26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T429,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample e2799b3c57b6… — Score 95/100 — Hybrid Analysis","description":"Malicious verdict for sample e2799b3c57b6…. Threat score 95/100. 0/28 AV engines flagged this file. 4 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447"],"about":{"@type":"SoftwareApplication","name":"dojo-delivery-dash.exe","applicationCategory":["peexe","executable"],"identifier":"e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447","additionalType":"Malicious sample"},"threatScore":95,"antivirusDetections":{"malicious":0,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4da,"ePlaybus Games.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Icon number=0 Archive ctime=Fri Oct 20 23:52:32 2017 mtime=Fri Oct 20 23:52:32 2017 atime=Fri Sep 10 21:05:16 2010 length=123 window=hide" "_shfoldr.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows" "Dojo Delivery Dash.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Fri Oct 20 23:52:32 2017 mtime=Fri Oct 20 23:52:32 2017 atime=Mon Feb 21 20:29:30 2011 length=4591616 window=hide" "is-6LK93.tmp" has type "PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows" "is-D9UVN.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "_RegDLL.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "is-HPKAE.tmp" has type "MS Windows 95 Internet shortcut text (URL=) ASCII text with CRLF line terminators" "e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "unins000.dat" has type "data" "is-2POA3.tmp" has type "MS Windows icon resource - 4 icons 48x48"28:T782,"" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "" touched file "C:\Windows\System32\netmsg.dll" "" touched file "C:\Windows\System32\en-US\netmsg.dll.mui" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\AppPatch\sysmain.sdb" "e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp" touched file "C:\Windows\Fonts\StaticCache.dat" "e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp" touched file "C:\Windows\System32\en-US\user32.dll.mui" "e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp" touched file "C:\Windows\System32\netmsg.dll" "e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp" touched file "C:\Windows\System32\en-US\netmsg.dll.mui" "e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp" touched file "C:\Windows\System32\shfolder.dll" "e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp" touched file "C:\Windows\System32\imageres.dll" "e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp" touched file "C:\Windows\System32\en-US\imageres.dll.mui" "e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp" touched file "C:\Users\1GZMGqI\AppData\Local\Microsoft\Windows\Caches" "e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db"29:Tfd1,Pattern match: "http://schemas.microsoft.com/SMI/2" Heuristic match: "ePlaybus.com" Heuristic match: "HEAD /edgedl/release2/LJCVr0SsrEs/GoogleUpdateSetup.exe HTTP/1.1 Connection: Keep-Alive Accept: */* Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempt" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSe" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "http://www.usertrust.com1" Pattern match: "crl.usertrust.com/UTN-USERFirst-Object.crl05" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://crl.thawte.com/ThawtePCA.crl0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "http://th.symcb.com/th.crl0" Pattern match: "www.thawte.com/cps0/" Pattern match: "https://www.thawte.com/repository0W" Pattern match: "http://th.symcd.com0&" Pattern match: "http://th.symcb.com/th.crt0" Pattern match: "https://d.symcb.com/cps0%" Pattern match: "https://d.symcb.com/rpa0" Pattern match: "http://sv.symcb.com/sv.crl0W" Pattern match: "http://sv.symcd.com0&" Pattern match: "http://sv.symcb.com/sv.crt0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Heuristic match: "tools.google.com" Heuristic match: "*.google.com" Heuristic