34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 3f:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T497,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TROJ_FR.91522159 Sample ed7100eb093e… — Score 80/100 — Hybrid Analysis","description":"Malicious verdict for sample ed7100eb093e…. Malware family: TROJ_FR.91522159. Threat score 80/100. 22/28 AV engines flagged this file. 3 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ed7100eb093e0921ee4c9bb3c1c8146f41019b7f1725978c51172611be469642","keywords":["Malicious","TROJ_FR.91522159","malware analysis","sandbox report","threat intelligence","ed7100eb093e0921ee4c9bb3c1c8146f41019b7f1725978c51172611be469642"],"about":{"@type":"SoftwareApplication","name":"2018-03-08_14-10-15.exe","applicationCategory":["peexe","executable"],"identifier":"ed7100eb093e0921ee4c9bb3c1c8146f41019b7f1725978c51172611be469642","additionalType":"Malicious sample"},"threatScore":80,"malwareFamily":"TROJ_FR.91522159","antivirusDetections":{"malicious":22,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T446,GetLocalTime@KERNEL32.dll at 10111-52-010051EE GetLocalTime@KERNEL32.dll at 10111-63-0100355F GetLocalTime@KERNEL32.DLL at 00055225-00002256-19788-19-010051EE GetLocalTime@KERNEL32.DLL at 00055225-00002256-19788-26-0100355F GetSystemTime@KERNEL32.DLL at 00055225-00002256-15574-647-01058961 GetSystemTime@KERNEL32.DLL at 00055225-00002256-15574-667-0105D5AD GetSystemTimeAsFileTime@KERNEL32.dll at 31267-2973-00412B20 GetSystemTimeAsFileTime@KERNEL32.dll at 25944-641-2E0468E7 GetSystemTimeAsFileTime@KERNEL32.dll at 25944-415-2E0474E1 GetSystemTimeAsFileTime@KERNEL32.dll at 25944-621-2E0454C5 GetSystemTimeAsFileTime@KERNEL32.dll at 25944-851-2E063E43 GetLocalTime@KERNEL32.dll at 25944-1680-2E026163 GetLocalTime@KERNEL32.dll at 25944-1919-2E0322FF GetLocalTime@KERNEL32.dll at 25944-759-2E0456E5 GetSystemTimeAsFileTime@KERNEL32.dll at 25944-756-2E0467E7 GetLocalTime@KERNEL32.dll at 25944-1962-2E02DC2D GetLocalTime@KERNEL32.dll at 25944-2245-2E043307 GetSystemTimeAsFileTime@KERNEL32.dll at 25944-1996-2E02D024 GetSystemTimeAsFileTime@KERNEL32.dll at 25944-2202-2E02CF7937:T404,GetUserDefaultLCID@KERNEL32.dll at 10111-52-010051EE GetUserDefaultLCID@KERNEL32.dll at 10111-53-01004068 GetUserDefaultLCID@KERNEL32.dll at 10111-63-0100355F GetUserDefaultLCID@KERNEL32.dll at 10111-81-010062F0 GetUserDefaultLCID@KERNEL32.DLL at 00055225-00002256-19788-19-010051EE GetUserDefaultLCID@KERNEL32.DLL at 00055225-00002256-19788-26-0100355F GetUserDefaultLCID@KERNEL32.dll at 25944-381-2E063B26 GetUserDefaultLCID@KERNEL32.dll at 25944-374-2E060978 GetUserDefaultLCID@KERNEL32.dll at 25944-653-2E05E84C GetUserDefaultLCID@KERNEL32.dll at 25944-651-2E061842 GetUserDefaultLCID@KERNEL32.dll at 25944-826-2E061B5C GetUserDefaultLCID@KERNEL32.dll at 25944-877-2E063AAD GetUserDefaultLCID@KERNEL32.dll at 25944-827-2E0618B5 GetUserDefaultLCID@KERNEL32.dll at 25944-803-2E04F5E8 EnumSystemLocalesW@KERNEL32.dll at 25944-2043-2E06A9E3 GetUserDefaultLCID@KERNEL32.dll at 25944-2037-2E06CF5B GetUserDefaultLCID@KERNEL32.dll at 25944-2129-2E06B5A4 GetUserDefaultUILanguage@KERNEL32.dll at 25944-2126-2E06DD6438:T1c5b,Found API call GetVersionExA@KERNEL32.DLL (Target: "2018-03-08_14-10-15.exe"; Stream UID: "00055225-00002256-19788-567-010567BF") which is directly followed by "cmp eax, dword ptr [ebp-00000084h]" and "jne 0105687Fh". See related instructions: "...