ewkt5tx","1536:wkt5txJ","1536:kt5txJ7","1536:t5txJ74","1536:5txJ749","1536:txJ749W","1536:xJ749WQ","768:Z3WDAxx","768:3WDAxxY","768:WDAxxYU","768:DAxxYUz","768:AxxYUzz","768:xxYUzz/","768:xYUzz/A","768:YUzz/AP","768:Uzz/AP3","768:zz/AP3J","768:z/AP3J7","768:/AP3J74","768:AP3J749","768:P3J749Z"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"Mix-Server's x32.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":69632,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1523471080000,"last_seen":1676718300000,"last_multi_scan":1676718300000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":17,"suspicious_count":13,"malicious_count":4,"total":34},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Unwanted/Win32.HackTool","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1216789","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.33056297","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_60% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.BLZ.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.33056297 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!CB1D36905E59D8E7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Confuser.fbqeyu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.GenKryptik.Win32.33653","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"PATH\"; Value: \"00000000010000004800000043003A005C00500072006F006700720061006D002000460069006C00650073005C0049006E007400650072006E006500740020004500780070006C006F007200650072003B000000\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"pussyhunters.ru\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"91.217.9.221:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!xnzguh7!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!xnzguh7!appdata!roaming!microsoft!windows!cookies!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!xnzguh7!appdata!local!microsoft!windows!history!history.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!xnzguh7!appdata!roaming!microsoft!windows!ietldcache!\"\n \"RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208\"\n \"ConnHashTable<3924>_HashTable_Mutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\c:!users!xnzguh7!appdata!roaming!microsoft!windows!ietldcache!\"\n \"Local\\WininetStartupMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\!IETld!Mutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00015809-00003924)\n Launches browser \"iexplore.exe\" (UID: 00015847-00002760)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 6ACE0000\n \"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll\" at 6A180000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 00015809-00003924) was launched with new environment variables: \"PATH=\"%PROGRAMFILES%\\Internet Explorer;\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"iexplore.exe\" with commandline \"-nohome\" (UID: 00015809-00003924)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3924 CREDAT:79873\" (UID: 00015847-00002760)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"informative","category":"Installation/Persistance","name":"Creates new processes","description":"\"iexplore.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\", Handle: 772)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"desktop.ini\" has type \"empty\"\n \"RecoveryStore.{07DBE753-3DF9-11E8-9542-0A002745ABDE}.dat\" has type \"Composite Document File V2 Document Cannot read section info\"\n \"frameiconcache.dat\" has type \"data\"\n \"{07DBE754-3DF9-11E8-9542-0A002745ABDE}.dat\" has type \"Composite Document File V2 Document Cannot read section info\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"iexplore.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$24","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"\n Heuristic match: \"pussyhunters.ru\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Mix-Server_s x32.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00013498-00002700-00000105-38349106","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.17575863421","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"3/67 reputation engines marked \"http://pussyhunters.ru\" as malicious (4% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"0X80000000L\"\n \"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /mix/check.