26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T484,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ursu.Generic Sample dd19774bafdd… — Score 60/100 — Hybrid Analysis","description":"Malicious verdict for sample dd19774bafdd…. Malware family: Ursu.Generic. Threat score 60/100. 13/28 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/dd19774bafdd8dcb8f87c1f2e14584159451e961923932ab961e3d351adcdfb7","keywords":["Malicious","Ursu.Generic","malware analysis","sandbox report","threat intelligence","dd19774bafdd8dcb8f87c1f2e14584159451e961923932ab961e3d351adcdfb7"],"about":{"@type":"SoftwareApplication","name":"winupdate-binary.exe","applicationCategory":["peexe","executable"],"identifier":"dd19774bafdd8dcb8f87c1f2e14584159451e961923932ab961e3d351adcdfb7","additionalType":"Malicious sample"},"threatScore":60,"malwareFamily":"Ursu.Generic","antivirusDetections":{"malicious":13,"total":28},"behavioralIndicators":{"malicious":2,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T51d,Spawned process "WMIC.exe" with commandline "wmic" (UID: 00019083-00002616) Spawned process "colorcpl.exe" (UID: 00019361-00002816) Spawned process "sysprep.exe" (UID: 00019686-00003124) Spawned process "AdobeUpd.exe" (UID: 00019975-00003464) Spawned process "cmd.exe" with commandline "cmd /c move %TEMP%\AdobeUpdate.exe %WINDIR%\System32\AdobeUpdate.exe & sc create AdobeUpdate binPath= %WINDIR%\System32\AdobeUpdate.exe DisplayName= AdobeUpdate type= own error= ignore obj= LocalSystem start= delayed-auto & sc failure AdobeUpdate reset= 30 actions= restart/10000/restart/30000/reboot/60000 &" (UID: 00020463-00003412) Spawned process "sc.exe" with commandline "sc create AdobeUpdate binPath= %WINDIR%\System32\AdobeUpdate.exe DisplayName= AdobeUpdate type= own error= ignore obj= LocalSystem start= delayed-auto" (UID: 00020686-00003460) Spawned process "sc.exe" with commandline "sc failure AdobeUpdate reset= 30 actions= restart/10000/restart/30000/reboot/60000" (UID: 00020885-00003056) Spawned process "cmd.exe" with commandline "cmd /c net start AdobeUpdate" (UID: 00021481-00003100) Spawned process "net.exe" with commandline "net start AdobeUpdate" (UID: 00021679-00002776) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 start AdobeUpdate" (UID: 00021872-00002712)28:T558,Spawned process "" (UID: 00018396-00000696) Spawned process "WMIC.exe" with commandline "wmic" (UID: 00019083-00002616) Spawned process "colorcpl.exe" (UID: 00019361-00002816) Spawned process "sysprep.exe" (UID: 00019686-00003124) Spawned process "AdobeUpd.exe" (UID: 00019975-00003464) Spawned process "cmd.exe" with commandline "cmd /c move %TEMP%\AdobeUpdate.exe %WINDIR%\System32\AdobeUpdate.exe & sc create AdobeUpdate binPath= %WINDIR%\System32\AdobeUpdate.exe DisplayName= AdobeUpdate type= own error= ignore obj= LocalSystem start= delayed-auto & sc failure AdobeUpdate reset= 30 actions= restart/10000/restart/30000/reboot/60000 &" (UID: 00020463-00003412) Spawned process "sc.exe" with commandline "sc create AdobeUpdate binPath= %WINDIR%\System32\AdobeUpdate.exe DisplayName= AdobeUpdate type= own error= ignore obj= LocalSystem start= delayed-auto" (UID: 00020686-00003460) Spawned process "sc.exe" with commandline "sc failure AdobeUpdate reset= 30 actions= restart/10000/restart/30000/reboot/60000" (UID: 00020885-00003056) Spawned process "cmd.exe" with commandline "cmd /c net start AdobeUpdate" (UID: 00021481-00003100) Spawned process "net.exe" with