26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4b1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Agent Sample e3d98cc45390… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e3d98cc45390…. Malware family: Trojan.Agent. Threat score 100/100. 9/25 AV engines flagged this file. 5 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e3d98cc4539068ce335f1240deb1d72a0b57b9ca5803254616ea4999b66703ad","keywords":["Malicious","Trojan.Agent","malware analysis","sandbox report","threat intelligence","e3d98cc4539068ce335f1240deb1d72a0b57b9ca5803254616ea4999b66703ad"],"about":{"@type":"SoftwareApplication","name":"e3d98cc4539068ce335f1240deb1d72a0b57b9ca5803254616ea4999b66703ad","applicationCategory":["peexe","executable"],"identifier":"e3d98cc4539068ce335f1240deb1d72a0b57b9ca5803254616ea4999b66703ad","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Agent","antivirusDetections":{"malicious":9,"total":25},"behavioralIndicators":{"malicious":5,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T94a,"AlticGO.exe" queries volume information of "C:\Windows\Fonts\segoeui.ttf" at 00000000-00003260-00000046-7178665 "AlticGO.exe" queries volume information of "C:\Windows\Fonts\segoeuib.ttf" at 00000000-00003260-00000046-7188601 "AlticGO.exe" queries volume information of "C:\Windows\Fonts\segoeuib.ttf" at 00000000-00003260-00000046-7251322 "AlticGO.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\AlticGO\logs\main.log" at 00000000-00003260-00000046-7551872 "AlticGO.exe" queries volume information of "C:\Windows\Fonts\ARIALN.TTF" at 00000000-00003260-00000046-21233403 "AlticGO.exe" queries volume information of "C:\Windows\Fonts\ARIALNI.TTF" at 00000000-00003260-00000046-21247990 "AlticGO.exe" queries volume information of "C:\Windows\Fonts\arialbi.ttf" at 00000000-00003260-00000046-21268966 "AlticGO.exe" queries volume information of "C:\Windows\Fonts\ARIALNBI.TTF" at 00000000-00003260-00000046-21279415 "AlticGO.exe" queries volume information of "C:\Windows\Fonts\ariblk.ttf" at 00000000-00003260-00000046-21289598 "AlticGO.exe" queries volume information of "C:\Windows\Fonts\timesbd.ttf" at 00000000-00003260-00000046-21396457 "AlticGO.exe" queries volume information of "C:\Windows\Fonts\timesbi.ttf" at 00000000-00003260-00000046-21406770 "AlticGO.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\AlticGO\Local Storage\leveldb\MANIFEST-000001" at 00000000-00003260-00000046-22101836 "AlticGO.exe" queries volume information of "C:\Windows\Fonts\ARIALNB.TTF" at 00000000-00003260-00000046-31225225 "AlticGO.exe" queries volume information of "C:\Windows\Fonts\timesi.ttf" at 00000000-00003260-00000046-31343490 "AlticGO.exe" queries volume information of "C:\" at 00000000-00003260-00000046-10902331009584145 "AlticGO.exe" queries volume information of "C:\Users" at 00000000-00003260-00000046-10902331009585029 "AlticGO.exe" queries volume information of "C:\Users\%OSUSER%" at 00000000-00003260-00000046-10902331009585796 "AlticGO.exe" queries volume information of "C:\Users\%OSUSER%\AppData" at 00000000-00003260-00000046-10902331009586516 "AlticGO.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00003260-00000046-10902331009587439 "AlticGO.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp" at 00000000-00003260-00000046-1090233100958812428:T5f6,"System.dll" contains export function called "Alloc" at ordinal 1 "System.dll" contains export function called "Call" at ordinal 2 "System.dll" contains export function called "Copy" at ordinal 3 "System.dll" contains export function called "Free" at ordinal 4 "System.dll" contains export function called "Get" at ordinal 5 "System.dll" contains export function called "Int64Op" at ordinal 6 "System.dll" contains export function called "Store" at ordinal 7 "System.dll" contains export function called "StrAlloc" at ordinal 8 "libGLESv2.dll" contains export function called "glActiveTexture" at ordinal 1 "libGLESv2.dll" contains export function called "glAttachShader" at ordinal 2 "libGLESv2.dll" contains export function called "glBeginQuery" at ordinal 221 "libGLESv2.dll" contains export function called "glBeginQueryEXT" at ordinal 310 "libGLESv2.dll" contains export function called "glBeginTransformFeedback" at ordinal 236 "libGLESv2.dll" contains export function called "glBindAttribLocation" at ordinal 3 "libGLESv2.dll" contains export function called "glBindBuffer" at ordinal 4 "libGLESv2.dll" contains export function called "glBindBufferBase" at ordinal 239 "libGLESv2.dll" contains export function called "glBindBufferRange" at ordinal 238 "libGLESv2.dll" contains export function called "glBindFramebuffer" at ordinal 5 "libGLESv2.dll" contains export function called "glBindFramebufferOES" at ordinal 311 "libGLESv2.dll" contains export function called "glBindRenderbuffer" at ordinal 629:T512,Antivirus vendors marked dropped file "System.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libGLESv2.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "d3dcompiler_47.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "snapshot_blob.bin" as clean (type is "data"), Antivirus vendors marked dropped file "v8_context_snapshot.bin" as clean (type is "data"), Antivirus vendors marked dropped file "StdUtils.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "nsis7z.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libEGL.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "elevate.exe" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "natives_blob.bin" as clean (type is "data"), Antivirus vendors marked dropped file "ffmpeg.