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: pussyhunters.ruContent-Length: 12Expect: 100-continueConnection: Keep-Alive\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"iexplore.exe\" wrote 32 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 772)\n \"iexplore.exe\" wrote 52 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 772)\n \"iexplore.exe\" wrote 4 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 772)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"pussyhunters.ru\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"suspicious","category":"System Security","name":"Tries to obtain the highest possible privilege level without UAC dialog","description":"\". --> \" (Indicator: \"requestedExecutionLevel level=\"highestAvailable\"\")","origin":"File/Memory","relevance":7,"id":"string-31","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$25","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"malicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines","description":"3/67 reputation engines marked \"http://pussyhunters.ru\" as malicious (4% detection rate)","origin":"External System","relevance":10,"id":"avtest-7","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"22/66 Antivirus vendors marked sample as malicious (33% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"22/66 Antivirus vendors marked sample as malicious (33% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$26","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Accesses potentially sensitive information from local browsers"},{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":29,"imported_dlls_count":102,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":95,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":11,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":14,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5ace52e77ca3e1289476a3a8","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.tfr","contacted_countries":["RUS"],"submit_name":"Mix-Server's x32.exe","analysis_start_time":"2018-04-11T19:24:24+00:00","indicators_count":{"informative":17,"suspicious":16,"malicious":5},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"91.217.9.221","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]}],"dns_resolutions":[{"domain":"pussyhunters.ru","address":"91.217.9.221","ttl":3599,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]}],"http_requests":[{"host":"pussyhunters.ru","host_ip":"91.217.9.221:80","url":"/mix/check.php","method":"POST","header":"POST /mix/check.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nHost: pussyhunters.ru\nContent-Length: 12Expect: 100-continue\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}],"processes":[{"pid":2700,"ppid":0,"name":"Mix-Server_s x32.exe","command_line":"","sha256":"d314aac126e2bc980573d830b421f88759d8232eae1ff3b1021e038df65b6ab1","normalized_path":"C:\\Mix-Server_s x32.exe","uid":"00013498-00002700","icon":"$27"},{"pid":3924,"ppid":2700,"name":"iexplore.exe","command_line":"-nohome","sha256":"e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00013498-00002700","uid":"00015809-00003924"},{"pid":2760,"ppid":3924,"name":"iexplore.exe","command_line":"SCODEF:3924 CREDAT:79873","sha256":"e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00015809-00003924","uid":"00015847-00002760"}],"all_imported_dlls":["imm32.dll","System.Configuration.ni.dll","rasapi32.dll","credssp.dll","FWPUCLNT.DLL","Wldap32.dll","NapiNSP.dll","winrnr.dll","System.ni.dll","apphelp.dll","SensApi.dll","msimg32.dll","System.Drawing.ni.dll","nlssorting.dll","rtutils.dll","mswsock.dll","WSHTCPIP.DLL","shell32.dll","tzres.dll","urlmon.dll","msvcrt.dll","ole32.dll","cryptbase.dll","System.Windows.Forms.ni.dll","rasadhlp.dll","wininet.dll","msxml3r.dll","sspicli.dll","IPHLPAPI.DLL","psapi.dll","iertutil.dll","ntmarta.dll","comdlg32.dll","nlaapi.dll","pnrpnsp.dll","mscoree.dll","mscoreei.dll","user32.dll","System.Xml.ni.dll","ws2_32.dll","profapi.dll","ieproxy.dll","ExplorerFrame.dll","rpcrt4.dll","lpk.dll","usp10.dll","msvcr120_clr0400.dll","sqmapi.dll","shlwapi.dll","mscorlib.ni.dll","clrjit.dll","wship6.dll","cfgmgr32.dll","dnsapi.dll","oleaccrc.dll","xmllite.dll","ntdll.dll","kernel32.dll","KernelBase.dll","rpcss.dll","webio.dll","cryptsp.dll","duser.dll","dui70.dll","nsi.dll","dhcpcsvc.dll","propsys.dll","crypt32.dll","mlang.dll","rsaenh.dll","gdi32.dll","msctf.dll","winhttp.dll","version.dll","msxml3.dll","devobj.dll","url.dll","clr.dll","uxtheme.dll","oleaut32.dll","clbcatq.dll","comctl32.dll","oleacc.dll","netprofm.dll","rasman.dll","winnsi.dll","dhcpcsvc6.dll","dwmapi.dll","ieframe.dll","msasn1.dll","ieui.dll","sechost.dll","setupapi.dll","npmproxy.dll","ONBTTN~1.DLL","normaliz.dll","userenv.dll","mscorlib.dll","linkinfo.dll","IEShims.dll","advapi32.dll","RpcRtRemote.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"RecoveryStore.