match: "*.android.com" Heuristic match: "*.appengine.google.com" Heuristic match: "*.cloud.google.com" Heuristic match: "*.db833953.google.cn" Heuristic match: "*.gcp.gvt2.com" Heuristic match: "*.google-analytics.com" Heuristic match: "*.google.ca" Heuristic match: "*.google.cl" Heuristic match: "*.google.co.in" Heuristic match: "*.google.co.jp" Heuristic match: "*.google.co.uk" Heuristic match: "*.google.com.ar" Heuristic match: "*.google.com.au" Heuristic match: "*.google.com.br" Heuristic match: "*.google.com.co" Heuristic match: "*.google.com.mx" Heuristic match: "*.google.com.tr" Heuristic match: "*.google.com.vn" Heuristic match: "*.google.de" Heuristic match: "*.google.es" Heuristic match: "*.google.fr" Heuristic match: "*.google.hu" Heuristic match: "*.google.it" Heuristic match: "*.google.nl" Heuristic match: "*.google.pl" Heuristic match: "*.google.pt" Heuristic match: "*.googleadapis.com" Heuristic match: "*.googleapis.cn" Heuristic match: "*.googlecommerce.com" Heuristic match: "*.googlevideo.com" Heuristic match: "*.gstatic.cn" Heuristic match: "*.gstatic.com" Heuristic match: "*.gvt1.com" Heuristic match: "*.gvt2.com" Heuristic match: "*.metric.gstatic.com" Heuristic match: "*.urchin.com" Heuristic match: "*.url.google.com" Heuristic match: "*.youtube-nocookie.com" Heuristic match: "*.youtube.com" Heuristic match: "*.youtubeeducation.com" Heuristic match: "*.ytimg.com" Heuristic match: "android.clients.google.com" Heuristic match: "android.com" Heuristic match: "developer.android.google.cn" Heuristic match: "developers.android.google.cn" Heuristic match: "google-analytics.com" Heuristic match: "google.com" Heuristic match: "googlecommerce.com" Heuristic match: "source.android.google.cn" Pattern match: "www.goo.gl" Heuristic match: "youtube.com" Heuristic match: "youtubeeducation.com" Pattern match: "http://pki.google.com/GIAG2.crt0+" Pattern match: "http://clients1.google.com/ocsp0" Pattern match: "http://pki.google.com/GIAG2.crl0" Pattern match: "http://g.symcd.com0" Pattern match: "http://g.symcb.com/crls/gtglobal.crl0" Pattern match: "http://crl.geotrust.com/crls/secureca.crl0N" Pattern match: "https://www.geotrust.com/resources/repository0" Heuristic match: "]O.NC" Pattern match: "http://www.eplaybus.com/games/play.html" Pattern match: "http://www.innosetup.com/" Pattern match: "http://www.remobjects.com/ps" Heuristic match: "COMMAND.COM" Pattern match: "http://schemas.microsoft.com/SMI/20" Pattern match: "http://www.ihotsee.com/" Pattern match: "http://www.eplaybus.com"2a:T537,"" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-KL4CB.tmp\e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp" (Handle: 164) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-KL4CB.tmp\e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp" (Handle: 164) "" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-KL4CB.tmp\e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp" (Handle: 164) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-KL4CB.tmp\e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp" (Handle: 164) "e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp" wrote 32 bytes to a remote process "C:\Program Files\ePlaybus.com\Dojo Delivery Dash\Dojo Delivery Dash.exe" (Handle: 620) "e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp" wrote 52 bytes to a remote process "C:\Program Files\ePlaybus.com\Dojo Delivery Dash\Dojo Delivery Dash.exe" (Handle: 620) "e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp" wrote 4 bytes to a remote process "C:\Program Files\ePlaybus.com\Dojo Delivery Dash\Dojo Delivery Dash.exe" (Handle: 