26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T48a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Swrort Sample eae53d89d7ad… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample eae53d89d7ad…. Malware family: Trojan.Swrort. Threat score 100/100. 18/28 AV engines flagged this file. 15 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/eae53d89d7add187dfe6f4498c99144d7650c37a99792e0e40035d83f73cfb02","keywords":["Malicious","Trojan.Swrort","malware analysis","sandbox report","threat intelligence","eae53d89d7add187dfe6f4498c99144d7650c37a99792e0e40035d83f73cfb02"],"about":{"@type":"SoftwareApplication","name":"CrunchyViewer.exe","applicationCategory":["peexe","executable"],"identifier":"eae53d89d7add187dfe6f4498c99144d7650c37a99792e0e40035d83f73cfb02","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Swrort","antivirusDetections":{"malicious":18,"total":28},"behavioralIndicators":{"malicious":15,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T958,Found API call GetSystemTime@KERNEL32.dll (Target: "eae53d89d7add187dfe6f4498c99144d7650c37a99792e0e40035d83f73cfb02.exe.bin"; Stream UID: "3807-40844-0078E957") which is directly followed by "cmp esi, esp" and "cmp esi, esp". See related instructions: "... +2419833 push ebp +2419834 mov ebp, esp +2419836 sub esp, 000000E0h +2419842 push ebx +2419843 push esi +2419844 push edi +2419845 lea edi, dword ptr [ebp-000000E0h] +2419851 mov ecx, 00000038h +2419856 mov eax, CCCCCCCCh +2419861 rep stosd +2419863 mov esi, esp +2419865 mov eax, dword ptr [ebp+08h] +2419868 push eax +2419869 call dword ptr [0104B2C4h] ;GetSystemTime +2419875 cmp esi, esp" ... at 3807-40844-0078E957 Found API call GetVersionExW@KERNEL32.dll (Target: "eae53d89d7add187dfe6f4498c99144d7650c37a99792e0e40035d83f73cfb02.exe.bin"; Stream UID: "3807-41435-0079CC82") which is directly followed by "cmp esi, esp" and "cmp esi, esp". See related instructions: "... +1590965 mov dword ptr [ebp-00000124h], 0000011Ch +1590975 mov esi, esp +1590977 lea eax, dword ptr [ebp-00000124h] +1590983 push eax +1590984 call dword ptr [0104B2ACh] ;GetVersionExW +1590990 cmp esi, esp" ... at 3807-41435-0079CC82 Found API call GetLocalTime@KERNEL32.dll (Target: "eae53d89d7add187dfe6f4498c99144d7650c37a99792e0e40035d83f73cfb02.exe.bin"; Stream UID: "3807-43803-0078F38E") which is directly followed by "cmp esi, esp" and "cmp esi, esp". See related instructions: "... +2414834 push ebp +2414835 mov ebp, esp +2414837 sub esp, 000000DCh +2414843 push ebx +2414844 push esi +2414845 push edi +2414846 lea edi, dword ptr [ebp-000000DCh] +2414852 mov ecx, 00000037h +2414857 mov eax, CCCCCCCCh +2414862 rep stosd +2414864 mov eax, dword ptr [0103C2B8h] +2414869 xor eax, ebp +2414871 mov dword ptr [ebp-04h], eax +2414874 mov esi, esp +2414876 lea eax, dword ptr [ebp-18h] +2414879 push eax +2414880 call dword ptr [0104B304h] ;GetLocalTime +2414886 cmp esi, esp" ... at 3807-43803-0078F38E Found API call GetSystemTime@KERNEL32.dll (Target: "eae53d89d7add187dfe6f4498c99144d7650c37a99792e0e40035d83f73cfb02.exe.bin"; Stream UID: "3807-42413-007805B4") which is directly followed by "cmp esi, esp" and "cmp esi, esp". See related instructions: "... +1927419 mov esi, esp +1927421 lea eax, dword ptr [ebp-40h] +1927424 push eax +1927425 call dword ptr [0104B2C4h] ;GetSystemTime +1927431 cmp esi, esp" ... at 3807-42413-007805B428:T1a31,Heuristic match: "Watch Videos Online \| (.+) \| Veoh\.com" Heuristic match: "(.+) / Streaming - Wakanim.TV" Pattern match: "https://github.com/nlohmann/json" Pattern match: "https://curl.haxx.se/docs/http-cookies.html" Heuristic match: "ftp@example.com" Pattern match: "http://taiga.moe/#support" Pattern match: "https://anidb.net/perl-bin/animedb.pl?show=animelist&adb.search=%title%&noalias=1&do.update=update" Pattern match: "https://en.wikipedia.org/wiki/Special:Search?search=%title%" Pattern match: "https://github.com/erengy/anisthesia" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "http://hb.cybrox.eu" Pattern match: "http://hummingboard.me" Pattern match: "http://graph.anime.plus" Pattern match: "http://mal.oko.im" Pattern match: "https://hb.wopian.me" Pattern match: "http://www.senpai.moe/?mode=calendar" Pattern match: "http://www.monthly.moe/weekly" Pattern match: "http://anichart.net/airing" Pattern match: "http://fansubdb.com" Pattern match: "http://because.moe" Pattern match: "https://raw.githubusercontent.com/erengy/anime-seasons/master/data/" Pattern match: "kitsu.io/api" Pattern match: "https://kitsu.io" Heuristic match: "myanimelist.net" Pattern match: "https://myanimelist.net/anime/" Pattern match: "https://myanimelist.net/anime.php?q=" Pattern match: "https://myanimelist.net/history/" Pattern match: "https://myanimelist.net/panel.php" Pattern match: "https://myanimelist.net/profile/" Pattern match: "https://myanimelist.net/anime.php?sd=" Heuristic match: "api.twitter.com" Pattern match: "https://api.twitter.com/oauth/authorize?oauth_token=" Pattern match: "https://myanimelist.cdn-dena.com/images/anime/13/22128.jpg" Pattern match: "https://nyaa.si/?page=rss&c=1_2&f=0&q=%title%" Pattern match: "https://www.tokyotosho.info/rss.php?filter=1,11&zwnj=0" Pattern match: "https://www.animelab.com" Pattern match: "https://www.animenewsnetwork.com/video/" Pattern match: "http://www.crunchyroll.com" Pattern match: "https://www.hidive.com" Pattern match: "https://www.plex.tv" Pattern match: "http://www.veoh.com" Pattern match: "https://www.viz.com/watch" Pattern match: "https://vrv.co" Pattern match: "https://www.wakanim.tv" Pattern match: "https://www.youtube.com" Pattern match: "http://taiga.moe}}{\fldrslt{Home" Pattern match: "https://github.com/erengy/taiga}}{\fldrslt{GitHub" Pattern match: "https://kitsu.io/groups/taiga}}{\fldrslt{Kitsu" Pattern match: "https://myanimelist.net/clubs.php?cid=21400}}{\fldrslt{MyAnimeList" Pattern match: "https://twitter.com/taigaapp}}{\fldrslt{Twitter" Pattern match: "irc.rizon.net/taiga}}{\fldrslt{IRC" Pattern match: "https://github.com/madler/zlib}}{\fldrslt{zlib" Pattern match: "https://github.com/JuliaLang/utf8proc}}{\fldrslt{utf8proc" Pattern match: "https://github.com/zeux/pugixml}}{\fldrslt{pugixml" Pattern match: "https://github.com/curl/curl}}{\fldrslt{libcurl" Pattern match: "https://github.com/yusukekamiyamane/fugue-icons}}{\fldrslt{Fugue" Pattern match: "https://github.com/HowardHinnant/date}}{\fldrslt{date" Pattern match: "http://twitter.com/" Pattern match: "https://anidex.info/rss/?cat=1&lang_id=1" Pattern match: "http://haruhichan.com/feed/feed.php?mode=rss" Pattern match: "http://horriblesubs.info/rss.php?res=all" Pattern match: "https://nyaa.pantsu.cat/feed?c=3_5&s=0" Pattern match: "https://nyaa.si/?page=rss&c=1_2&f=0" Pattern match: "http://tracker.minglong.org/rss.xml" Pattern match: "https://www.shanaproject.com/feeds/site/" Pattern match: "https://anidex.info/rss/?cat=1&lang_id=1&q=%title%" Pattern match: "https://nyaa.pantsu.cat/feed?c=3_5&s=0&q=%title%" Pattern match: "https://myanimelist.net/register.php" Pattern match: "http://taiga.moe/update/update_beta.xml" Pattern match: "http://taiga.moe" Pattern match: "https://raw.githubusercontent.com/erengy/anime-relations/master/anime-relations.txt" Heuristic match: "raw.githubusercontent.com" Pattern match: "www.digicert.com1/0-" Pattern match: "www.github.com0" Pattern match: "www.github.com" Heuristic match: "*.github.com" Heuristic match: "github.com" Heuristic match: "*.github.io" Heuristic match: "github.io" Heuristic match: "*.githubusercontent.com" Pattern match: "http://crl3.digicert.com/sha2-ha-server-g5.crl04" Pattern match: "http://crl4.digicert.com/sha2-ha-server-g5.crl0L" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "http://ocsp.digicert.com0M" Pattern match: "cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt0" Pattern match: "www.digicert.com1+0" Pattern match: "http://ocsp.digicert.com0K" Pattern match: "http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Heuristic match: "nyaa.si" Heuristic match: "nyaa.se" Pattern match: "myanimelist.net/history/" Pattern match: "t.net/panel.php" Pattern match: "myanimelist.net/profile/" Pattern match: "myanimelist.cdn-dena.com/images/anime/13/22128.jpg" Pattern match: "www.animelab.com" Pattern match: "animenewsnetwork.com/video/" Pattern match: "www.hidive.com" Pattern match: "www.plex.tv" Pattern match: "www.veoh.com" Heuristic match: "h Videos Online \| (.+) \| Veoh\.com" Pattern match: "www.wakanim.tv" Pattern match: "www.youtube.com" Pattern match: "n.net/taiga}}{\fldrslt{IRC" Pattern match: "aiga.moe/#support" Pattern match: "ichan.com/feed/feed.php?mode=rss" Pattern match: "nyaa.pantsu.cat/feed?c=3_5&s=0" Pattern match: "tracker.minglong.org/rss.xml" Pattern match: "ject.com/feeds/site/" Pattern match: "anidex.info/rss/?cat=1&lang_id=1&q=%title%" Pattern match: "http://taiga.moe/update.php?channel=beta&check=auto&service=myanimelist&username&version=1.3.0-beta" Pattern match: "http://taiga.moe/download.php?channel=beta" Heuristic match: "2017-11-04 12:14:33 [Debug] http.cpp:432 taiga::HttpManager::ProcessQueue | Connections for hostname is now 1: raw.githubusercontent.com" Heuristic match: "Host: raw.githubusercontent.com" Pattern match: "https://myanimelist.net/anime/{id}/{title" Pattern match: "https://kitsu.io/api/edge/anime?filter[text]={title" Pattern match: "https://github.com/erengy/anime-relations" Heuristic match: "2017-11-04 12:14:33 [Debug] http.cpp:462 taiga::HttpManager::FreeConnection | Connections for hostname is now 0: raw.githubusercontent.com" Pattern match: "https://hb.wopian.me MALgraph|http://graph.anime.plus - AniChart|http://anichart.net/airing Monthly.moe|https://www.monthly.moe/weekly Senpai" Pattern match: "https://www.tokyotosho.info/rss.php?filter=1,11&zwnj=0" Pattern match: "https://nyaa.si/?page=rss&c=1_2&f=0&q=%title%"29:T7ce,"youtube\.com/watch" (Indicator: "youtube") "YouTube|(?:" (Indicator: "youtube") ")?(.+) - YouTube" (Indicator: "youtube") "action="KitsuViewFeed()"/> ... MyAnimeList --> ... Share --> ... Tools --> " wrote bytes "c0df10771cf90f77ccf80f770d64117700000000c011fb7500000000fc3efb7500000000e013fb75000000009457ee7525e01077c6e0107700000000bc6aed7500000000cf31fb75000000009319ee75000000002c32fb7500000000" to virtual address "0x770B1000" (part of module "NSI.DLL") "" wrote bytes "711146017a3b4501ab8b02007f950200fc8c0200729602006cc805001ecd42017d264201" to virtual address "0x75D007E4" (part of module "USER32.DLL") "svchost.exe" wrote bytes "c0df10771cf90f77ccf80f770d64117700000000c011fb7500000000fc3efb7500000000e013fb75000000009457ee7525e01077c6e0107700000000bc6aed7500000000cf31fb75000000009319ee75000000002c32fb7500000000" to virtual address "0x770B1000" (part of module "NSI.DLL") "svchost.exe" wrote bytes "7d07147781ed1277ae861177c6e01077effd13772d16127760141477478d1177a8e210776089117700000000ad3736768b2d3676b641367600000000" to virtual address "0x73611000" (part of module "WSHTCPIP.DLL") "svchost.exe" wrote bytes "711146017a3b4501ab8b02007f950200fc8c0200729602006cc805001ecd42017d264201" to virtual address "0x75D007E4" (part of module "USER32.DLL") "CrunchyFixSetup.exe" wrote bytes "d0550075647309750000000051c1e2759498e275ee9ce27575dce475273ee4750fb3e875000000008548fb756987fb750f77fd75d917fb75ead7fc75a934fb75f811fb752014fb753a84fc75f516fb755414fb75ff10fb753214fb7500000000" to virtual address "0x73831000" (part of module "SHFOLDER.DLL") "CrunchyFixSetup.exe" wrote bytes "711146017a3b4501ab8b02007f950200fc8c0200729602006cc805001ecd42017d264201" to