commandline "net start AdobeUpdate" (UID: 00021679-00002776) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 start AdobeUpdate" (UID: 00021872-00002712)29:Tbfc,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAiSSURBVFhHzVdpcJVXGe7wRwsU2bKHbCxNoYFSKFZaS7Fl0I6daSsVKDQI6SaOgzpDp+WHK9Ufjo61KrUqndrQVPYlkgSy7zd3yXIhd8vNvSHhRpYsFUIgwDw+z7n3Iwujf21m3jnnfuec933e7Tkn99zzefl7K3EOAkseQSjjfoQzH0B31kL0zF2I85TeuYsQ4W/N/8W181kPoCf9fvTtfBtDl/sQ+cluDJZVILJspdljzmZkGz2hzGx0pi+g3mx40ubDk/MI3kxIwTi/38iaD0fyHNTHp8JNIC5KW0IavElpOJuUjvbENPg5ejkGOPo5erkn8u57GPB60T43G6FNW+Bb8wza4lJwhuvuxHS4uddJHY00WE+pjEtGKccqfn81a8EoiNenzYCNCu006kiYg1aKm+JNzjCGwymZ8HMe5LxT3wQoOR19H32MIZ8fgQULEfryYwiuXAUPz3m47uFeN/UJiCMhFTZKHaUqMRWn41Owdcq0UQB5U+5DLRdlvE3CDTISIPoQx1BSBg2nI0jppGIB0VrfH/Zg+Fw3gg8uRTArG4G0eeZcB0H6aLido/S1JKfBRTB1nNcyyqcYic2Tp44H0EgAzQZxGtppQF4EpCwWAUVBot8C00FFF3/8M4xcuoTQ8pUIP7YaHfMWmnULgJ8gpU9ip/F6Sg2dOx2fjNyJABR+F1Er9wqdPJHBEI0pAhYApSBI6aSyyObv4PbwMM6v/SYufG+HiYKiIxAenpNYABymFpiCWAS2MOp3CnHb1Glm0UHDCtlZbhYAGZsI4A4Q7u1i3m8RwIUf7ET/+39BR/p8A04A/EoB9XgIXuFXeutpQxGopGyePAbAKwRQy7y00mgLD6rareKzDHZRsTWP1gVTwfE6i/Ca04UrJ4sRSM00EZD4UzJMN5ylKLUCYLcAsBPG1YAANHKDg52g8HvVckaRaiBahJFYDchwKAYmMCMRg+wE/X22/yACPGuMx7rEAhCNQBrq41L/VxEKABFTuQrQpGBCAVqem9pQJ8xORW/eG7g9MoJLP38HAebXGCdodYmiqJSqrQWgmhyh8FcyAuNqQG2oHo0WIaMQAyBvrLAbo7HQj01Fz3Mv4va1YVwtrUCH+CLGGSIxRVFFfYZOOWNRqKHxcgJ5aWIXiAe0ScZ9CmMsl2MBaK7CNKI90xMw+LcPTQRGBgbQ9dRaBOPn3OEQD/e3iQ1jNWCjc1WMgOEBpv1OF1gRUKtEuyCdRDLH5PO/AQgQcHj5o7jZP4D+3/8Jt27cwNXTZfBRuZ9nFYF2FqIi4KROG9OjKFs88PLYCLwy9T7Thk56b0ImMopR70QA+m0qnUr7/7oXN0JhBDPmo2/PB7h96xYi23fAzxB7COAM9yn/bTEiauRYTbmLCbcZKk5GE1EKgFpHaVCYLSa0CMiqhc4ly3Gj6xwG/p5vGDOYsxTDgQ5c57fg0hXwsuLPEIQANBsAqYYJK5gCXUh3UbF4WkVoMZfhdAMg2oaGgi1Qs5NZ9btxa2gI4a+uZt5TTAd0P/s8bl68hKHmZl7ty+E2t6u4JUrFVYxMDWukZCIVmxRwk1rFwUi4DRNaxTQmCmo9Kgo9tAIj/f0YzC+Af2ZitCC5X/nveWkLbn72b1y1NcH78Aq0zEgwERAR1ZE3Kvm7aHoccr84ZbQIRUQqkCZ60sxRAJQ/FZIuFsPvHPUWCFKZbsHrvITCq9eYb9G1aO/7aKRr3UYMBztxrbcX53b8CG5eVq4nn4bzW+vRlLsV9XmvYevSZeMBVDMvDQSgh4kAiJDUDVKqu90YVwoWL8P1c+fQX1AAD6vcPFBmp6D9S3Hw8nfnqqfRs/Mt9NfU4Cbbc7ivHwNdXbjMaztUVAJfwadw7nkfr639xiiALWyJqtirpZWhbGa4FAHl7yzzb72GfAz3hT/uwbXuHngXPQQfL5/Ak2tw/odv4jKp+EprK640t6Cf90KE+zroqe/17YiUleNCuAvBI0dhz92GQr7ANn5h8t0AalkcTTTuFCvqZiQAC4Q6I/i1r2OQoe/53Xvo/ukv0Edjgw4Hun/zLvwvrIc752E0p2ahRZFksdnjktDAurCJjHhle/P3IdDmRntDI777cu4oAD0O1BoiCRWjnaKWdMV6WM8zVXIvvRyIRDgeQBcfI54nnoKLKXIy/M3sDItunTQuUtP1K6kkkIpZCahgAZYsXIzyjZuR98SqUQDqSQEoI9paGmug97odFQ0Hlbfw3ves24CL3d3wsv3ss5OMh7o91d/mtSNPOW/UWToiw6J3OVVBAOXULwI6TiBHZ8bjxXvHPMl0MRTyY5lIgpvE17WzEuF49HF43vklWtZvRriqGuFTp9GYko5G9nOdqJX7GvjIrGbqdEavHXNWLx+9fimlsSeYjP9zdiKOEMwBOvDtsQA2EcAJKjrJRW0snRGHuufXob24BBXZOXDt/hXCPh9szzyLGiqRVwIrOUUpJwBzzRJYKecVHKVHUkSdJfKc34/T8H46JgAbxj7JFIHDXCik8kIar93+fbjKylC24isof3wVzthscP76t8YbpaqEZKV5Mc8UU9lJShG/F9GQnDhBPSf47TjH4/x2jPsOz0oyNvbNTEAB5bl7xxDRJhKRQTY9HiUbNsJWWYmS5Stwcl42mmvr0PBJAU7MiEcRlRRSsfHIKE+JjmPkKOfHKPLyINcPSi/HT5h7Gd/H33s5jovA+pwl2M8qPrRoCapPnUJR3qs4mMQn9J8/QENJCY7x2j1AAMe55zCNy5NDlKOUE/T4CL//gwYOMSqHaFxrn8ZAyNuPKB9T8il7qSef4F54cPFoF0yaNAkfvr0L1SQNt92OJlKmq6EBrS4XKXQNbDRq5z8XzqQsVn4mmlj9TWrX5CzTMRIVXpPpnui8Pva9hoWpebQjUlFM8tq7axdk8/Pyf/H/F8d/AIiFYhfxrhHxAAAAAElFTkSuQmCC2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3d3AAB2ZnAAAAAAAAAAAAeHh3AAZ3dgAAAAAAAAAAB3d3d3cGd3YAAAAAAAB3d3d4d3eHdnd2AAAAAHd3d3d3f4d3iHZ3dgAAd3d3d3d3d3+Hd4iGd3YAd3d3d3d3d3d/h3eIh4eHAHiIiId3d3d3f4d3iIeIhwB4iIiIiHd3d3+Hd3iHiIcAiIiIiIiId4d/h3eHd3h2AIiId4iIiIf3eId3iId4cACIh4eIiIiHh3iHd3eIeHAAiIf3iIh3d3d4h3d3d3hgAIiHh3eIiIiIeId3d3d3dgCHh3eIiIiIiHiHd3d3iHYAiIiIj//4iIh4h3d3d4hwAI/////4iIiIeId3d3eIcACI/4iId4iIiHiId3cAiHAAd4iIh/d3h3d3d3AAAIhwAAd3iIiIAHAAeIhwAACIcAAAAHd3cAAAB4iIdwAAiHAAAAAAAAAAAHiIiIdwAIhwAAAAAAAAAAeP+IiIdwCIcAAAAAAAAAAAd4/4iIcAiHAAAAAAAAAAAAh3j/iHAIhwAAAAAAAAAAAIiIePhwCIcAAAAAAAAAAACIhwf/cAj3AAAAAAAAAAAAf3AH93AI9wAAAAAAAAAAAPgAeIcACIcAAAAAAAAAAAAAB4hwAAiIAAAAAAAAAAAAAAAAAAAAAAD///////+Dwf//gcH//wBB/+AAAf4AAAHgAAABgAAAAYAAAAGAAAAAgAAAAIAAAACAAAAAgAAAAIAAAAGAAAABgAAAA4AAAAOAAABjgAAD48AAA+P4IAHj//4A4//8AGP//gBj//8AY///AGP//whj//8YY///MOP//+Hj/////w==2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAId3d3d3d3d3eIh3dwAAAACP/////////3iIiIdwAAAAj/////////94iIiIhwAAAI////iIj///eIiIiIhwAACP/4iIu3iP/3iIiIiHgAAAj/iHu7uziP94iIiId4AAAI/6qru7u5j/eIiHd3hwAACPiqq7u7uX/3h3d3eIiIcAj4qqiIi7l/93d3eIiIiHAI+G54iPiJf/d3eIiIiIh3CPju6Ij4jV/3iIiHZER4eAj/7uiP/43Y93ZETMzMeIcI/+7o///92PREzMzMzHiHCP/u7oiIjY/0R3fMzMx4hwj/iId3eIiP9ju7fMzMyIcI/////////4O7u7dMzMiHCP//////iIiDu7u5FMzIhwj//////4//d7uLuZXMyIcI//////+P93eIiLmVzMiHCP//////j3Z4iIiHlcx4h3j//////4duiIiIiNV3eId4iIiIiIhm7oiI/4jVd3iIcAAAiExExu7oiP+I3Xd4iHAAAIhMTMbu6I//+N1XeIhwAACIZEzO7uiP/4jdV3j4cAAAiETMxm7uh3d3d3d4+HAAAAh0zMzMzMx3d3d4iIhwAAAIdMzMzMx4iIiIiIiPcAAACHRMzMzHiIiIiIiIiIAAAAiEZ3eIiIiIiIiIiIiAAAAIiIiIiIiIiIgAAAAAD/////AAAA/wAAAHMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAAAAAAAAAAAAPgAAAD4AAAA+AAAAPgAAAD8AAAA/AAAAPwAAAD8AAAA/AAB/w==2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3AAAAAAAAAAAAB/iqiAAAgREXAAAAAAAAAAf4iIh3d4cHERAAAAAAAAAH///////3AAERAAEAAAAAAHAAAAAACAAAERARAAAAAAB3d3d3d3AAAAEREQAAAAAAf4iIiIhwAAAAEREAAAAAAH9wRERIcAAAARERd3d3dwB/cMzMSHAAABEREYgAAIcAf3DMzEhwAAAH+IiId3eHAH9w7MxIcAAAB///////9wB/cAAACHAAAABwAAAAAAgAf4iIiIhwAAAAd3d3d3dwAAdxd3d3cAAAAH+IiIiIcAAAAQAAAAAAAAB/cERESHAAAAFwAAAAAAAAf3DMzEhwAAABEAAAAAAAAH9wzMxIcAAABxEAAAd3d3d/cOzMSHAAAAAREAAX+KqIf3AAAAhwAAAAAREBF/iIiH+IiIiIcAAAAAARERf////3d3d3d3AAAAAAAREQcAAAAAAIAAAAAAAAABEREHd3d3d3cAAAAAAAAAERERB/iIiIiHAAAAAAAAAAAAAAf3BEREhwAAAAAAAAAAAAAH9wzMxIcAAAAAAAAAAAAAB/cMzMSHAAAAAAAAAAAAAAf3DszEhwAAAAAAAAAAAAAH9wAAAIcAAAAAAAAAAAAAB/iIiIiHAAAAAAAAAAAAAAB3d3d3dwAAAACAB///AAP//wAAf/8AAD//AAMd/4ADif+AB8H/gAfgAYAHwACAB4AAgAfAAIAHwACAB+AAgAfgAcAP4AH3/+AB8//gAfP4AAHx8AAB+OAAAfxAAAH+AAAD/wgAP/4IAH/8CAB///gAf//4AH//+AB///gAf//4AH//+AB///wA/w==2d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAd4eImZmZmZmZmZmZmRcAARGHGIEREREREREREREREAEReBGIERERERERERERERABEReBGIEREREREREREREQAREReBeHmRERmREREREREAERGZmHiJmZmZmZmRERERABEZmZmX95mZmZmZmREREQARmZmZmY+HmZmZmZmREXEAGZmZmZmfiIiHmZmZl4iHABmZmZmZmPmZeIiId4+HEQAZmZmZmZn4mZmZeP//iIcAGZmZmZmZj5mZmX/3mXdxABmZmZmZmZ+JmZf4mZmZEQAZmZmZmZmY+ZmfiZmZmREAGZmZmZmZmfiZ/5mZmZERABmZmZmZmZmPmPeZmZmZEQAZmZmZmZmZn4+JmZmZmREAGZmZmZmZmZj/mZmZmZkRABmZmZmZmZmX+JmZmZmZEQAZmZmZmZmZl/iZmZmZmZEAGZmZmZmZmZj4mZmZmZkRABmZmZmZmZmfiJmZmZmZkQAZmZmZmZmZn3iZmZmZmZEAGZmZmZmZmX+XmZmZmZkRABmZmZmZmZmPmZmZmZmZEQAZmZmZmZmZj5mZmZmZmREAGZmZmZmZmY+ZmZmZmZkRABmZmZmZmZmPl5mZmZmRkQABmZmZmZmZf4iZmZmZmRAAAAAAAAAAAAAAAAAAAAAAD//////////4AAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAHAAAAD/////w==2e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"dd19774bafdd8dcb8f87c1f2e14584159451e961923932ab961e3d351adcdfb7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":60,"unified_at_epoch_ms":1790289263742,"unified_at":"2026-09-24T22:34:23.742Z","metadata":{"hashes":{"sha256":"dd19774bafdd8dcb8f87c1f2e14584159451e961923932ab961e3d351adcdfb7","