620)2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4iI5gAAAAAAAAePjwAAB4iIiOZoAAAAAAAH+PgHAHiIiI5miIAAAAAAB4+PCHB4iIiGaI/wAAAAAAf4+AeHiIiIho///wAAAAAHj48Id4iIiAD/+IgAAAAAB/j4B4eIiIAAB3eIAAAAAAePjwh3d3dwAAiHdwAAAAAH+PgHh/+I7gCI+IgAAAAAB///CHf47md4iI+IAAAAAAf//weHfuZ3iIiI8AAAAAAH//8IeH5meIiIiICIiIAAB///CIiHZ3iIiIgAAAiHAAf//wiIgHd4iIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH9ERERERET4cAAAAAd3dwB/TohmZszE+HAAAAAAf//wf0/ohmZsxPhwAAAAAAd3dw9O/ohmZsT4cAAAAAAAAAB/T+/ohmZk+HAAAAAAAAAAf07+/ohmZPhwAAAAAAAAAH9I7+/ohmT4cAAAAAAAAAB/SI7+/ohk+HAAAAAAAAAAf0iI7+/ohPhwAAAAAAAAAH9ERERERET4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AiIiIiIiIjuiO7oiIiIiIiO7u7u7u7u7u7u7u7u7u7u7u///47o+O6I7o+O6P//+O6P///+6Pju+OePh+////juj///+I/4iP+Ij/iP///47o//////////////////+O6P//////////////////juj//////////////////47o//////////////////+O6P//////////////////juj/////iP/////4j////47o////iO6I///4juj///+O6P//+O7ueP//+O7uj///juj///ju7o////+O7uj//47o//+O7o//////+I7u//+O6P//h4j////////45o//juj//4j///////////iP/47o//iP////////////iP+O6P/////4iP//////////juj/////h3j/iI///////47o/////47oiO7oj/////+O6P////ju7u7u7uiI////juj////47u7u7u7u6P///47o////+O7u7u7u7uj///+O6P////ju7u7u7u6P////juj////47u7u7u7o/////47o////+O7u7u7u6P////+O6P////7u7u7u7uj/////ju6IiIiO7u7u7u7oiIiIiO7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":95,"unified_at_epoch_ms":1791552813641,"unified_at":"2026-10-09T13:33:33.641Z","metadata":{"hashes":{"sha256":"e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447","sha1":"cb631fc0884a62c2ba60b6f5687049a5b43e8bc9","md5":"dfd1460ec0f69a630adf81e9e526a051","sha512":"5c451c80d31ce2204f32d31ec9a2914a0783073936e060e850291edd73a7ce3f46f43d30f36307663a7e10fa8ef0fcabed5374cf058096d0575ae24a8e1a350b","ssdeep":"98304:CT4c9CFGS1k5z9xT6vzmqu3lWC7zYB8/JvGlLNYSn4+gsk:r+5Bxmzm/l7zYB8slW+Jk","ssdeep_chunks":["98304:CT4c9CF","98304:T4c9CFG","98304:4c9CFGS","98304:c9CFGS1","98304:9CFGS1k","98304:CFGS1k5","98304:FGS1k5z","98304:GS1k5z9","98304:S1k5z9x","98304:1k5z9xT","98304:k5z9xT6","98304:5z9xT6v","98304:z9xT6vz","98304:9xT6vzm","98304:xT6vzmq","98304:T6vzmqu","98304:6vzmqu3","98304:vzmqu3l","98304:zmqu3lW","98304:mqu3lWC","98304:qu3lWC7","98304:u3lWC7z","98304:3lWC7zY","98304:lWC7zYB","98304:WC7zYB8","98304:C7zYB8/","98304:7zYB8/J","98304:zYB8/Jv","98304:YB8/JvG","98304:B8/JvGl","98304:8/JvGlL","98304:/JvGlLN","98304:JvGlLNY","98304:vGlLNYS","98304:GlLNYSn","98304:lLNYSn4","98304:LNYSn4+","98304:NYSn4+g","98304:YSn4+gs","98304:Sn4+gsk","196608:CT4c9CF","196608:T4c9CFG","196608:4c9CFGS","196608:c9CFGS1","196608:9CFGS1k","196608:CFGS1k5","196608:FGS1k5z","196608:GS1k5z9","196608:S1k5z9x","196608:1k5z9xT","196608:k5z9xT6","196608:5z9xT6v","196608:z9xT6vz","196608:9xT6vzm","196608:xT6vzmq","196608:T6vzmqu","196608:6vzmqu3","196608:vzmqu3l","196608:zmqu3lW","196608:mqu3lWC","196608:qu3lWC7","196608:u3lWC7z","196608:3lWC7zY","196608:lWC7zYB","196608:WC7zYB8","196608:C7zYB8/","196608:7zYB8/J","196608:zYB8/Jv","196608:YB8/JvG","196608:B8/JvGl","196608:8/JvGlL","196608:/JvGlLN","196608:JvGlLNY","196608:vGlLNYS","196608:GlLNYSn","196608:lLNYSn4","196608:LNYSn4+","196608:NYSn4+g","196608:YSn4+gs","196608:Sn4+gsk","98304:r+5Bxmz","98304:+5Bxmzm","98304:5Bxmzm/","98304:Bxmzm/l","98304:xmzm/l7","98304:mzm/l7z","98304:zm/l7zY","98304:m/l7zYB","98304:/l7zYB8","98304:l7zYB8s","98304:7zYB8sl","98304:zYB8slW","98304:YB8slW+","98304:B8slW+J","98304:8slW+Jk"],"imphash":"884310b1928934402ea6fec1dbd3cf5e"},"file_info":{"file_name":"dojo-delivery-dash.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":4594942,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1508518742000,"last_seen":1662940017000,"last_multi_scan":1662940017000}},"detections":{"summary":{"verdict":"malicious","score":95,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":14,"suspicious_count":8,"malicious_count":4,"total":26},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".reloc\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{943E1A5A-9FAD-40E8-A8F4-BCDA434D70CC}_IS1\")\n \"e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{943E1A5A-9FAD-40E8-A8F4-BCDA434D70CC}_IS1\")\n \"e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\E2799B3C57B63E80DDACF0ECA9CF11CD7093497E57687ACE4FB672CAEF617447.TMP\")\n \"e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\E2799B3C57B63E80DDACF0ECA9CF11CD7093497E57687ACE4FB672CAEF617447.TMP\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"informative","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)\" (SID: 2015744, Rev: 4, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"mi_exe_stub.