+113 mov eax, dword ptr [ebp-00000098h]+119 lea eax, dword ptr [esi+eax+00000083h]+126 mov dword ptr [ebp-00000094h], eax+132 lea eax, dword ptr [ebp-00000094h]+138 push eax+139 call dword ptr [01063BC0h] ;GetVersionExA+145 mov eax, dword ptr [ebp-00000090h]+151 mov dword ptr [01064434h], eax+156 mov eax, dword ptr [01064110h]+161 add eax, dword ptr [01064100h]+167 sub eax, 09h+170 cmp eax, dword ptr [ebp-00000084h]+176 jne 0105687Fh" ... at 00055225-00002256-19788-567-010567BF Found API call GetDiskFreeSpaceA@KERNEL32.DLL (Target: "2018-03-08_14-10-15.exe"; Stream UID: "00055225-00002256-15574-640-010569D5") which is directly followed by "cmp edi, eax" and "jne 01056BB1h". See related instructions: "...+417 call dword ptr [01062398h] ;GetDiskFreeSpaceA+423 mov edi, dword ptr [010640ECh]+429 sub edi, 05h+432 cmp edi, eax+434 jne 01056BB1h" ... at 00055225-00002256-15574-640-010569D5 Found API call EnumServicesStatusA@ADVAPI32.DLL (Target: "2018-03-08_14-10-15.exe"; Stream UID: "00055225-00002256-15574-619-01052F41") which is directly followed by "cmp eax, edi" and "je 010530CFh". See related instructions: "...+220 call dword ptr [010629E0h] ;EnumServicesStatusA+226 mov edi, dword ptr [010640F8h]+232 sub edi, 09h+235 cmp eax, edi+237 je 010530CFh" ... at 00055225-00002256-15574-619-01052F41 Found API call GetSystemTimeAsFileTime@KERNEL32.dll (Target: "bglnccaf.tmp.967279607"; Stream UID: "25944-641-2E0468E7") which is directly followed by "cmp ecx, dword ptr [ebp+0Ch]" and "jbe 2E046939h". See related instructions: "...+43 call 2E045803h+48 add esp, 10h+51 lea eax, dword ptr [edi+40h]+54 push eax+55 call dword ptr [2E0011D0h] ;GetSystemTimeAsFileTime+61 mov eax, ebx+63 add ebx, 08h+66 mov ecx, ebx+68 sub ecx, edi+70 cmp ecx, dword ptr [ebp+0Ch]+73 jbe 2E046939h" ... at 25944-641-2E0468E7 Found API call GetSystemTimeAsFileTime@KERNEL32.dll (Target: "bglnccaf.tmp.967279607"; Stream UID: "25944-415-2E0474E1") which is directly followed by "cmp dword ptr [2E0D8800h], edi" and "jne 2E047590h". See related instructions: "...+130 call dword ptr [2E0011D0h] ;GetSystemTimeAsFileTime+136 cmp dword ptr [2E0D8800h], edi+142 jne 2E047590h" ... at 25944-415-2E0474E1 Found API call GetLocalTime@KERNEL32.dll (Target: "bglnccaf.tmp.967279607"; Stream UID: "25944-759-2E0456E5") which is directly followed by "cmp word ptr [ebp-10h], cx" and "jnbe 2E045723h". See related instructions: "...+0 push ebp+1 mov ebp, esp+3 sub esp, 10h+6 push edi+7 xor eax, eax+9 mov word ptr [ebp-10h], ax+13 lea edi, dword ptr [ebp-0Eh]+16 stosd +17 stosd +18 stosd +19 stosw +21 lea eax, dword ptr [ebp-10h]+24 push eax+25 call dword ptr [2E00116Ch] ;GetLocalTime+31 mov eax, 000007E4h+36 mov ecx, eax+38 pop edi+39 cmp word ptr [ebp-10h], cx+43 jnbe 2E045723h" ... at 25944-759-2E0456E5 Found API call GetVersionExA@KERNEL32.dll (Target: "bglnccaf.tmp.967279607"; Stream UID: "25944-1844-2E03D377") which is directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "xor ecx, ebp". See related instructions: "...