sha1":"eec0b83017f59b8d15ed630107160d71950c7888","md5":"f45d1ec469f6eebc6ea377817a71d98a","sha512":"ebd6589e3aef093e55e3dd19abfd48fb04f3185fc612365bc6365bc8e728e80bdc26a95785c8f5eaeb0c40547e7290cd8ab0ceaccb796b4eb55dec673adeb4e9","ssdeep":"24576:DJTOHP9D1V/rzN44DGlz6S3MI978Vl6qoENr:DJTGP","ssdeep_chunks":["24576:DJTOHP9","24576:JTOHP9D","24576:TOHP9D1","24576:OHP9D1V","24576:HP9D1V/","24576:P9D1V/r","24576:9D1V/rz","24576:D1V/rzN","24576:1V/rzN4","24576:V/rzN44","24576:/rzN44D","24576:rzN44DG","24576:zN44DGl","24576:N44DGlz","24576:44DGlz6","24576:4DGlz6S","24576:DGlz6S3","24576:Glz6S3M","24576:lz6S3MI","24576:z6S3MI9","24576:6S3MI97","24576:S3MI978","24576:3MI978V","24576:MI978Vl","24576:I978Vl6","24576:978Vl6q","24576:78Vl6qo","24576:8Vl6qoE","24576:Vl6qoEN","24576:l6qoENr","49152:DJTOHP9","49152:JTOHP9D","49152:TOHP9D1","49152:OHP9D1V","49152:HP9D1V/","49152:P9D1V/r","49152:9D1V/rz","49152:D1V/rzN","49152:1V/rzN4","49152:V/rzN44","49152:/rzN44D","49152:rzN44DG","49152:zN44DGl","49152:N44DGlz","49152:44DGlz6","49152:4DGlz6S","49152:DGlz6S3","49152:Glz6S3M","49152:lz6S3MI","49152:z6S3MI9","49152:6S3MI97","49152:S3MI978","49152:3MI978V","49152:MI978Vl","49152:I978Vl6","49152:978Vl6q","49152:78Vl6qo","49152:8Vl6qoE","49152:Vl6qoEN","49152:l6qoENr"],"imphash":"c3592e7c5a81f44322d09492d3cd4d74"},"file_info":{"file_name":"winupdate-binary.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1544192,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499290478000,"last_seen":1677396168000,"last_multi_scan":1677396168000}},"detections":{"summary":{"verdict":"malicious","score":60,"tags":null},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":10,"suspicious_count":15,"malicious_count":2,"total":27},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Spy.Agent.1232896.79","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ursu.724975","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Injector.ADKK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ursu.724975 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Spy.Agent.OTJ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDropper/Agent.lf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0055e3991 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Exploit.Win32.BypassUAC.wt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Mlw.eilmxp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ursu.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\Development\\Backup\\UAC\\UniversalUACBypass\\x64\\Release\\DemoLibrary.pdb\"\n \"D:\\Development\\Backup\\UAC\\UniversalUACBypass\\Release\\DemoLibrary.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\AdobeUpdate.exe\"\n \"\" created file \"%TEMP%\\tmp001\"\n \"\" created file \"%TEMP%\\AdobeUpd.exe\"\n \"AdobeUpd.exe\" created file \"%TEMP%\\tmp001\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\Color CPL Startup Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\SYSPREP-APP-5c9fbbd0-ee0e-11d2-9a21-0000f81edacc\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\SetupLog\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\WdsSetupLogInit\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"informative","category":"General","name":"Loads the visual basic runtime environment","description":"\"\" loaded module \"%WINDIR%\\System32\\msvbvm60.dll\" at 72940000\n \"AdobeUpd.exe\" loaded module \"%WINDIR%\\System32\\msvbvm60.dll\" at 72940000","origin":"Loaded