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\is-KL4CB.tmp\\e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp\"\n \"e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp\" created file \"%TEMP%\\is-H933N.tmp\\_isetup\\_RegDLL.tmp\"\n \"e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp\" created file \"%TEMP%\\is-H933N.tmp\\_isetup\\_shfoldr.dll\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"_shfoldr.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"), Antivirus vendors marked dropped file \"is-6LK93.tmp\" as clean (type is \"PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"), Antivirus vendors marked dropped file \"is-D9UVN.tmp\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp\" searching for class \"Shell_TrayWnd\"\n \"Dojo Delivery Dash.exe\" searching for class \"MS_WINHELP\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp\" with commandline \"/SL5=\"$101A2\n4354295\n54272\nC:\\e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.exe\"\" (UID: 00015374-00002984)\n Spawned process \"Dojo Delivery Dash.exe\" (UID: 00028779-00003352)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$27","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$28","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$29","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"*.youtube-nocookie.com\" (Indicator: \"youtube\")\n \"*.youtube.com\" (Indicator: \"youtube\")\n \"*.youtubeeducation.com\" (Indicator: \"youtube\")\n \"youtube.com\" (Indicator: \"youtube\")\n \"youtubeeducation.com\" (Indicator: \"youtube\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.exe.bin\" has a PE timestamp using the buggy magic timestamp 0x2A425E19.\n \"is-D9UVN.tmp\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970\n \"e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.exe.bin\" was detected as \"Borland Delphi 4.0\"\n \"is-D9UVN.tmp\" was detected as \"Borland Delphi 3.0\"\n \"_RegDLL.tmp\" was detected as \"Morphine v1.2 (DLL)\"\n \"e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp\" was detected as \"Borland Delphi 3.0\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.99638855813","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Dojo Delivery Dash.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Dojo Delivery Dash.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"_shfoldr.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"\n \"is-6LK93.tmp\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"\n \"is-D9UVN.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"_RegDLL.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"Dojo Delivery Dash.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"_shfoldr.dll\" claimed CRC 36336 while the actual is CRC 4605248","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n OpenProcessToken\n RegOpenKeyExA\n GetFileAttributesA\n VirtualProtect\n GetVersionExA\n GetModuleFileNameA\n GetFileSize\n LockResource\n CreateDirectoryA\n DeleteFileA\n GetCommandLineA\n GetProcAddress\n GetModuleHandleA\n WriteFile\n LoadLibraryA\n CreateProcessA\n Sleep\n CreateFileA\n FindResourceA\n VirtualAlloc\n SetSecurityDescriptorDacl\n RegOpenKeyA\n RegCreateKeyExA\n GetFileAttributesW\n CreateDirectoryW\n FindResourceExW\n GetTempPathA\n LoadLibraryExA\n UnhandledExceptionFilter\n CreateThread\n GetTickCount\n GetStartupInfoA\n FindFirstFileA\n ShellExecuteA\n GetLastActivePopup\n SetWindowsHookExA\n FindWindowA\n GetWindowThreadProcessId\n RegDeleteKeyA\n GetUserNameA\n RegDeleteValueA\n RegEnumKeyExA\n CreateFileMappingA\n GetDriveTypeA\n DeviceIoControl\n CopyFileA\n TerminateProcess\n OpenProcess\n GetComputerNameA\n FindNextFileA\n MapViewOfFile\n ShellExecuteExA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"Dojo Delivery Dash.