+33 call 2E06E640h+38 add esp, 0Ch+41 lea eax, dword ptr [ebp-00000098h]+47 push eax+48 mov dword ptr [ebp-00000098h], 00000094h+58 call dword ptr [2E0011B4h] ;GetVersionExA+64 mov ecx, dword ptr [ebp-04h]+67 xor eax, eax+69 cmp dword ptr [ebp-00000088h], 02h+76 sete al+79 xor ecx, ebp" ... at 25944-1844-2E03D377 Found API call GetSystemTimeAsFileTime@KERNEL32.dll (Target: "bglnccaf.tmp.967279607"; Stream UID: "25944-756-2E0467E7") which is directly followed by "cmp esi, dword ptr [ebp-04h]" and "ret ". See related instructions: "...+40 call 2E04D2D1h+45 mov esi, eax+47 lea eax, dword ptr [ebp-08h]+50 push eax+51 call dword ptr [2E0011D0h] ;GetSystemTimeAsFileTime+57 cmp esi, dword ptr [ebp-04h]+60 pop esi+61 sbb eax, eax+63 neg eax+65 leave +66 ret " ... at 25944-756-2E0467E7 Found API call GetVersion@KERNEL32.dll (Target: "bglnccaf.tmp.967279607"; Stream UID: "25944-2715-2E04B8B4") which is directly followed by "cmp eax, 80000000h" and "jnc 2E04B925h". See related instructions: "...+67 call 2E045C6Dh+72 pop ecx+73 mov dword ptr [ebp+18h], eax+76 call dword ptr [2E0012DCh] ;GetVersion+82 cmp eax, 80000000h+87 jnc 2E04B925h" ... at 25944-2715-2E04B8B4 Found API call GetVersion@KERNEL32.dll (Target: "bglnccaf.tmp.967279607"; Stream UID: "25944-2727-2E04BBE1") which is directly followed by "cmp eax, 80000000h" and "jnc 2E04BD94h". See related instructions: "...+353 call dword ptr [2E0012DCh] ;GetVersion+359 cmp eax, 80000000h+364 jnc 2E04BD94h" ... at 25944-2727-2E04BBE1 Found API call GetVersion@KERNEL32.dll (Target: "bglnccaf.tmp.967279607"; Stream UID: "25944-2674-2E04A6EF") which is directly followed by "cmp eax, 80000000h" and "jnc 2E04A7AFh". See related instructions: "...+122 call dword ptr [2E0012DCh] ;GetVersion+128 cmp eax, 80000000h+133 jnc 2E04A7AFh" ... at 25944-2674-2E04A6EF Found API call GetVersionExA@KERNEL32.dll (Target: "bglnccaf.tmp.967279607"; Stream UID: "25944-2256-2E02AB71") which is directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "jne 2E02ABDDh". See related instructions: "...+33 call 2E06E640h+38 add esp, 0Ch+41 lea eax, dword ptr [ebp-00000098h]+47 push eax+48 mov dword ptr [ebp-00000098h], 00000094h+58 call dword ptr [2E0011B4h] ;GetVersionExA+64 cmp dword ptr [ebp-00000088h], 02h+71 jne 2E02ABDDh" ... at 25944-2256-2E02AB71 Found API call GetVersion@KERNEL32.dll (Target: "bglnccaf.tmp.967279607"; Stream UID: "25944-2557-2E04A4CF") which is directly followed by "cmp eax, 80000000h" and "jnc 2E04A500h". See related instructions: "...+0 push ebp+1 mov ebp, esp+3 call dword ptr [2E0012DCh] ;GetVersion+9 cmp eax, 80000000h+14 jnc 2E04A500h" ... at 25944-2557-2E04A4CF Found API call GetVersion@KERNEL32.dll (Target: "bglnccaf.tmp.967279607"; Stream UID: "25944-2556-2E04A606") which is directly followed by "cmp eax, 80000000h" and "jnc 2E04A627h". See related instructions: "...