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows")2a:T126c,"System.dll" file has an entrypoint instructions - "moveax, dword ptr [esp + 4],cmpdword ptr [esp + 8], 1,movdword ptr [0x10005048], eax,jne0x100029e3,push0x1000504c,push0x40,push4,push0x1000505c,calldword ptr [0x10004038],xoreax, eax,movbyte ptr [0x1000505c], 0xc2,movdword ptr [0x1000504c], eax,movdword ptr [0x10005054], eax,movdword ptr [0x10005068], eax,movdword ptr [0x10005058], eax,movdword ptr [0x10005050], eax,movdword ptr [0x10005060], eax,movbyte ptr [0x1000505e], al,xoreax, eax,inceax,ret0xc,moveax, 0x10000,ret,moveax, dword ptr [esp + 4]," "libGLESv2.dll" file has an entrypoint instructions - "movqword ptr [rsp + 8], rbx,movqword ptr [rsp + 0x10], rsi,pushrdi,subrsp, 0x20,movrdi, r8,movebx, edx,movrsi, rcx,cmpedx, 1,jne0x18031ce09,call0x18031ce28,movr8, rdi,movedx, ebx,movrcx, rsi,movrbx, qword ptr [rsp + 0x30],movrsi, qword ptr [rsp + 0x38],addrsp, 0x20,poprdi,jmp0x18031ccb4,int3,int3,int3,movqword ptr [rsp + 0x20], rbx,pushrbp,movrbp, rsp,subrsp, 0x20,movrax, qword ptr [rip + 0x75c5c],movabsrbx, 0x2b992ddfa232,cmprax, rbx,jne0x18031cebf," "d3dcompiler_47.dll" file has an entrypoint instructions - "movqword ptr [rsp + 8], rbx,movqword ptr [rsp + 0x10], rsi,pushrdi,subrsp, 0x20,movrdi, r8,movebx, edx,movrsi, rcx,cmpedx, 1,jne0x1802664f1,call0x180266d04,movr8, rdi,movedx, ebx,movrcx, rsi,movrbx, qword ptr [rsp + 0x30],movrsi, qword ptr [rsp + 0x38],addrsp, 0x20,poprdi,jmp0x18026638c,int3,int3,int3,int3,int3,int3,int3,int3,int3,nopword ptr [rax + rax],cmprcx, qword ptr [rip + 0x1b5af9],bnd jne0x18026653c,rolrcx, 0x10,testcx, 0xffff," "StdUtils.dll" file has an entrypoint instructions - "cmpdword ptr [esp + 8], 1,jne0x1000eae7,push0x10019550,calldword ptr [0x10014044],moveax, dword ptr [esp + 4],movdword ptr [0x1001959c], 0,movbyte ptr [0x10019582], 0,movdword ptr [0x10019598], eax,jmp0x1000eafe,cmpdword ptr [esp + 8], 0,jne0x1000eafe,call0x10005968,push0x10019550,calldword ptr [0x10014078],xoreax, eax,inceax,ret0xc,cmpdword ptr [esp + 4], 0,jl0x1000eb12,cmpdword ptr [esp + 4], 1,jle0x1000eb1d,push0x10014398,calldword ptr [0x1001403c]," "nsis7z.dll" file has an entrypoint instructions - "pushebp,movebp, esp,cmpdword ptr [ebp + 0xc], 1,jne0x10041926,call0x10041d9f,pushdword ptr [ebp + 0x10],pushdword ptr [ebp + 0xc],pushdword ptr [ebp + 8],call0x100417e7,addesp, 0xc,popebp,ret0xc,int3,int3,int3,int3,int3,pushecx,leaecx, [esp + 4],subecx, eax,sbbeax, eax,noteax,andecx, eax,moveax, esp,andeax, 0xfffff000,cmpecx, eax,bnd jb0x10041964,moveax, ecx,popecx,xchgeax, esp,moveax, dword ptr [eax],movdword ptr [esp], eax,bnd ret,subeax, 0x1000,testdword ptr [eax], eax,jmp0x10041954,jmp0x10045e26,pushebp,movebp, esp,pushesi,pushdword ptr [ebp + 8],movesi, ecx," "libEGL.dll" file has an entrypoint instructions - "movqword ptr [rsp + 8], rbx,movqword ptr [rsp + 0x10], rsi,pushrdi,subrsp, 0x20,movrdi, r8,movebx, edx,movrsi, rcx,cmpedx, 1,jne0x1800038d1,call0x1800038f0,movr8, rdi,movedx, ebx,movrcx, rsi,movrbx, qword ptr [rsp + 0x30],movrsi, qword ptr [rsp + 0x38],addrsp, 0x20,poprdi,jmp0x18000377c,int3,int3,int3,movqword ptr [rsp + 0x20], rbx,pushrbp,movrbp, rsp,subrsp, 0x20,movrax, qword ptr [rip + 0x1d714],movabsrbx, 0x2b992ddfa232,cmprax, rbx,jne0x180003987," "elevate.exe" file has an entrypoint instructions - "call0x401e04,jmp0x4018f0,pushebp,movebp, esp,push0,calldword ptr [0x413020],pushdword ptr [ebp + 8],calldword ptr [0x41301c],push0xc0000409,calldword ptr [0x413024],pusheax,calldword ptr [0x413028],popebp,ret,pushebp,movebp, esp,subesp, 0x324,push0x17,call0x410fd4,testeax, eax,je0x401ab7,push2,popecx,int0x29,movdword ptr [0x41a8f0], eax,movdword ptr [0x41a8ec], ecx,movdword ptr [0x41a8e8], edx,movdword ptr [0x41a8e4], ebx," "libEGL.dll" file has an entrypoint instructions - "movqword ptr [rsp + 8], rbx,movqword ptr [rsp + 0x10], rsi,pushrdi,subrsp, 0x20,movrdi, r8,movebx, edx,movrsi, rcx,cmpedx, 1,jne0x180029865,call0x180029884,movr8, rdi,movedx, ebx,movrcx, rsi,movrbx, qword ptr [rsp + 0x30],movrsi, qword ptr [rsp + 0x38],addrsp, 0x20,poprdi,jmp0x180029710,int3,int3,int3,movqword ptr [rsp + 0x20], rbx,pushrbp,movrbp, rsp,subrsp, 0x20,movrax, qword ptr [rip + 0x24780],movabsrbx, 0x2b992ddfa232,cmprax, rbx,jne0x18002991b," "ffmpeg.dll" file has an entrypoint instructions - "movqword ptr [rsp + 8], rbx,movqword ptr [rsp + 0x10], rsi,pushrdi,subrsp, 0x20,movrdi, r8,movebx, edx,movrsi, rcx,cmpedx, 1,jne0x180170a21,call0x180170a40,movr8, rdi,movedx, ebx,movrcx, rsi,movrbx, qword ptr [rsp + 0x30],movrsi, qword ptr [rsp + 0x38],addrsp, 0x20,poprdi,jmp0x1801708cc,int3,int3,int3,movqword ptr [rsp + 0x20], rbx,pushrbp,movrbp, rsp,subrsp, 0x20,movrax, qword ptr [rip + 0x8b954],movabsrbx, 0x2b992ddfa232,cmprax, rbx,jne0x180170ad7,"2b:Taba,"System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsl2194.tmp\System.dll]- [targetUID: 00000000-00003164] "libGLESv2.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\swiftshader\libGLESv2.dll]- [targetUID: 00000000-00003164] "d3dcompiler_47.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\d3dcompiler_47.dll]- [targetUID: 00000000-00003164] "snapshot_blob.bin" has type "data"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\snapshot_blob.bin]- [targetUID: 00000000-00003164] "v8_context_snapshot.bin" has type "data"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\v8_context_snapshot.bin]- [targetUID: 00000000-00003600] "StdUtils.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\nsl2194.tmp\StdUtils.dll]- [targetUID: 00000000-00003164] "nsis7z.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsl2194.tmp\nsis7z.dll]- [targetUID: 00000000-00003164] "libEGL.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\swiftshader\libEGL.dll]- [targetUID: 00000000-00003164] "elevate.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\resources\elevate.exe]- [targetUID: 00000000-00003164] "natives_blob.bin" has type "data"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\natives_blob.bin]- [targetUID: 00000000-00003600] "ffmpeg.