virtual address "0x75D007E4" (part of module "USER32.DLL")2f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAhzMzMzMzMzMzMzMzMzMwCIgzMzMzMzMzMzMzMzMzMLiIMzMzMzMzMzMzMzMzMzuIiDMzMzMzMzMzMzMzMzM4iIgzMzMzMzMzMzMzMzMzMzMzMzMzM3czMzMzMzMzMzMzMzMzN4gzM3czMzMzMzMzMzMzO48zOP///3MzMzMzMzMzM7/zM//////4MzMzMzMzMzOPcz///////4MzMzMzMzM4+DOP///////4MzMzMzMzP/cz/////////zMzMzMzM4/zOP////////8zMzMzMzOP8zj/////////czMzMzMz/4M4//////9zeHMzMzMzM/+DOP/////zMzMzMzMzMzP/8zf/////czMzMzMzMzMz//Mz/////zMzMzczMzMzM4/4M3////8zMzM3MzMzMzOP/zM4////gzMzgzMzMzMzP/+DM3////gzM4MzMzMzMzj/+DMzeIiHMz9zMzMzMzMzj/+DMzMzMzf4MzMzMzMzM7///4MzMzeP+zMzMzMzMzM7j///+I//+LMzMzMzMzMzMzj//////4MzMzMzMzMzMzMzOI//+IMzMzMzMzMzMzMzMzMzMzMzMzMziIhzMzMzMzMzMzMzMzMzM4iIgzMzMzMzMzMzMzMzMzOIiwMzMzMzMzMzMzMzMzMziLADMzMzMzMzMzMzMzMzM4sADgAAAAwAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAADAAAABw==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"eae53d89d7add187dfe6f4498c99144d7650c37a99792e0e40035d83f73cfb02","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790286342782,"unified_at":"2026-09-24T21:45:42.782Z","metadata":{"hashes":{"sha256":"eae53d89d7add187dfe6f4498c99144d7650c37a99792e0e40035d83f73cfb02","sha1":"0b68ef0c2155ceda4b2e25298ab5f75eac621121","md5":"af9370395d6dde90b045c1e0f8a2e212","sha512":"186859c7a519812ce577ea56a22b6b4436c6a5e8c70c64e815e9207e81fbc847038e6eb74c8ab62b85d514c082b3d1d8e7229f22b501376f469e93d4fd791681","ssdeep":"196608:1/LVUp3895RH6bQXRsdWD1177TLAM2/31RJJUu7Eb4WIB:MVq4X","ssdeep_chunks":["196608:1/LVUp3","196608:/LVUp38","196608:LVUp389","196608:VUp3895","196608:Up3895R","196608:p3895RH","196608:3895RH6","196608:895RH6b","196608:95RH6bQ","196608:5RH6bQX","196608:RH6bQXR","196608:H6bQXRs","196608:6bQXRsd","196608:bQXRsdW","196608:QXRsdWD","196608:XRsdWD1","196608:RsdWD11","196608:sdWD117","196608:dWD1177","196608:WD1177T","196608:D1177TL","196608:1177TLA","196608:177TLAM","196608:77TLAM2","196608:7TLAM2/","196608:TLAM2/3","196608:LAM2/31","196608:AM2/31R","196608:M2/31RJ","196608:2/31RJJ","196608:/31RJJU","196608:31RJJUu","196608:1RJJUu7","196608:RJJUu7E","196608:JJUu7Eb","196608:JUu7Eb4","196608:Uu7Eb4W","196608:u7Eb4WI","196608:7Eb4WIB","393216:1/LVUp3","393216:/LVUp38","393216:LVUp389","393216:VUp3895","393216:Up3895R","393216:p3895RH","393216:3895RH6","393216:895RH6b","393216:95RH6bQ","393216:5RH6bQX","393216:RH6bQXR","393216:H6bQXRs","393216:6bQXRsd","393216:bQXRsdW","393216:QXRsdWD","393216:XRsdWD1","393216:RsdWD11","393216:sdWD117","393216:dWD1177","393216:WD1177T","393216:D1177TL","393216:1177TLA","393216:177TLAM","393216:77TLAM2","393216:7TLAM2/","393216:TLAM2/3","393216:LAM2/31","393216:AM2/31R","393216:M2/31RJ","393216:2/31RJJ","393216:/31RJJU","393216:31RJJUu","393216:1RJJUu7","393216:RJJUu7E","393216:JJUu7Eb","393216:JUu7Eb4","393216:Uu7Eb4W","393216:u7Eb4WI","393216:7Eb4WIB"],"imphash":"85a130298aceda21e46e9d26b10733fd"},"file_info":{"file_name":"CrunchyViewer.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":9689600,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1509794723000,"last_seen":1677400067000,"last_multi_scan":1677400067000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["criminal"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":27,"suspicious_count":23,"malicious_count":15,"total":65},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Swrort.tp5w","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Dropper/Win32.Swrort","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.Swrort.ivvdd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Agent.ZGR trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0051b0e91 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Swrort.anc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Swrort.euubog","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Mdrop-IAG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Swrort.9689600","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_TRUEBOT.CRB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_TRUEBOT.CRB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Swrort","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Swrort.Win32.495","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Swrort","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 3807-36516-00D39F70\n SetUnhandledExceptionFilter@KERNEL32.dll at 54557-351-00401308\n SetUnhandledExceptionFilter@KERNEL32.dll at 54557-633-0040195A","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".textbss\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 3807-27544-0078B612\n GetSystemTimeAsFileTime@KERNEL32.dll at 3807-34799-0079FAA9\n GetSystemTime@KERNEL32.dll at 3807-40844-0078E957\n GetLocalTime@KERNEL32.dll at 3807-43803-0078F38E\n GetSystemTime@KERNEL32.dll at 3807-42413-007805B4","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 3807-31656-00E02E90\n GetTimeZoneInformation@KERNEL32.dll at 3807-41754-00792E67","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 3807-24105-00788C87\n GetVersionExW@KERNEL32.dll at 3807-41435-0079CC82","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"EnumSystemLocalesW@KERNEL32.dll at 3807-25326-00E58F80\n GetUserDefaultLCID@KERNEL32.dll at 3807-25325-00E59000\n EnumSystemLocalesW@KERNEL32.dll at 3807-25330-00E59050\n EnumSystemLocalesW@KERNEL32.dll at 3807-25327-00E59170\n GetUserDefaultLCID@KERNEL32.dll at 3807-25285-00791B4D\n EnumSystemLocalesW@KERNEL32.dll at 3807-25299-00E3BC90","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$27","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 3807-31889-00E388C0\n GetProcessHeap@KERNEL32.dll at 54557-645-004060FC","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\EAE53D89D7ADD187DFE6F4498C99144D7650C37A99792E0E40035D83F73CFB02.