Module","id":"module-0","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /c move %TEMP%\\AdobeUpdate.exe %WINDIR%\\System32\\AdobeUpdate.exe & sc create AdobeUpdate binPath= %WINDIR%\\System32\\AdobeUpdate.exe DisplayName= AdobeUpdate type= own error= ignore obj= LocalSystem start= delayed-auto & sc failure AdobeUpdate reset= 30 actions= restart/10000/restart/30000/reboot/60000 &\" on 2016-11-12.18:57:00.030\n \"cmd /c net start AdobeUpdate\" on 2016-11-12.19:07:00.050","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$27","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"AdobeUpd.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"diagerr.xml\" has type \"UTF-8 Unicode (with BOM) text\"\n \"AdobeUpd.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"AdobeAir32.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"CRYPTBASE.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"AdobeUpdate.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"setupact.log\" has type \"UTF-8 Unicode (with BOM) text with CRLF line terminators\"\n \"tmp001\" has type \"ASCII text with very long lines with no line terminators\"\n \"diagwrn.xml\" has type \"UTF-8 Unicode (with BOM) text\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\AppPatch\\AcGenral.DLL\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%WINDIR%\\System32\\Wbem\\WMIC.exe\"\n \"\" touched file \"%WINDIR%\\system32\\scrrun.dll\"\n \"AdobeUpd.exe\" touched file \"%WINDIR%\\AppPatch\\AcGenral.DLL\"\n \"AdobeUpd.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"AdobeUpd.exe\" touched file \"%WINDIR%\\system32\\cmd.exe\"\n \"AdobeUpd.exe\" touched file \"%WINDIR%\\system32\\scrrun.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"AdobeUpd.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"colorcpl.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"sysprep.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"sc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"colorcpl.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"AdobeUpd.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"AdobeAir32.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"CRYPTBASE.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"AdobeUpdate.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 1232896 bytes starting with PE header signature to file \"%APPDATA%\\AdobeAir32.dll\": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000e80000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...\n \"\" wrote 28672 bytes starting with PE header signature to file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\AdobeUpd.exe\": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000b80000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"wmic.exe\" (Indicator: \"wmic.exe\")","origin":"File/Memory","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads system information using Windows Management Instrumentation Commandline (WMIC)","description":"Process \"WMIC.exe\" with commandline \"wmic\" (UID: 00019083-00002616)","origin":"Monitored Target","relevance":3,"id":"target-10","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"%TEMP%\\AdobeUpd.exe\" marked \"C:\\winupdate_binary.exe\" for deletion\n \"%TEMP%\\AdobeUpd.exe\" marked \"%APPDATA%\\AdobeAir32.dll\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"AdobeUpd.exe\" opened \"C:\\winupdate_binary.exe\" with delete access\n \"AdobeUpd.exe\" opened \"%APPDATA%\\AdobeAir32.dll\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"colorcpl.