{07DBE753-3DF9-11E8-9542-0A002745ABDE}.dat","sha256":"a89d1dbcf286812737108dd503ad7044e61feb1dabfb8ee1a8f453c7ee7127fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"{07DBE754-3DF9-11E8-9542-0A002745ABDE}.dat","sha256":"ebe7284925d2ee28e18429ed0410f38ea95c46f523bde69df971a73d5b514e09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"frameiconcache.dat","sha256":"b73e0fd324eca3e607ee5e9f68d928b521ca6fcd6729cf7dde4675dce1c3ef21","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"C:\\Mix-Server_s x32.exe.config","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"C:\\Mix-Server_s x32.exe","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\250e8e6af918e7ca66787117bc8633e3\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\8990487b8c05ada1e1febe7dcb6c0410\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\24db7e31c7ba5b0e824e2f521c0914bc\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\7152ca3b4e8d992fb4be5317321c2ee5\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\870a651e78e8d414b516df1ecae18884\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"C:\\Mix","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Low","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"C:\\Users\\XNZguH7","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Low","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Low","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE\\Low","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache\\Low","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\Low","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%TEMP%\\Low","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en-US\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{07DBE753-3DF9-11E8-9542-0A002745ABDE}.dat","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%TEMP%\\~DF0C741BD9EB38090D.TMP","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\System32\\url.dll","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\System32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%USERPROFILE%\\Favorites\\Links","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\ONBttnIE.dll","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\ONBTTN~1.DLL","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Suggested Sites.url","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Suggested Sites.url:favicon","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Web Slice Gallery.url","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\4shared.com.url","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\5pk.com.url","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\7k7k.com.url","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\17kuxun.com.url","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\27.cn.url","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%WINDIR%\\System32\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{07DBE754-3DF9-11E8-9542-0A002745ABDE}.dat","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%TEMP%\\~DFAC7638C89E05A781.TMP","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\frameiconcache.dat","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\MIX-SERVER_S X32_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\MIX-SERVER_S X32_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"key":"HKCU\\LOCAL SETTINGS\\SOFTWARE\\MICROSOFT\\WINDOWS\\SHELL\\MUICACHE\\@%WINDIR%\\SYSTEM32\\IEFRAME.DLL,-12385\\@%WINDIR%\\SYSTEM32\\IEFRAME.DLL,-12385","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"key":"HKCU\\LOCAL SETTINGS\\SOFTWARE\\MICROSOFT\\WINDOWS\\SHELL\\MUICACHE\\@C:\\WINDOWS\\SYSTEM32\\IEFRAME.DLL,-12385\\@C:\\WINDOWS\\SYSTEM32\\IEFRAME.DLL,-12385","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\SHELLNOROAM\\MUICACHE\\@%WINDIR%\\SYSTEM32\\IEFRAME.DLL.MUI,-12385\\@%WINDIR%\\SYSTEM32\\IEFRAME.DLL.MUI,-12385","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\SHELLNOROAM\\MUICACHE\\@C:\\WINDOWS\\SYSTEM32\\IEFRAME.DLL.MUI,-12385\\@C:\\WINDOWS\\SYSTEM32\\IEFRAME.DLL.MUI,-12385","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!xnzguh7!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!xnzguh7!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!xnzguh7!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!xnzguh7!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"ConnHashTable<3924>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"Local\\c:!users!xnzguh7!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ConnHashTable<3924>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ace52e77ca3e1289476a3a8"}]}]}},"report_ids":{"sandbox_job_ids":["5ace52e77ca3e1289476a3a8"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Trojan.Generic Sample d314aac126e2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d314aac126e2…. Malware family: Trojan.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d314aac126e2bc980573d830b421f88759d8232eae1ff3b1021e038df65b6ab1"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample d314aac126e2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d314aac126e2…. Malware family: Trojan.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d314aac126e2bc980573d830b421f88759d8232eae1ff3b1021e038df65b6ab1"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample d314aac126e2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d314aac126e2…. Malware family: Trojan.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]