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\EAE53D89D7ADD187DFE6F4498C99144D7650C37A99792E0E40035D83F73CFB02.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"taiga.moe\"\n \"raw.githubusercontent.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"145.239.41.131:6969\"\n \"104.131.84.31:80\"\n \"151.101.0.133:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"%USERPROFILE%\\Desktop\\taiga-develop\\bin\\Debug\\Taiga.pdb\"\n \"%USERPROFILE%\\source\\repos\\svchost\\Release\\svchost.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Taiga-33d5a63c-de90-432f-9a8b-f6f733dab258\"\n \"DBWinMutex\"\n \"Taiga-33d5a63c-de90-432f-9a8b-f6f733dab258\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /update.php?channel=beta&check=auto&service=myanimelist&username&version=1.3.0-beta HTTP/1.1\nHost: taiga.moe\nUser-Agent: Crunchyroll/1.3\nAccept: */*\"\n \"GET /update/update_beta.xml HTTP/1.1\nHost: taiga.moe\nUser-Agent: Crunchyroll/1.3\nAccept: */*\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 6A7B0000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"svchost.exe\" (UID: 00014910-00002932)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"svchost.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"history.xml\" has type \"XML 1.0 document UTF-8 Unicode (with BOM) text\"\n \"Crunchyroll.log\" has type \"UTF-8 Unicode text with CRLF LF line terminators\"\n \"settings.xml\" has type \"XML 1.0 document UTF-8 Unicode (with BOM) text with very long lines\"\n \"anime-relations.txt\" has type \"UTF-8 Unicode text\"\n \"anime.xml\" has type \"XML 1.0 document UTF-8 Unicode (with BOM) text\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"\" touched file \"%WINDIR%\\System32\\tzres.dll\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\tzres.dll.mui\"\n \"\" touched file \"%WINDIR%\\Fonts\\StaticCache.dat\"\n \"\" touched file \"%WINDIR%\\System32\\imageres.dll\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\imageres.dll.mui\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\msctf.dll.mui\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\user32.dll.mui\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\duser.dll.mui\"\n \"\" touched file \"%WINDIR%\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\comctl32.dll.mui\"\n \"svchost.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"$29","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"eae53d89d7add187dfe6f4498c99144d7650c37a99792e0e40035d83f73cfb02.exe.bin\" was detected as \"Microsoft visual C++ 8.0\"\n \"svchost.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 17 calls to GetProcAddress@KERNEL32.dll at 3807-35951-00D5F7A0\n Found 40 calls to GetProcAddress@KERNEL32.dll at 3807-37738-00D09890","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"eae53d89d7add187dfe6f4498c99144d7650c37a99792e0e40035d83f73cfb02.exe.bin\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to measure performance","description":"rdtsc at 3807-34997-00798D3A\n rdtsc at 3807-34411-00789D62","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-6","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"$2a","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/63 reputation engines marked \"https://github.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.dll at 3807-49395-00788755","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"svchost.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"svchost.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"svchost.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"JAVA\"; Value: \"%APPDATA%\\svchost.exe \")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$2b","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"\"\" (Indicator: \"login=\")","origin":"File/Memory","relevance":10,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"svchost.exe\" claimed CRC 0 while the actual is CRC 9706286","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n RegOpenKeyExW\n RegEnumKeyExW\n CryptEncrypt\n RegDeleteKeyW\n GetDriveTypeW\n FindFirstFileW\n GetFileAttributesW\n UnhandledExceptionFilter\n WriteFile\n LockResource\n OutputDebugStringA\n OutputDebugStringW\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryA\n LoadLibraryExA\n LoadLibraryExW\n CreateThread\n TerminateProcess\n GetModuleHandleExW\n SleepEx\n LoadLibraryW\n GetVersionExW\n GetTickCount\n VirtualProtect\n ExitThread\n OpenProcess\n GetStartupInfoW\n GetProcAddress\n GetFileSizeEx\n FindFirstFileExA\n FindNextFileW\n FindNextFileA\n FindFirstFileExW\n CreateFileW\n GetCommandLineW\n GetCommandLineA\n GetTickCount64\n GetModuleHandleA\n GetModuleHandleW\n GetFileAttributesExW\n FindResourceW\n CreateProcessW\n Sleep\n VirtualAlloc\n ShellExecuteW\n GetUpdateRect\n SetWindowsHookExW\n FindWindowW\n GetWindowThreadProcessId\n accept\n WSAStartup\n connect\n recv\n send\n listen\n closesocket\n socket\n bind\n recvfrom\n sendto","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a fake system process","description":"Process \"svchost.exe\" at non-system pathway \"%APPDATA%\\svchost.exe\" (UID: 00014910-00002932)","origin":"Monitored Target","relevance":10,"id":"target-33","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/65 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"malicious","category":"Installation/Persistance","name":"Scans for the windows taskbar (often used for explorer injection)","description":"\"\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":5,"id":"api-17","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%APPDATA%\\svchost.exe\" (Handle: 232)\n \"\" wrote 52 bytes to a remote process \"%APPDATA%\\svchost.exe\" (Handle: 232)\n \"\" wrote 4 bytes to a remote process \"%APPDATA%\\svchost.exe\" (Handle: 232)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2c","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 145.239.41.131 on port 6969","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2d","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"CrunchyFixSetup.exe\" created file \"%TEMP%\\nsqBE41.tmp\\System.dll\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"System.