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"colorcpl.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"colorcpl.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"winupdate_binary.exe.bin\" claimed CRC 1578475 while the actual is CRC 1593540\n \"AdobeUpd.exe\" claimed CRC 38435 while the actual is CRC 32167\n \"AdobeUpdate.exe\" claimed CRC 1285806 while the actual is CRC 95024","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CreateFileW\n CreateProcessA\n GetCommandLineA\n GetModuleFileNameA\n GetModuleFileNameW\n GetModuleHandleExW\n GetModuleHandleW\n GetProcAddress\n GetStartupInfoW\n GetTickCount64\n IsDebuggerPresent\n LoadLibraryExW\n LoadLibraryW\n OutputDebugStringW\n Sleep\n TerminateProcess\n UnhandledExceptionFilter\n WriteFile","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"net1.exe\" wrote bytes \"40537f7758588077186a8077653c81770000000000bfde750000000056ccde75000000007ccade75000000003768bb756a2c8177d62d8177000000002069bb750000000029a6de7500000000a48dbb7500000000f70ede7500000000\" to virtual address \"0x77961000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"colorcpl.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"AdobeUpd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"net.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"18/56 Antivirus vendors marked dropped file \"AdobeUpdate.exe\" as malicious (classified as \"Gen:Variant.Kazy\" with 32% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$28","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"},{"detail":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"}],"sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]}]},"activity":{"stats":{"process_count":11,"spawned_processes_count":11,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":77,"dropped_files_count":0,"extracted_files_count":8,"files_written_count":32,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files","Sample not shared","TOR analysis"],"sandbox_reports":[{"id":"58275065aac2ed0c21c98224","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":60,"submit_name":"winupdate-binary.exe","analysis_start_time":"2016-11-12T18:25:24+00:00","indicators_count":{"informative":10,"suspicious":18,"malicious":2},"tags":["Multi-Process","Extracted Files","Sample not shared","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}],"processes":[{"pid":696,"ppid":0,"name":"winupdate_binary.exe","command_line":"","normalized_path":"C:\\winupdate_binary.exe","uid":"00018396-00000696","icon":"$29"},{"pid":2616,"ppid":696,"name":"WMIC.exe","command_line":"wmic","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00018396-00000696","uid":"00019083-00002616","icon":"$2a"},{"pid":2816,"ppid":2616,"name":"colorcpl.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\colorcpl.exe","parent_uid":"00019083-00002616","uid":"00019361-00002816","icon":"$2b"},{"pid":3124,"ppid":2816,"name":"sysprep.