+0 push ebp+1 mov ebp, esp+3 push ecx+4 push ebx+5 push esi+6 push edi+7 call dword ptr [2E0012DCh] ;GetVersion+13 cmp eax, 80000000h+18 jnc 2E04A627h" ... at 25944-2556-2E04A606 Found API call GetVersion@KERNEL32.dll (Target: "bglnccaf.tmp.967279607"; Stream UID: "25944-2673-2E04A514") which is directly followed by "cmp eax, 80000000h" and "jnc 2E04A53Fh". See related instructions: "...+0 push ebp+1 mov ebp, esp+3 call dword ptr [2E0012DCh] ;GetVersion+9 cmp eax, 80000000h+14 jnc 2E04A53Fh" ... at 25944-2673-2E04A514 Found API call GetVersion@KERNEL32.dll (Target: "bglnccaf.tmp.967279607"; Stream UID: "25944-2739-2E04C608") which is directly followed by "cmp eax, 80000000h" and "jnc 2E04C677h". See related instructions: "...+0 push ebp+1 mov ebp, esp+3 sub esp, 000005E8h+9 mov eax, dword ptr [2E0C18A0h]+14 xor eax, ebp+16 mov dword ptr [ebp-04h], eax+19 push ebx+20 mov ebx, dword ptr [ebp+08h]+23 push esi+24 mov esi, dword ptr [ebp+0Ch]+27 mov dword ptr [ebp-000005E8h], esi+33 call dword ptr [2E0012DCh] ;GetVersion+39 cmp eax, 80000000h+44 jnc 2E04C677h" ... at 25944-2739-2E04C60839:T536,"Calculator.lnk" has type "empty " "MineSweeper.lnk" has type "empty " "Paint.lnk" has type "empty " "Sticky Notes.lnk" has type "empty " "Windows Media Player.lnk" has type "empty " "gkbpadmi.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "eahookpn.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "mnclgkoo.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "fijffced.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "klncjook.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "bglnccaf.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "cpgeqlhc.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "dnmejccm.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "okpmgclk.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows" "ckjgpiji.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "iinnmpgl.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows" "pnhochhl.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "ejlkpjei.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "ghpbhbif.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "moflgfgd.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows"3a:T47a,"gkbpadmi.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "eahookpn.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "mnclgkoo.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "fijffced.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "klncjook.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "bglnccaf.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "cpgeqlhc.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "dnmejccm.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "okpmgclk.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows" "ckjgpiji.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "iinnmpgl.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows" "pnhochhl.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "ejlkpjei.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "ghpbhbif.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "moflgfgd.