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\ffmpeg.dll]- [targetUID: 00000000-00003600] "he.pak" has type "data"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\locales\he.pak]- [targetUID: 00000000-00003164] "lv.pak" has type "data"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\locales\lv.pak]- [targetUID: 00000000-00003164] "es.pak" has type "data"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\locales\es.pak]- [targetUID: 00000000-00003164] "fr.pak" has type "data"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\locales\fr.pak]- [targetUID: 00000000-00003164] "bn.pak" has type "data"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\locales\bn.pak]- [targetUID: 00000000-00003164] "data_3" has type "data"- Location: [%APPDATA%\AlticGO\Cache\data_3]- [targetUID: 00000000-00003260] "sl.pak" has type "data"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\locales\sl.pak]- [targetUID: 00000000-00003164] "pl.pak" has type "data"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\locales\pl.pak]- [targetUID: 00000000-00003164]2c:T566,"System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsl2194.tmp\System.dll]- [targetUID: 00000000-00003164] "libGLESv2.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\swiftshader\libGLESv2.dll]- [targetUID: 00000000-00003164] "d3dcompiler_47.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\d3dcompiler_47.dll]- [targetUID: 00000000-00003164] "StdUtils.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\nsl2194.tmp\StdUtils.dll]- [targetUID: 00000000-00003164] "nsis7z.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsl2194.tmp\nsis7z.dll]- [targetUID: 00000000-00003164] "libEGL.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\swiftshader\libEGL.dll]- [targetUID: 00000000-00003164] "elevate.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\resources\elevate.exe]- [targetUID: 00000000-00003164] "ffmpeg.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\ffmpeg.dll]- [targetUID: 00000000-00003600]2d:T566,"System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsl2194.tmp\System.dll]- [targetUID: 00000000-00003164] "libGLESv2.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\swiftshader\libGLESv2.dll]- [targetUID: 00000000-00003164] "d3dcompiler_47.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\d3dcompiler_47.dll]- [targetUID: 00000000-00003164] "StdUtils.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\nsl2194.tmp\StdUtils.dll]- [targetUID: 00000000-00003164] "nsis7z.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsl2194.tmp\nsis7z.dll]- [targetUID: 00000000-00003164] "libEGL.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\swiftshader\libEGL.dll]- [targetUID: 00000000-00003164] "elevate.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\resources\elevate.exe]- [targetUID: 00000000-00003164] "ffmpeg.dll" has type "PE32+ executable (DLL) (console) x86-64 for MS Windows"- Location: [%TEMP%\1jjFXKBINzialcdGn8mxefOD0H4\ffmpeg.dll]- [targetUID: 00000000-00003600]2e:T487,"AlticGO.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\AlticGO\GPUCache\data_0" with delete access "AlticGO.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\AlticGO\Code Cache\js\index-dir\temp-index" with delete access "AlticGO.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\AlticGO\GPUCache\index" with delete access "AlticGO.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\AlticGO\GPUCache\data_1" with delete access "AlticGO.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\AlticGO\GPUCache\data_2" with delete access "AlticGO.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\AlticGO\GPUCache\data_3" with delete access "AlticGO.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\AlticGO\Code Cache\js\INDEX-DIR\THE-REAL-INDEX" with delete access "AlticGO.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\AlticGO\Local Storage\leveldb\000001.dbtmp" with delete access "AlticGO.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\AlticGO\Cache\index" with delete access "AlticGO.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\AlticGO\Cache\data_0" with delete access "AlticGO.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\AlticGO\Cache\data_1" with delete access2f:T6d5,".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "AlticGO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "VI-VN") "AlticGO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "VI-VN") "AlticGO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "AlticGO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "AlticGO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "PL-PL") "AlticGO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "PL-PL") "AlticGO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "NB-NO") "AlticGO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "NB-NO") "AlticGO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "NL-NL") "AlticGO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "FR-CA") "AlticGO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FR-CA") "AlticGO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ES-ES") "AlticGO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ES-ES") "AlticGO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "PT-PT") "AlticGO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "PT-PT") "AlticGO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ES-MX")30:T5b2,".exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\1jjFXKBINzialcdGn8mxefOD0H4\AlticGO.exe" (Handle: 444) ".exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\1jjFXKBINzialcdGn8mxefOD0H4\AlticGO.exe" (Handle: 444) ".exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\1jjFXKBINzialcdGn8mxefOD0H4\AlticGO.exe" (Handle: 444) ".exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\1jjFXKBINzialcdGn8mxefOD0H4\AlticGO.exe" (Handle: 444) "AlticGO.