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\sysprep\\sysprep.exe","parent_uid":"00019361-00002816","uid":"00019686-00003124","icon":"$2c"},{"pid":3464,"ppid":3124,"name":"AdobeUpd.exe","command_line":"","normalized_path":"%TEMP%\\AdobeUpd.exe","parent_uid":"00019686-00003124","uid":"00019975-00003464","icon":"$2d"},{"pid":3412,"ppid":3464,"name":"cmd.exe","command_line":"cmd /c move %TEMP%\\AdobeUpdate.exe %WINDIR%\\System32\\AdobeUpdate.exe & sc create AdobeUpdate binPath= %WINDIR%\\System32\\AdobeUpdate.exe DisplayName= AdobeUpdate type= own error= ignore obj= LocalSystem start= delayed-auto & sc failure AdobeUpdate reset= 30 actions= restart/10000/restart/30000/reboot/60000 &","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00019975-00003464","uid":"00020463-00003412","icon":"$2e"},{"pid":3460,"ppid":3412,"name":"sc.exe","command_line":"sc create AdobeUpdate binPath= %WINDIR%\\System32\\AdobeUpdate.exe DisplayName= AdobeUpdate type= own error= ignore obj= LocalSystem start= delayed-auto","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00020463-00003412","uid":"00020686-00003460"},{"pid":3056,"ppid":3412,"name":"sc.exe","command_line":"sc failure AdobeUpdate reset= 30 actions= restart/10000/restart/30000/reboot/60000","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00020463-00003412","uid":"00020885-00003056"},{"pid":3100,"ppid":3464,"name":"cmd.exe","command_line":"cmd /c net start AdobeUpdate","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00019975-00003464","uid":"00021481-00003100","icon":"$2f"},{"pid":2776,"ppid":3100,"name":"net.exe","command_line":"net start AdobeUpdate","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00021481-00003100","uid":"00021679-00002776"},{"pid":2712,"ppid":2776,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 start AdobeUpdate","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00021679-00002776","uid":"00021872-00002712"}],"all_imported_dlls":["msvbvm60.dll","propsys.dll","rsaenh.dll","wdscore.dll","shlwapi.dll","sfc_os.dll","profapi.dll","dwmapi.dll","urlmon.dll","sxs.dll","wkscli.dll","clbcatq.dll","ActionQueue.dll","msvcrt.dll","userenv.dll","wininet.dll","winbrand.dll","browcli.dll","uxtheme.dll","version.dll","sti.dll","ntdll.dll","lpk.dll","sechost.dll","colorui.dll","user32.dll","setupapi.dll","cfgmgr32.dll","mpr.dll","cryptbase.dll","psapi.dll","ntmarta.dll","IPHLPAPI.DLL","usp10.dll","AcGenral.dll","sspicli.dll","msctf.dll","mscms.dll","comctl32.dll","unattend.dll","samlib.dll","samcli.dll","rpcss.dll","dbghelp.dll","netutils.dll","kernel32.dll","gdi32.dll","crypt32.dll","ntdsapi.dll","ole32.dll","shell32.dll","sfc.dll","cryptsp.dll","RpcRtRemote.dll","netapi32.dll","ws2_32.dll","oleaut32.dll","iertutil.dll","msasn1.dll","Wldap32.dll","wintrust.dll","advapi32.dll","rpcrt4.dll","msacm32.dll","devobj.dll","nsi.dll","netmsg.dll","scrrun.dll","CRYPTBASE.dll","winnsi.dll","dsrole.dll","logoncli.dll","winmm.dll","imm32.dll","srvcli.dll","KernelBase.dll","apphelp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"AdobeUpdate.exe","sha256":"1f954911064d71b0458b016f2b4e6a3998b4be93101322a2d83f8336990fc4de","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"name":"AdobeAir32.dll","sha256":"8c5a988abbb52c9b980e46c3b1f1691853dad62d9d4c7a8456ca707ec5ef63a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"name":"AdobeUpd.exe","sha256":"87668837614a7c7bcaf32993236e7f86a1359cdd6c5e9d761e834a345fdc6cb0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"name":"tmp001","sha256":"4ca7dda9b3a52424bfb9ce91b55a4da87c436bc1f17ef601e3f533cb1526b84c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"name":"CRYPTBASE.dll","sha256":"8c5a988abbb52c9b980e46c3b1f1691853dad62d9d4c7a8456ca707ec5ef63a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"name":"diagerr.xml","sha256":"6c06bf950d0fe3476e020cd363ec0c8c9d4ee0fc89a24c50780c44e6453995c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