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"Taiga.exe\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"CrunchyFixSetup.exe\" connecting to \"\\ThemeApiPort\"\n \"Taiga.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"CrunchyFixSetup.exe\" opened \"\\Device\\KsecDD\"\n \"Taiga.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"Taiga.exe\" queried SystemProcessInformation at 00015730-00003824-00000033-72555414","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%WINDIR%\\win.ini\"\n \"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"CrunchyFixSetup.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"recv@WS2_32.DLL at 00015730-00003824-35567-769-00B87720\n recv@WS2_32.DLL at 00015730-00003824-35567-785-00B87270\n recvfrom@WS2_32.DLL at 00015730-00003824-35567-1352-00BA0E40\n recv@WS2_32.DLL at 00015730-00003824-35567-1666-00B87400\n recv@WS2_32.DLL at 00015730-00003824-35567-1667-00B872F0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 43048-8461-0044D4F2","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\CrunchyFixSetup.exe\" marked \"%APPDATA%\\svchost.exe\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"CrunchyFixSetup.exe\" opened \"%APPDATA%\\svchost.exe\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2e","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"malicious","category":"Environment Awareness","name":"Found a Wine emulator related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\"; File: \"eae53d89d7add187dfe6f4498c99144d7650c37a99792e0e40035d83f73cfb02.exe.bin\")","origin":"File/Memory","relevance":2,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET POLICY PE EXE or DLL Windows file download HTTP\" (SID: 2018959, Rev: 3, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"45/67 Antivirus vendors marked sample as malicious (67% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"2/67 Antivirus vendors marked dropped file \"Uninstall.exe\" as malicious (classified as \"Suspicious_GEN.F47V0921\" with 2% detection rate)\n 1/68 Antivirus vendors marked dropped file \"CrunchyFixSetup.exe\" as malicious (classified as \"BehavesLike.ObfusRansom\" with 1% detection rate)\n 48/68 Antivirus vendors marked dropped file \"svchost.exe\" as malicious (classified as \"Trojan.Shelma\" with 70% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"48/68 Antivirus vendors marked spawned process \"svchost.exe\" (PID: 3208) as malicious (classified as \"Trojan.Shelma\" with 70% detection rate)\n 1/68 Antivirus vendors marked spawned process \"CrunchyFixSetup.exe\" (PID: 3864) as malicious (classified as \"BehavesLike.ObfusRansom\" with 1% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"\" allocated memory in \"%WINDIR%\\AppPatch\\sysmain.sdb\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: Crunchyroll/1.3\n Taiga/1.3","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Creates a fake system process"}],"sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":82,"dropped_files_count":0,"extracted_files_count":26,"files_written_count":122,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":7,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":12,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":2,"contacted_urls_count":7,"http_requests_count":7},"behavior_tags":["criminal"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"5a4195077ca3e1314904d93d","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Swrort","contacted_countries":["FRA","USA"],"submit_name":"OTX_eae53d89d7add187dfe6f4498c99144d7650c37a99792e0e40035d83f73cfb02","analysis_start_time":"2017-12-26T01:31:35+00:00","indicators_count":{"informative":27,"suspicious":28,"malicious":14},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true},{"id":"59fda17b7ca3e1197924a673","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"ml.Generic","contacted_countries":["FRA","USA"],"submit_name":"CrunchyViewer.exe","analysis_start_time":"2017-11-04T12:13:25+00:00","indicators_count":{"informative":22,"suspicious":18,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"145.239.41.131","port":6969,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"address":"104.131.84.31","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"address":"151.101.0.133","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"}]}],"dns_resolutions":[{"domain":"raw.githubusercontent.com","address":"151.101.120.133","country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"GitHub, Inc.","registrar_name_servers":"NS-1411.AWSDNS-48.ORG","registrar_creation_date":"2014-02-06T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"}]},{"domain":"taiga.moe","address":"104.131.84.31","country":"United States","registrar_name":"Dynadot LLC","registrar_name_servers":"ns1.digitalocean.com","registrar_creation_date":"2015-10-21T20:01:15+00:00","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]}],"http_requests":[{"host":"taiga.moe","host_ip":"104.131.84.31:80","url":"/update.php?channel=beta&check=auto&service=myanimelist&username&version=1.3.0-beta","method":"GET","response_code":"302","response_phrase":"Moved Temporarily","header":"GET /update.php?channel=beta&check=auto&service=myanimelist&username&version=1.3.0-beta HTTP/1.1\nHost: taiga.moe\nUser-Agent: Crunchyroll/1.3\nAccept: */*","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"host":"taiga.moe","host_ip":"104.131.84.31:80","url":"/update/update_beta.xml","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /update/update_beta.xml HTTP/1.1\nHost: taiga.moe\nUser-Agent: Crunchyroll/1.3\nAccept: */*","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"}]},{"host":"taiga.moe","host_ip":"104.131.84.31:80","url":"/update/update_crunchyfix.xml","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /update/update_crunchyfix.xml HTTP/1.1\nHost: taiga.moe\nUser-Agent: Crunchyroll/1.3\nAccept: */*","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"host":"taiga.moe","host_ip":"104.131.84.31:80","url":"/download.php?channel=crunchyfix","method":"GET","response_code":"302","response_phrase":"Moved Temporarily","header":"GET /download.php?channel=crunchyfix HTTP/1.1\nHost: taiga.moe\nUser-Agent: Crunchyroll/1.3\nAccept: */*","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"host":"taiga.moe","host_ip":"104.131.84.31:80","url":"/update/CrunchyFixSetup.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /update/CrunchyFixSetup.exe HTTP/1.1\nHost: taiga.moe\nUser-Agent: Crunchyroll/1.3\nAccept: */*","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"host":"taiga.moe","host_ip":"104.131.84.31:80","url":"/update.php?channel=crunchyfix&check=auto&service=myanimelist&username&version=1.3.0-crunchyfix","method":"GET","response_code":"302","response_phrase":"Moved Temporarily","header":"GET /update.php?channel=crunchyfix&check=auto&service=myanimelist&username&version=1.3.0-crunchyfix HTTP/1.1\nHost: taiga.moe\nUser-Agent: Taiga/1.3\nAccept: */*","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"host":"taiga.moe","host_ip":"104.131.84.31:80","url":"/update/update_stable.xml","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /update/update_stable.xml HTTP/1.1\nHost: taiga.moe\nUser-Agent: Taiga/1.3\nAccept: */*","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}],"processes":[{"pid":1844,"ppid":0,"name":"eae53d89d7add187dfe6f4498c99144d7650c37a99792e0e40035d83f73cfb02.exe","command_line":"","sha256":"eae53d89d7add187dfe6f4498c99144d7650c37a99792e0e40035d83f73cfb02","normalized_path":"C:\\eae53d89d7add187dfe6f4498c99144d7650c37a99792e0e40035d83f73cfb02.exe","uid":"00010202-00001844","icon":"$2f"},{"pid":3208,"ppid":1844,"name":"svchost.exe","command_line":"","sha256":"61ce0980d7b9e7fa352e64b7434a67cebcdd1e7de3dd98651253e28693fbef74","normalized_path":"%APPDATA%\\svchost.exe","parent_uid":"00010202-00001844","uid":"00010375-00003208"},{"pid":3864,"ppid":1844,"name":"CrunchyFixSetup.exe","command_line":"/S /D=C:\\","sha256":"04ac2daacf80b2a6d2c30d4676588601cb6e6a6dd6227806865e8873cc891e31","normalized_path":"C:\\CrunchyFixSetup.exe","parent_uid":"00010202-00001844","uid":"00015571-00003864"},{"pid":3824,"ppid":3864,"name":"Taiga.exe","command_line":"","sha256":"49bf0266bd3e2de2f4245e8cffe58795659ae3abd21e913bd3de187e3d004fae","normalized_path":"%APPDATA%\\Taiga\\Taiga.exe","parent_uid":"00015571-00003864","uid":"00015730-00003824"}],"all_imported_dlls":["oleaut32.dll","imm32.dll","secur32.dll","riched20.dll","clbcatq.dll","dnsapi.dll","IPHLPAPI.DLL","ntdll.dll","msvcrt.dll","crypt32.dll","gdi32.dll","shlwapi.dll","wship6.dll","cryptbase.dll","imageres.dll","nsi.dll","msasn1.dll","lpk.dll","usp10.dll","comdlg32.dll","sspicli.dll","msftedit.dll","WSHTCPIP.DLL","advapi32.dll","Wldap32.dll","apphelp.dll","winnsi.dll","cryptsp.dll","schannel.dll","bcryptprimitives.dll","duser.dll","sechost.dll","ws2_32.dll","msctf.dll","dwmapi.dll","rasadhlp.dll","FWPUCLNT.DLL","KernelBase.dll","rpcrt4.dll","ncrypt.dll","bcrypt.dll","ExplorerFrame.dll","kernel32.dll","uxtheme.dll","comctl32.dll","ole32.dll","GdiPlus.dll","credssp.dll","dui70.dll","normaliz.dll","user32.dll","mswsock.dll","rpcss.dll","xmllite.dll","shell32.dll","setupapi.dll","urlmon.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","wow64.dll","propsys.dll","profapi.dll","version.dll","cfgmgr32.dll","oleaccrc.dll","shfolder.dll","wow64cpu.dll","api-ms-win-downlevel-user32-l1-1-0.dll","WindowsCodecs.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","iertutil.dll","wininet.dll","ntmarta.dll","api-ms-win-core-synch-l1-2-0.dll","tzres.dll","userenv.dll","wow64win.dll","oleacc.dll","System.dll","devobj.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"svchost.exe","sha256":"61ce0980d7b9e7fa352e64b7434a67cebcdd1e7de3dd98651253e28693fbef74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"Crunchyroll.log","sha256":"75e8a7a821eeb244417a9ceaa1260c1cd280d434580829fce10f805d63d4b1e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"}]},{"name":"anime-relations.txt","sha256":"7fe833eb8343dfb78ab137e692b34b184ec9e93d88186bf41576f06126db99ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"anime.xml","sha256":"88423a2aa08b8fd939d0fbdfdbce4fc1a7639f9869abfdadfa258271b9c83de7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"history.xml","sha256":"d342883d970be6ed9a21e9f999ed0999175351e0ae9f96439562090c43b2dc97","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"}]},{"name":"settings.xml","sha256":"d271a7bb3adbeb2ea58e4e9e43a7c65eb54c6b82ef68db298a49034e12593239","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"}]},{"name":"Uninstall.exe","sha256":"0b458b322c48784b7d75ecce6ef9a6adcd0a6a6698644bf515a4fab0f83aec48","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"CrunchyFixSetup.exe","sha256":"04ac2daacf80b2a6d2c30d4676588601cb6e6a6dd6227806865e8873cc891e31","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"Taiga.exe","sha256":"49bf0266bd3e2de2f4245e8cffe58795659ae3abd21e913bd3de187e3d004fae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"System.dll","sha256":"904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"Taiga.log","sha256":"5e7d186d34ce983