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/66 Antivirus vendors marked sample as malicious (1% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"1/88 Antivirus vendors marked dropped file \"_RegDLL.tmp\" as malicious (classified as \"Malware.HighConfidence\" with 1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Scans for the windows taskbar (often used for explorer injection)","description":"\"e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":5,"id":"api-17","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$2a","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":55,"dropped_files_count":0,"extracted_files_count":10,"files_written_count":42,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"59ea29687ca3e164b61f14e3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":95,"malware_family":"WebToolbar.RK","submit_name":"dojo-delivery-dash.exe","analysis_start_time":"2017-10-20T17:49:29+00:00","indicators_count":{"informative":14,"suspicious":12,"malicious":5},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}],"processes":[{"pid":2928,"ppid":0,"name":"e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.exe","command_line":"","sha256":"e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447","normalized_path":"C:\\e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.exe","uid":"00015220-00002928","icon":"$2b"},{"pid":2984,"ppid":2928,"name":"e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp","command_line":"/SL5=\"$101A2,4354295,54272,C:\\e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.exe\"","normalized_path":"%TEMP%\\is-KL4CB.tmp\\e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp","parent_uid":"00015220-00002928","uid":"00015374-00002984","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB7klEQVR42u2XzYrqMBiG5w5FdOeleBsiWLs8unfhHYg7F4J/iHjc+DszbRfaf/ue8yV0qh2DTeLs5oMXWmjyPGnyFfr29lu/lavpdIr9fo/T6YTD4VAw/PntdovhcIhSqQRlgdlshiRJoFJRFIHGk0SlUoGyQBAEbEISSZIrrldRYsRxFqrVaoXlconJZIJyuQxNATE4D08FNpu/2O127H48HqNWq0FZoMiqs0RsDK1+vV6za9u2MRgMUK1WISXg+75QQARPBebzObrdP//TRafTQa/XQ7/ff5WAGE4HkJLW8XhkMqPRiEloCsRCeArOEiIMw7tOWiwWOgLPV30LTwV4aJ4El8tFVUAHHrCQgOM4sgIee4XPX3kemoGpkyg0j+PYcgKelxeIlOBB4LNviaaAHDwT8F8hoAdPBeiDJCngsoGiFhOD7wXoMFMn2bYlL0ADi5zy/J7fwrlALC/gunkBNTh1k6ZAKA3nAt5XNATiAm0mXvmtgGUpCFALFjnlIjCFuom6yLI+dQSKwL+DeVwdgfBpiz2CcwH3K4oCFzawyCl/vPoXCejClQTov+B8PrP953AvJ+B+C20ZST9KGEb4+HiXE/iJKixQr9fRbDZhmm202zyGkV4bdzEMSuthWi0e0zTRaDTU/5R+uv4BptK4NzAQLaQAAAAASUVORK5CYII="},{"pid":3352,"ppid":2984,"name":"Dojo Delivery Dash.exe","command_line":"","sha256":"235b59076215747ca4adf8b5881961793233186d2d0e85fdba6d1097f14d5567","normalized_path":"%PROGRAMFILES%\\ePlaybus.com\\Dojo Delivery Dash\\Dojo Delivery Dash.exe","parent_uid":"00015374-00002984","uid":"00028779-00003352","icon":"$2c"}],"all_imported_dlls":["setupapi.dll","ExplorerFrame.dll","duser.dll","dui70.dll","kernel32.dll","lpk.dll","shlwapi.dll","mpr.dll","comdlg32.dll","ntmarta.dll","sspicli.dll","ntshrui.dll","sechost.dll","netmsg.dll","uxtheme.dll","dwmapi.dll","sfc.dll","linkinfo.dll","cscapi.dll","cryptsp.dll","user32.dll","ole32.dll","comctl32.dll","shell32.dll","Wldap32.dll","devobj.dll","slc.dll","olepro32.dll","msvcrt.dll","version.dll","shfolder.dll","imageres.dll","cfgmgr32.dll","RpcRtRemote.dll","gdi32.dll","_shfoldr.dll","sfc_os.dll","srvcli.dll","netutils.dll","rsaenh.dll","rpcrt4.dll","advapi32.dll","devrtl.dll","usp10.dll","oleaut32.dll","imm32.dll","msctf.dll","rpcss.dll","cryptbase.dll","clbcatq.dll","profapi.dll","ntdll.dll","KernelBase.dll","apphelp.dll","propsys.