"name":"diagwrn.xml","sha256":"6c06bf950d0fe3476e020cd363ec0c8c9d4ee0fc89a24c50780c44e6453995c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"name":"setupact.log","sha256":"22711a77bc2f1800854c8ebcd32d4a5b01fae487b929f9491947f94a78feab22","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]}],"files_written":[{"path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%WINDIR%\\System32\\colorcpl.exe","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%WINDIR%\\System32\\en-US\\colorcpl.exe.mui","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%WINDIR%\\System32\\en-US\\colorui.dll.mui","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%WINDIR%\\WinSxS\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\comctl32.dll.mui","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%WINDIR%\\System32\\sysprep\\sysprep.exe","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%WINDIR%\\System32\\sysprep\\en-US\\sysprep.exe.mui","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%WINDIR%\\System32\\sysprep\\Panther\\setuperr.log","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%WINDIR%\\System32\\sysprep\\Panther\\setuplog.cfg","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%WINDIR%\\System32\\sysprep\\Panther\\setupact.log","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%WINDIR%\\System32\\sysprep\\Panther\\diagerr.xml","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%WINDIR%\\System32\\sysprep\\Panther\\diagwrn.xml","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%WINDIR%\\System32\\sysprep","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%WINDIR%\\AppPatch\\AcGenral.DLL","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%WINDIR%\\system32\\sc.exe","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%WINDIR%\\system32\\en-US\\sc.exe.mui","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%WINDIR%\\system32\\scrrun.dll","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%WINDIR%\\system32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"%WINDIR%\\system32\\net.exe","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Color CPL Startup Mutex","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SYSPREP-APP-5c9fbbd0-ee0e-11d2-9a21-0000f81edacc","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\WdsSetupLogInit","sources":[{"report_type":"sandbox","report_id":"58275065aac2ed0c21c98224"}]}]}},"report_ids":{"sandbox_job_ids":["58275065aac2ed0c21c98224"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Ursu.Generic Sample dd19774bafdd… — Score 60/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample dd19774bafdd…. Malware family: Ursu.Generic. Threat score 60/100. 13/28 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/dd19774bafdd8dcb8f87c1f2e14584159451e961923932ab961e3d351adcdfb7"}],["$","meta","4",{"property":"og:title","content":"Malicious Ursu.Generic Sample dd19774bafdd… — Score 60/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample dd19774bafdd…. Malware family: Ursu.Generic. Threat score 60/100. 13/28 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/dd19774bafdd8dcb8f87c1f2e14584159451e961923932ab961e3d351adcdfb7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ursu.Generic Sample dd19774bafdd… — Score 60/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample dd19774bafdd…. Malware family: Ursu.Generic. Threat score 60/100. 13/28 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]