f158f9a16475c61a88cacde653a543d1cce88c7aab343d7fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"2011_fall.xml","sha256":"30e42f72e87bea7d7b04e98cd0673c1da6a3e1026829dd1022167ae315eb90ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"2011_spring.xml","sha256":"b6b5068ba8a59cc4ba2c2c770d2416a8f541adb56cd63d48b8829ffcb941c260","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"2011_summer.xml","sha256":"76a2e06ee4459b176776a186071eadafaa94a1624a9eb0530c3c486955c66397","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"2011_winter.xml","sha256":"8c2556eed057d01f5e3cb145f45b7017077113560bc19a41f09bf4ab368f315b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"2012_fall.xml","sha256":"0bdaaa5853098bffb29715274b958243aeab061c7711bfa3a0551fcd38ec3519","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"2012_spring.xml","sha256":"9e154d61f78149e3eb49ec8997d21c471f1d3863c44a262604c9ab8674e16139","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"2012_summer.xml","sha256":"fbcbe6df19af7e7b0aacd79e291eae980230fef4b4a1569386654ecea4759c5f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"2012_winter.xml","sha256":"bf6d49d2ef5121c7decc3817c0791a312a60d95ae82cc7c93a7ac65a905c1372","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"2013_fall.xml","sha256":"8cd5d92811e434eb6802c73b54c883dcf209d762f0e17486db060357077f45b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"2013_spring.xml","sha256":"621fea80c8717406a4b57947c676dbd3c8c26c6a9c4354236854dc273171c4f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"2013_summer.xml","sha256":"5d4470d2a63e62734042a378795abf30b0e3fc8b9e957f84b73191d55984b633","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"2013_winter.xml","sha256":"d21fc24995653befeda55522cebde88cf3e29305ee2c59385a6651883ecd85d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"2014_fall.xml","sha256":"b0e4338dad6132e8bdfc39d03e3bf92661a40011788929eadd33fb0b3bee8cda","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"2014_spring.xml","sha256":"8deb63f5cc0f5a32c163d905f4669ee1fb71e47376fb9a6c24a61527e41d2de4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"2014_summer.xml","sha256":"0b8ebc213d2da69d02002322ed16dde006085ee3ff28e767fe0c4d7868fc8709","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]}],"files_written":[{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"}]},{"path":"C:\\eae53d89d7add187dfe6f4498c99144d7650c37a99792e0e40035d83f73cfb02.exe","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"}]},{"path":"C:\\data\\players.anisthesia","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"C:\\data\\theme\\Default\\theme.xml","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%WINDIR%\\System32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"}]},{"path":"%WINDIR%\\System32\\en-US\\imageres.dll.mui","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"C:\\data\\user\\@myanimelist\\history.xml","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"C:\\data","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"C:\\data\\db","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"C:\\data\\db\\anime-relations.txt","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"}]},{"path":"%WINDIR%\\System32\\en-US\\duser.dll.mui","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"}]},{"path":"%WINDIR%\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\comctl32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"C:\\Crunchyroll.log","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"C:\\data\\settings.xml","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"C:\\data\\db\\anime.xml","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"C:\\data\\feed","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"C:\\data\\feed\\history.xml","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%WINDIR%\\SysWOW64\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"C:\\CrunchyFixSetup.exe","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\anime-relations.txt","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2011_fall.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2011_spring.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2011_summer.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2011_winter.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2012_fall.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2012_spring.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2012_summer.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2012_winter.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2013_fall.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2013_spring.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2013_summer.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2013_winter.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2014_fall.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2014_spring.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2014_summer.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2014_winter.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2015_fall.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2015_spring.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2015_summer.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2015_winter.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2016_fall.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2016_spring.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2016_summer.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2016_winter.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2017_fall.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2017_spring.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2017_summer.