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\1jjFXKBINzialcdGn8mxefOD0H4\AlticGO.exe" (Handle: 1028) "AlticGO.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\1jjFXKBINzialcdGn8mxefOD0H4\AlticGO.exe" (Handle: 1028) "AlticGO.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\1jjFXKBINzialcdGn8mxefOD0H4\AlticGO.exe" (Handle: 1028) "AlticGO.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\1jjFXKBINzialcdGn8mxefOD0H4\AlticGO.exe" (Handle: 1372) "AlticGO.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\1jjFXKBINzialcdGn8mxefOD0H4\AlticGO.exe" (Handle: 1372) "AlticGO.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\1jjFXKBINzialcdGn8mxefOD0H4\AlticGO.exe" (Handle: 1372)1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"e3d98cc4539068ce335f1240deb1d72a0b57b9ca5803254616ea4999b66703ad","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790404028353,"unified_at":"2026-09-26T06:27:08.353Z","metadata":{"hashes":{"sha256":"e3d98cc4539068ce335f1240deb1d72a0b57b9ca5803254616ea4999b66703ad","sha1":"ff17bd5abe9f4939918f27afbe0072c18df6db37","md5":"855b2f4c910602f895ee3c94118e979a","sha512":"88bd9df61f209a68dfe7d90881f5c69588b8bafbbd35710ea013f973214524ec3f85f31772ea0ddc4e76652a5cd4e5c9e54697d92e731eac24de342d59eb1c21","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"e3d98cc4539068ce335f1240deb1d72a0b57b9ca5803254616ea4999b66703ad","file_type":["peexe","executable"],"file_type_id":"exe","file_size":46745505,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1666150682000,"last_seen":1710131944000,"last_multi_scan":1710131944000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["downloader","labyrinthchollima","sparkdownloader","targeted","adware","nsis"]},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":25},"sandbox_signatures":{"informative_count":41,"suspicious_count":23,"malicious_count":5,"total":69},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Unwanted/Win.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Application.Miner.LH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"JS/Agent.DL trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005ab5421 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.xaoxzg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.2767131","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Imports GetCommandLine API"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to enable or disable privileges in the specified access token (API string)"},{"type":"suspicious","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"suspicious","value":"Contains ability to obtains specified information about the security of a file or directory"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","identifiers":[{"type":"suspicious","value":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to query volume size"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve a module handle for the specified module"},{"type":"suspicious","value":"Contains ability to retrieve the specified system metric or system configuration setting"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Imports GetEnvironmentVariable API"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Queries volume information of an entire harddrive"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Reads the hosts file"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"},{"type":"suspicious","value":"Contains a remote desktop related string"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1471","attack_id_wiki":"https://attack.mitre.org/techniques/T1471","identifiers":[{"type":"informative","value":"Imports Crypto related APIs"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"malicious","value":"Contains ability to reboot/shutdown the operating system"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 64642-844-00402075\n SetUnhandledExceptionFilter@KERNEL32.dll at 64642-556-00401A76","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"Cryptographic Related","name":"Imports Crypto related APIs","description":"Observed import api \"CryptProtectData\" which can \"performs encryption on the data\" [Source: StdUtils.dll]\n Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: StdUtils.dll]","origin":"Static Parser","mitre_attack_id":"T1471","relevance":1,"id":"static-82","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00003164-49671-44-00406C25\n FindNextFileW@KERNEL32.DLL at 00000000-00003164-49671-29-004014FA\n FindFirstFileW@KERNEL32.DLL at 00000000-00003164-49671-42-00406A15\n FindNextFileW@KERNEL32.DLL at 00000000-00003164-54343-29-004014FA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00000000-00003164-49671-1-004039ED","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00003164-49671-123-004042E3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"AlticGO.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"AlticGO.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, cx\" and \"je 00403A39h\" at 00000000-00003164-49671-1-004039ED","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 64642-859-0040AC12","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$27","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"AlticGO.exe\" queries volume information of \"C:\\\" at 00000000-00003260-00000046-10902331009584145","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00003164-49671-24-0040643F\n LoadLibraryExW@KERNEL32.DLL at 00000000-00003164-49671-29-004014FA\n LoadLibraryExW@KERNEL32.DLL at 00000000-00003164-54343-29-004014FA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$28","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$29","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"\"SHGetFolderPathW\" (Indicator: \"SHGetFolderPathW\")\n \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStringsW\")\n \"SetCurrentDirectoryW\" (Indicator: \"SetCurrentDirectoryW\")\n \"DeleteFileW\" (Indicator: \"DeleteFileW\")\n \"FindClose\" (Indicator: \"FindClose\")\n \"FindFirstFileW\" (Indicator: \"FindFirstFileW\")\n \"FindNextFileW\" (Indicator: \"FindNextFileW\")\n \"GetFileAttributesW\" (Indicator: \"GetFileAttributesW\")\n \"GetFullPathNameW\" (Indicator: \"GetFullPathNameW\")\n \"SetFileAttributesW\" (Indicator: \"SetFileAttributesW\")\n \"SetFilePointer\" (Indicator: \"SetFilePointer\")\n \"CloseHandle\" (Indicator: \"CloseHandle\")\n \"GetLastError\" (Indicator: \"GetLastError\")\n \"FreeLibrary\" (Indicator: \"FreeLibrary\")\n \"GetModuleHandleW\" (Indicator: \"GetModuleHandleW\")\n \"LoadLibraryExW\" (Indicator: \"LoadLibraryExW\")\n \"GlobalAlloc\" (Indicator: \"GlobalAlloc\")\n \"GlobalFree\" (Indicator: \"GlobalFree\")\n \"lstrcmpiW\" (Indicator: \"lstrcmpiW\")\n \"GetPrivateProfileStringW\" (Indicator: \"GetPrivateProfileStringW\")","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \".exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")\n \"AlticGO.exe\" touched \"TF_ThreadMgr\" (Path: \"HKCU\\CLSID\\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\\INPROCSERVER32\")\n \"AlticGO.exe\" touched \"TF_CategoryMgr\" (Path: \"HKCU\\CLSID\\{A4B544A1-438D-4B41-9325-869523E2D6C7}\")\n \"AlticGO.exe\" touched \"TF_DisplayAttributeMgr\" (Path: \"HKCU\\CLSID\\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\\TREATAS\")\n \"AlticGO.exe\" touched \"MMDeviceEnumerator class\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{BCDE0395-E52F-467C-8E3D-C4579291692E}\\TREATAS\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"System.dll\" has an executable section named \".text\"\n \"libGLESv2.dll\" has an executable section named \".text\"\n \"d3dcompiler_47.dll\" has an executable section named \".text\"\n \"StdUtils.dll\" has an executable section named \".text\"\n \"nsis7z.dll\" has an executable section named \".text\"\n \"libEGL.dll\" has an executable section named \".text\"\n \"elevate.exe\" has an executable section named \".text\"\n \"ffmpeg.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"System.dll\" has an writable section named \".data\"\n \"libGLESv2.dll\" has an writable section named \".data\"\n \"libGLESv2.dll\" has an writable section named \".tls\"\n \"d3dcompiler_47.dll\" has an writable section named \".data\"\n \"StdUtils.dll\" has an writable section named \".data\"\n \"nsis7z.dll\" has an writable section named \".data\"\n \"libEGL.dll\" has an writable section named \".data\"\n \"libEGL.dll\" has an writable section named \".tls\"\n \"elevate.exe\" has an writable section named \".data\"\n \"ffmpeg.dll\" has an writable section named \".data\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2a","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"AlticGO.exe\" (UID: 00000000-00003260) was launched with new environment variables: \"PORTABLE_EXECUTABLE_DIR=\"C:\", PORTABLE_EXECUTABLE_FILE=\"C:\\e3d98cc4539068ce335f1240deb1d72a0b57b9ca5803254616ea4999b66703ad.exe\", PROCESSOR_ARCHITEW6432=\"AMD64\", PORTABLE_EXECUTABLE_APP_FILENAME=\"AlticGO\"\"\n Process \"AlticGO.exe\" (UID: 00000000-00003260) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"AlticGO.exe\" (UID: 00000000-00003340) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"AlticGO.exe\" (UID: 00000000-00003340) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\".exe\" searching for class \"#32770\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"AlticGO.exe\" (UID: 00000000-00003260)\n Spawned process \"AlticGO.exe\" with commandline \"--type=utility --field-trial-handle=1016,4842723913914359035,854 ...\" (UID: 00000000-00003340)\n Spawned process \"AlticGO.exe\" with commandline \"--type=renderer --field-trial-handle=1016,4842723913914359035,85 ...\" (UID: 00000000-00003600)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"AlticGO.exe\" (UID: 00000000-00003260)\n Spawned process \"AlticGO.exe\" with commandline \"--type=utility --field-trial-handle=1016,4842723913914359035,854 ...\" (UID: 00000000-00003340)\n Spawned process \"AlticGO.exe\" with commandline \"--type=renderer --field-trial-handle=1016,4842723913914359035,85 ...\" (UID: 00000000-00003600)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"AlticGO.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$2b","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"AlticGO.exe\" touched file \"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"}_S ].kI\"\n Heuristic match: \"{Vbb;D{$p.XN\"\n Heuristic match: \"voH;pR.KW\"\n Heuristic match: \"vqL^wt.UA\"\n Heuristic match: \"{8}NbH.gA\"\n Heuristic match: \"{..exe\" opened \"\\Device\\KsecDD\"\n \"AlticGO.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$2c","origin":"Binary File","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"nsis7z.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"elevate.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"AlticGO.exe\" queried SystemProcessInformation at 00000000-00003340-00000033-10902331008799349\n \"AlticGO.exe\" queried SystemProcessInformation at 00000000-00003600-00000033-6129739","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00003164-49671-32-0040342F\n GetTickCount@KERNEL32.DLL at 00000000-00003164-49671-78-004036D7\n GetTickCount@KERNEL32.DLL at 00000000-00003164-49671-79-00403673\n GetTickCount@KERNEL32.DLL at 00000000-00003164-49671-82-00406FC4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 64642-34-00402176","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle for the specified module","description":"GetModuleHandleA@KERNEL32.DLL at 00000000-00003164-49671-23-00406E4E\n GetModuleHandleW@KERNEL32.DLL at 00000000-00003164-49671-29-004014FA\n GetModuleHandleW@KERNEL32.DLL at 00000000-00003164-54343-29-004014FA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the specified system metric or system configuration setting","description":"GetSystemMetrics@USER32.DLL at 00000000-00003164-49671-135-00404D84","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-122","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"AlticGO.