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"_RegDLL.tmp","sha256":"4dc09bac0613590f1fac8771d18af5be25a1e1cb8fdbf4031aa364f3057e74a2","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"name":"is-6LK93.tmp","sha256":"235b59076215747ca4adf8b5881961793233186d2d0e85fdba6d1097f14d5567","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"name":"is-D9UVN.tmp","sha256":"8a2444bc7c7edb0ea07fa7addb7474fc17449adca1a884a9b2abdc82cfd5ba80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"name":"_shfoldr.dll","sha256":"9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"name":"e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp","sha256":"78f6692d50d07bd78a97294d196f9ae7d1fc48b058375e5d7bb766970faab758","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"name":"is-2POA3.tmp","sha256":"ae03452111796ccfb5f37e726acee490cfc61f89feed171d0ac4f2cf53ccbdf3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"name":"is-HPKAE.tmp","sha256":"10dd3e7f412e91189106442f457d9a2649e5ade2381660d4b2c031d645eba752","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"name":"unins000.dat","sha256":"39cfc9223695ad0cedaba38884678eb28a02c5db9da1c6261cea371fbc92bf4e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"name":"Dojo Delivery Dash.lnk","sha256":"3c74473f1f4234fdba3a11e0da44ab6aa76985a2bc24a4150299e5372317e3ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"name":"ePlaybus Games.lnk","sha256":"027ad53715842f59fc0198f393e29792199ae4774644cbc77de518948f099362","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]}],"files_written":[{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%WINDIR%\\System32\\netmsg.dll","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%WINDIR%\\System32\\en-US\\netmsg.dll.mui","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%WINDIR%\\System32\\shfolder.dll","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%WINDIR%\\System32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%WINDIR%\\System32\\en-US\\imageres.dll.mui","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%TEMP%\\is-KL4CB.tmp\\e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.tmp","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"C:\\e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447.exe","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\ePlaybus.com","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\ePlaybus.com\\Dojo Delivery Dash","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\ePlaybus.com\\Dojo Delivery Dash\\Dojo Delivery Dash.lnk","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\ePlaybus.com\\Dojo Delivery Dash\\ePlaybus Games.lnk","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%PUBLIC%\\Desktop\\Dojo Delivery Dash.lnk","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%PROGRAMFILES%\\ePlaybus.com","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%PROGRAMFILES%\\ePlaybus.com\\Dojo Delivery Dash\\ePlaybus Games.url","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%PUBLIC%\\Desktop\\ePlaybus Games.lnk","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%PROGRAMFILES%\\ePlaybus.com\\Dojo Delivery Dash\\unins000.dat","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%PROGRAMFILES%\\ePlaybus.com\\Dojo Delivery Dash\\Dojo Delivery Dash.exe","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"59ea29687ca3e164b61f14e3"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["59ea29687ca3e164b61f14e3"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Sample e2799b3c57b6… — Score 95/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e2799b3c57b6…. Threat score 95/100. 0/28 AV engines flagged this file. 4 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample e2799b3c57b6… — Score 95/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e2799b3c57b6…. Threat score 95/100. 0/28 AV engines flagged this file. 4 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e2799b3c57b63e80ddacf0eca9cf11cd7093497e57687ace4fb672caef617447"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample e2799b3c57b6… — Score 95/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e2799b3c57b6…. Threat score 95/100. 0/28 AV engines flagged this file. 4 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]