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season\\2017_winter.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\season","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\Uninstall.exe","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\Taiga.log","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%WINDIR%\\SysWOW64\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\players.anisthesia","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\feed\\history.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\Theme.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\square-small-green.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\square-small-blue.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\square-small-red.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\square-small-gray.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\film.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\magnifier-left.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\folder-small-horizontal.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\application-small-blue.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\application-small.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\arrow-circle-315.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\navigation-270-button.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\gear.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\cross.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\plus.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\minus.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\arrow-090.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\arrow-270.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\funnel-small.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\funnel-cross.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\funnel-tick.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\funnel-plus.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\funnel-pencil.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\calendar-month.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\category.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\sort-quantity-descending.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\balloon-left.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\clock.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\home.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\document-attribute.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\chart.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\feed.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\ui-scroll-pane-detail.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\document-import.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\16px\\document-export.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\24px\\arrow-circle-double-135.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\24px\\folder-open.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\24px\\application-export.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\24px\\gear.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\24px\\taiga.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\24px\\globe.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\24px\\inbox-document.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\24px\\application-sidebar-list.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\24px\\document-question.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\24px\\megaphone.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\theme\\Default\\24px\\feed.png","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\db\\anime.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\user\\@myanimelist\\history.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\settings.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"path":"%APPDATA%\\Taiga\\data\\user\\@kitsu\\history.xml","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\TAIGA\\","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\CRUNCHYROLL\\CRUNCHYROLL","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\JAVA\\JAVA","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\TAIGA\\TAIGA","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Taiga-33d5a63c-de90-432f-9a8b-f6f733dab258","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"Taiga-33d5a63c-de90-432f-9a8b-f6f733dab258","sources":[{"report_type":"sandbox","report_id":"59fda17b7ca3e1197924a673"},{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a4195077ca3e1314904d93d"}]}]}},"report_ids":{"sandbox_job_ids":["5a4195077ca3e1314904d93d","59fda17b7ca3e1197924a673"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Swrort Sample eae53d89d7ad… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample eae53d89d7ad…. Malware family: Trojan.Swrort. Threat score 100/100. 18/28 AV engines flagged this file. 15 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/eae53d89d7add187dfe6f4498c99144d7650c37a99792e0e40035d83f73cfb02"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Swrort Sample eae53d89d7ad… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample eae53d89d7ad…. Malware family: Trojan.Swrort. Threat score 100/100. 18/28 AV engines flagged this file. 15 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/eae53d89d7add187dfe6f4498c99144d7650c37a99792e0e40035d83f73cfb02"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Swrort Sample eae53d89d7ad… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample eae53d89d7ad…. Malware family: Trojan.Swrort. Threat score 100/100. 18/28 AV engines flagged this file. 15 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]