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"22/64 Antivirus vendors marked sample as malicious (34% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$2d","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\".exe\" wrote 12288 bytes starting with PE header signature to file \"%TEMP%\\nsl2194.tmp\\System.dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.1.4.0\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"suspicious","category":"Network Related","name":"Reads the hosts file","description":"\"AlticGO.exe\" read 4096 bytes from file \"%WINDIR%\\System32\\drivers\\etc\\hosts\"","origin":"API Call","mitre_attack_id":"T1018","relevance":10,"id":"api-33","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains a remote desktop related string","description":"\",wX~vncR)\" (Indicator for product: Generic VNC)","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":10,"id":"string-27","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"AlticGO.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"GLASSSESSIONID\")","origin":"Registry Access","mitre_attack_id":"T1021.001","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\".exe\" marked \"%APPDATA%\\AlticGO\\Cache\\data_0\" for deletion\n \"AlticGO.exe\" marked \"%APPDATA%\\AlticGO\\Cache\\data_1\" for deletion\n \"AlticGO.exe\" marked \"%APPDATA%\\AlticGO\\Cache\\data_2\" for deletion\n \"AlticGO.exe\" marked \"%APPDATA%\\AlticGO\\Cache\\data_3\" for deletion\n \"AlticGO.exe\" marked \"%APPDATA%\\AlticGO\\Cache\\index\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2e","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"suspicious","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\".exe\" called \"AdjustTokenPrivileges\" (UID: 00000000-00003164)","origin":"API Call","mitre_attack_id":"T1134","relevance":5,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to adjust token privileges","description":"LookupPrivilegeValueW@ADVAPI32.DLL at 00000000-00003164-49671-1-004039ED","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.003","relevance":5,"id":"stream-76","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory","description":"SetFileSecurityW@ADVAPI32.DLL at 00000000-00003164-49671-20-0040609B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.001","relevance":3,"id":"stream-117","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"d3dcompiler_47.dll\" claimed CRC 4511220 while the actual is CRC 3897582\n \"StdUtils.dll\" claimed CRC 142210 while the actual is CRC 4511220","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryW\n VirtualProtect\n GetProcAddress\n VirtualAlloc\n GetModuleHandleW\n GetDriveTypeW\n GetFileAttributesW\n UnhandledExceptionFilter\n WriteFile\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryExW\n CreateThread\n TerminateProcess\n GetModuleHandleExW\n GetModuleHandleExA\n GetVersionExW\n GetTickCount\n LoadLibraryA\n GetStartupInfoW\n DeleteFileW\n GetFileSizeEx\n FindNextFileW\n FindFirstFileExW\n CreateFileW\n GetSystemInfo\n GetCommandLineW\n GetCommandLineA\n GetModuleHandleA\n Sleep\n recv\n socket\n bind\n accept\n WSAStartup\n send\n closesocket\n listen\n RegCloseKey\n RegOpenKeyExW\n RegOpenKeyExA\n RegEnumKeyExA\n DeviceIoControl\n MapViewOfFileEx\n CreateFileMappingW\n MapViewOfFile\n OutputDebugStringA\n CreateFileA\n GetFileSize\n ShellExecuteW\n ShellExecuteExW\n GetWindowThreadProcessId\n OpenProcessToken\n GetTempPathW\n ExitThread\n CreateDirectoryW\n FindFirstFileW\n FindWindowExW\n LoadLibraryExA\n SleepConditionVariableSRW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"d3dcompiler_47.dll\" claims program is from Sun Jun 26 22:21:55 2050","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"22/64 Antivirus vendors marked sample as malicious (34% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"AlticGO.exe\" allocated memory in \"%WINDIR%\\System32\\credssp.dll\"","origin":"API Call","mitre_attack_id":"T1055.012","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$30","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00000000-00003164-49671-1-004039ED","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1529","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Reads terminal service related keys (often RDP related)"},{"detail":"Contains a remote desktop related string"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"Spyware","details_count":3,"details":[{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries process information"},{"detail":"Reads the windows installation language"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to detect virtual environment (API)"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":107,"dropped_files_count":0,"extracted_files_count":29,"files_written_count":55,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["downloader","labyrinthchollima","sparkdownloader","targeted","adware","nsis"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"634f6e9d927c885cc50a2901","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Application.Miner","submit_name":"e3d98cc4539068ce335f1240deb1d72a0b57b9ca5803254616ea4999b66703ad","analysis_start_time":"2022-10-19T03:27:34+00:00","indicators_count":{"informative":41,"suspicious":45,"malicious":5},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}],"processes":[{"pid":3164,"ppid":0,"name":"e3d98cc4539068ce335f1240deb1d72a0b57b9ca5803254616ea4999b66703ad.exe","command_line":"","sha256":"e3d98cc4539068ce335f1240deb1d72a0b57b9ca5803254616ea4999b66703ad","normalized_path":"C:\\e3d98cc4539068ce335f1240deb1d72a0b57b9ca5803254616ea4999b66703ad.exe","uid":"00000000-00003164","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABCElEQVR42u2XSxKDIBBEvWUWEfSSOOQi2ShwFCImWv4GUBnNwqliJUW/aRrULLvrn+oNT6sht0oUJMNIZmv5sChA88qtG1QA/frr4sCHCRQQ47WdFtp9P0xFCDB3Yf4wtQvY+p24Egyd0AA7DgA5un7ttiKcXNrxc4EGYsiTT9yVFqUXQLdWbRXXAQANxTSIqV1YnCqsewqIWi6DrST3i6cEwFIfBEgBgR5p3zU8BfAH0oAneBAAaO+VqLfiXhcOdx8L4d4TpOJ7XEgOsAWCRLwDqHjwhgwFz8gDADEukHUfA7F24yUX/25FeV33mAunincA468jyb3iqmKW5L/hsu7HdVrw7jqrPuihmRnKO0FIAAAAAElFTkSuQmCC"},{"pid":3260,"ppid":3164,"name":"AlticGO.exe","command_line":"","sha256":"69474f417b57b1b6568269aa1c4875578a693ac8c3f89a5e283048185ebff089","normalized_path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\AlticGO.exe","parent_uid":"00000000-00003164","uid":"00000000-00003260"},{"pid":3340,"ppid":3260,"name":"AlticGO.exe","command_line":"--type=utility --field-trial-handle=1016,4842723913914359035,8542258422319803163,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --service-request-channel-token=8041523099111583009 --mojo-platform-channel-handle=1312 /prefetch:8","sha256":"69474f417b57b1b6568269aa1c4875578a693ac8c3f89a5e283048185ebff089","normalized_path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\AlticGO.exe","parent_uid":"00000000-00003260","uid":"00000000-00003340"},{"pid":3600,"ppid":3260,"name":"AlticGO.exe","command_line":"--type=renderer --field-trial-handle=1016,4842723913914359035,8542258422319803163,131072 --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --app-path=\"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\resources\\app.asar\" --node-integration --no-sandbox --no-zygote --background-color=#fff --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=1409833587049085454 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1380 /prefetch:1","sha256":"69474f417b57b1b6568269aa1c4875578a693ac8c3f89a5e283048185ebff089","normalized_path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\AlticGO.exe","parent_uid":"00000000-00003260","uid":"00000000-00003600"}],"all_imported_dlls":["user32.dll","usp10.dll","msctf.dll","nsis7z.dll","dxva2.dll","winsta.dll","gdi32.dll","ole32.dll","oleaut32.dll","comdlg32.dll","credssp.dll","StdUtils.dll","crypt32.dll","wship6.dll","propsys.dll","System.dll","ffmpeg.dll","wshqos.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","nlaapi.dll","dhcpcsvc6.dll","urlmon.dll","kernel32.dll","KernelBase.dll","imm32.dll","api-ms-win-downlevel-version-l1-1-0.dll","rpcss.dll","version.dll","wow64cpu.dll","uxtheme.dll","profapi.dll","setupapi.dll","advapi32.dll","d3d9.dll","d3d8thk.dll","wow64.dll","ws2_32.dll","shell32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","normaliz.dll","MMDevAPI.dll","atl.dll","mfplat.dll","msvcrt.dll","nsi.dll","shfolder.dll","devobj.dll","apphelp.dll","winhttp.dll","mswsock.dll","dxgi.dll","shlwapi.dll","wow64win.dll","fltLib.dll","psapi.dll","dbghelp.dll","DWrite.dll","iertutil.dll","tzres.dll","oleacc.dll","oleaccrc.dll","sspicli.dll","cryptbase.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","winnsi.dll","dhcpcsvc.dll","avrt.dll","lpk.dll","UIAutomationCore.dll","msimg32.dll","secur32.dll","powrprof.dll","cryptsp.dll","rasadhlp.dll","dnsapi.dll","sechost.dll","rpcrt4.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","WSHTCPIP.DLL","mf.dll","ksuser.dll","mfreadwrite.dll","wtsapi32.dll","winmm.dll","cfgmgr32.dll","ntmarta.dll","Wldap32.dll","api-ms-win-core-synch-l1-2-0.dll","IconCodecService.dll","ncrypt.dll","bcrypt.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","comctl32.dll","ntdll.dll","dwmapi.dll","WindowsCodecs.dll","webio.dll","userenv.dll","msasn1.dll","d3d11.dll","api-ms-win-downlevel-user32-l1-1-0.dll","wininet.dll","mscms.dll","IPHLPAPI.DLL","VxSSL64.dll","hid.dll","clbcatq.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"d3dcompiler_47.dll","sha256":"4b074a3976399dc735484f5d43d04b519b7bdee8ac719d9ab8ed6bd4e6be0345","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"ffmpeg.dll","sha256":"787d472e060446fd3a7a2cf8856b5e9f212eda85381df067ac4709b0c3b000a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"natives_blob.bin","sha256":"02586eeaf4ce40d1b34310d885e34fb63e8e9f155fcedbd796536735907cbe80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"elevate.exe","sha256":"9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"snapshot_blob.bin","sha256":"4f0195b0b6b5be146396c38450c89be519aef9244887991db4955e50e167eb59","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"libEGL.dll","sha256":"cc1ac36359f95cc08433f7447a5bde45764b0007f50a8071607180e9e6f7c85d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"libGLESv2.dll","sha256":"687505d35be893ad98c836620afe142ea2a2cef328151ba8767e5f30a6941fc0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"v8_context_snapshot.bin","sha256":"25b3a8326201f6940611c49eabecaff1648d31c27ff38dd192015b23e7dc75e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"StdUtils.dll","sha256":"b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"System.dll","sha256":"3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"nsis7z.dll","sha256":"b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"data_3","sha256":"e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"81cb3e09-e5cc-4ed6-9727-72a6d88056f1.tmp","sha256":"226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"data_0","sha256":"d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"data_1","sha256":"ac13860c69f1ac63feab5e926599a8e99d5552300ec097eb755d11768f427a03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"data_2","sha256":"ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"index","sha256":"a254abb284d9b48fa80fb6de79f66e2bc53bf4d2f778ec95c7ab495a4a5c73d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"temp-index","sha256":"ca6bad18a3118d0c438639c188e6b53d3a1f72e4ce82c96f9980190b49c1d35c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"000001.dbtmp","sha256":"0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"LOG","sha256":"ff9c737b21ee876bf50829e3afb353d4956f97c12169a4cf60dfe1fb6e3f98a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"MANIFEST-000001","sha256":"f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"main.log","sha256":"c5e77c9066cfe2071978a1bc01d75320bd1f3d25c840037a2d9312e7ec5ce529","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"LICENSE.electron.txt","sha256":"34f6f27c26d1bb8682ebb42ae401f558228fd608455bd7c6561d5fd500b7d05b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"LICENSES.chromium.html","sha256":"67885e1586ecf0354e79467340cebe4d977b8ddcb432f7e832008b4ff3c8a1ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"chrome_100_percent.pak","sha256":"d8cbc2234f40b49437a5876bb008b6b43afdf92391dec3f0739be98e448ab671","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"chrome_200_percent.pak","sha256":"55dd419a1cecca86665ba5e6184d6b58edf714d652e67c5220dd3b407d99afa8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"am.pak","sha256":"e0ef4ba4fb1d4570123ac1311e67da9358cc028fbc0a5816b563d4ba0179f5ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"ar.pak","sha256":"1e894a2b00f957a913e1ba768ffcf30c29b570d2eab307790fc761fa55f44225","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"name":"bg.pak","sha256":"0beda1647b0760046a7b18e4498a62b727b6320141e0a3b0cd864cabb7eb21ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]}],"files_written":[{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\nsl2194.tmp","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\am.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\bg.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\bn.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\ca.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\cs.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\da.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\de.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\el.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\es-419.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\es.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\et.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\fi.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\fil.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\he.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\hr.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\it.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\ja.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\lt.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\mr.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\pl.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\pt-BR.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\ro.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\ru.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\sk.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\sv.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\uk.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\zh-CN.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\libEGL.dll","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\resources","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\swiftshader\\libEGL.dll","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\swiftshader","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\fa.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\hi.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\ms.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\te.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%TEMP%\\1jjFXKBINzialcdGn8mxefOD0H4\\locales\\tr.pak","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%APPDATA%\\AlticGO\\Code Cache\\js\\index","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%APPDATA%\\AlticGO\\GPUCache\\data_0","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%APPDATA%\\AlticGO\\GPUCache\\data_1","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%APPDATA%\\AlticGO\\GPUCache\\data_2","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%APPDATA%\\AlticGO\\GPUCache\\data_3","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%APPDATA%\\AlticGO\\logs\\main.log","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%APPDATA%\\AlticGO\\Cache\\data_2","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%APPDATA%\\AlticGO\\Local Storage\\leveldb\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"path":"%APPDATA%\\AlticGO\\Local Storage\\leveldb\\000003.log","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\DIRECT3D\\MOSTRECENTAPPLICATION\\","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"634f6e9d927c885cc50a2901"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["634f6e9d927c885cc50a2901"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Agent Sample e3d98cc45390… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e3d98cc45390…. Malware family: Trojan.Agent. Threat score 100/100. 9/25 AV engines flagged this file. 5 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e3d98cc4539068ce335f1240deb1d72a0b57b9ca5803254616ea4999b66703ad"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Agent Sample e3d98cc45390… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e3d98cc45390…. Malware family: Trojan.Agent. Threat score 100/100. 9/25 AV engines flagged this file. 5 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e3d98cc4539068ce335f1240deb1d72a0b57b9ca5803254616ea4999b66703ad"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Agent Sample e3d98cc45390… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e3d98cc45390…. Malware family: Trojan.Agent. Threat score 100/100. 9/25 AV engines flagged this file. 5 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]