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows"3b:T760,"C:\2018-03-08_14-10-15.exe" marked "C:\Windows\Microsoft.NET\Framework\v4.0.30319\okpmgclk.tmp" for deletion "C:\2018-03-08_14-10-15.exe" marked "C:\Program Files\Google\Update\eahookpn.tmp" for deletion "C:\2018-03-08_14-10-15.exe" marked "C:\Windows\System32\cignnaqe.tmp" for deletion "C:\2018-03-08_14-10-15.exe" marked "C:\Program Files\Mozilla Maintenance Service\ncboidmi.tmp" for deletion "C:\2018-03-08_14-10-15.exe" marked "C:\Program Files\Common Files\microsoft shared\Source Engine\cpgeqlhc.tmp" for deletion "C:\2018-03-08_14-10-15.exe" marked "C:\Program Files\WinPcap\iinnmpgl.tmp" for deletion "C:\2018-03-08_14-10-15.exe" marked "C:\Program Files\Microsoft Games\Minesweeper\moflgfgd.tmp" for deletion "C:\2018-03-08_14-10-15.exe" marked "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\klncjook.tmp" for deletion "C:\2018-03-08_14-10-15.exe" marked "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\ckjgpiji.tmp" for deletion "C:\2018-03-08_14-10-15.exe" marked "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\bglnccaf.tmp" for deletion "C:\2018-03-08_14-10-15.exe" marked "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\mnclgkoo.tmp" for deletion "C:\2018-03-08_14-10-15.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\fijffced.tmp" for deletion "C:\2018-03-08_14-10-15.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\pnhochhl.tmp" for deletion "C:\2018-03-08_14-10-15.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\dnmejccm.tmp" for deletion "C:\2018-03-08_14-10-15.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\ghpbhbif.tmp" for deletion "C:\2018-03-08_14-10-15.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\ejlkpjei.tmp" for deletion "C:\2018-03-08_14-10-15.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\gkbpadmi.tmp" for deletion3c:T6fa,"" opened "c:\windows\microsoft.net\framework\v4.0.30319\okpmgclk.tmp" with delete access "" opened "c:\program files\google\update\eahookpn.tmp" with delete access "" opened "c:\windows\system32\cignnaqe.tmp" with delete access "" opened "c:\program files\mozilla maintenance service\ncboidmi.tmp" with delete access "" opened "c:\program files\common files\microsoft shared\source engine\cpgeqlhc.tmp" with delete access "" opened "c:\program files\winpcap\iinnmpgl.tmp" with delete access "" opened "C:\Program Files\Microsoft Games\Minesweeper\moflgfgd.tmp" with delete access "" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\klncjook.tmp" with delete access "" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\ckjgpiji.tmp" with delete access "" opened "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\bglnccaf.tmp" with delete access "" opened "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\mnclgkoo.tmp" with delete access "" opened "C:\Program Files\Adobe\Reader 11.0\Reader\fijffced.tmp" with delete access "" opened "C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\pnhochhl.tmp" with delete access "" opened "C:\Program Files\Adobe\Reader 11.0\Reader\dnmejccm.tmp" with delete access "" opened "C:\Program Files\Adobe\Reader 11.0\Reader\ghpbhbif.tmp" with delete access "" opened "C:\Program Files\Adobe\Reader 11.0\Reader\ejlkpjei.tmp" with delete access "" opened "C:\Program Files\Adobe\Reader 11.0\Reader\gkbpadmi.tmp" with delete access3d:T5d0,RegCloseKey RegCreateKeyW RegOpenKeyExA LoadLibraryA GetStartupInfoA GetCommandLineW DeleteFileW CreateFileMappingW MapViewOfFile GetModuleHandleA WriteFile FindFirstFileW GetProcAddress CreateFileW RegCreateKeyExW OpenProcessToken RegOpenKeyExW RegOpenKeyW GetDriveTypeW GetFileAttributesW ConnectNamedPipe OutputDebugStringA CopyFileW GetModuleFileNameW IsDebuggerPresent UnhandledExceptionFilter LoadLibraryExW CreateThread DisconnectNamedPipe TerminateProcess LoadLibraryW GetTickCount GetVersionExA GetStartupInfoW CreateDirectoryW FindNextFileW GetModuleHandleW Sleep ShellExecuteA FindWindowW HttpSendRequestA InternetWriteFile InternetCloseHandle InternetOpenA InternetReadFile InternetConnectA HttpQueryInfoA InternetCrackUrlA HttpSendRequestExA WSASocketA WSAStartup OutputDebugStringW LockResource GetCommandLineA FindResourceExW FindFirstFileExW GetFileAttributesExW GetModuleHandleExW FindResourceW RegDeleteKeyW SetSecurityDescriptorDacl RegEnumKeyW RegEnumKeyExW GetTempPathW GetModuleFileNameA GetVersionExW CreateFileA CreateProcessW VirtualAlloc GetUserNameExW RegDeleteValueW RegCreateKeyExA GetFileSize ShellExecuteExW LookupAccountNameW GetUserNameA StartServiceCtrlDispatcherW GetTempPathA GetComputerNameW GetFileSizeEx RegEnumKeyExA RegDeleteValueA CreateFileMappingA LoadLibraryExA ExitThread CreateRemoteThread OpenProcess ReadProcessMemory GetComputerNameA ShellExecuteExA3e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAd3d3d3d3d3dwAAAAAAAACIiIiIiIiIiIdwAAAAAAAP//////////+IcAAAAAAACIiIiIiI////+HAAAAAAAAd3d3d3d3d3d3hwAAAAAAAIiIiIiIiI///4cAAAAAAACIiIiIiIiP//+HAAAAAAAAd3d3d3d3d3d3hwAAAAAAAIiIiIiIiIj//4cAAAAAAAAAAAAAAIiI//+HAABmZmZmZmZmZmYHd3d3hwAA6Ojo6Ojo6OjmCIiP/4cAAI6Ojo6Ojo6OjmCIj/+HAAAI6Ojo6Ojo6Ohgd3d3hwAADo6Ojo6Ojo6OhgiI/4cAAADo6Ojo6Ojo6OYIiP+HAAAAjo6Ojo6Ojo6OYHd3hwAAAAjo6Ojo6Ojo6GCIj4cAAAAOjo6Ojo6Ojo6GCI+HAAAAAOjo6Ojo6Ojo5gd3hwAAAACOjgAAAAAAjo5giIcAAAAACOjo6Ojo6OjoYIiHAAAAAA6OgAAAAAAOjoYIhwAAAAAA6Ojo6Ojo6OjmCIcAAAAAAI6Ojo6Ojo6OjmCHAAAAAAAI6Ojo6Ojo6OhghwAAAAAADg6Ajg6Ajg6AhgAAAAAAAADwDwDwDwDwDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////+AAD//AAAf/gAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA4AAAAMAAAADAAAAAwAAAAOAAAADgAAAA8AAAAPAAAAD4AAAA+AAAAPwAAAD8AAAA/gAAAP4AAAD/AAAA/wAAAP+AAAD/gAAB/8AAA//kkk//////w==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"ed7100eb093e0921ee4c9bb3c1c8146f41019b7f1725978c51172611be469642","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":80,"unified_at_epoch_ms":1793899962877,"unified_at":"2026-11-05T17:32:42.877Z","metadata":{"hashes":{"sha256":"ed7100eb093e0921ee4c9bb3c1c8146f41019b7f1725978c51172611be469642","sha1":"30291d9975ad14a8f31ace40197923016f2b176d","md5":"15695cbb622b86503daedce434e7e2d4","sha512":"100b54cd2be1e62854c5853c4a92eb5d5d8ff3291750d0e3798a14d98e3723a7345871b4d23341ae325416f29d447423fc2d35e4ab31cb70f3a3d98074411c0e","ssdeep":"6144:PFOTeCXeZhg4Yj6LoBfJ1SNnd9rwB0D9/1SswTPcKAoAZiupMvyefxG9FMkS:tz0eZhg4YjgoBmbwuDl1uPcKzA/pMvnK","ssdeep_chunks":["6144:PFOTeCX","6144:FOTeCXe","6144:OTeCXeZ","6144:TeCXeZh","6144:eCXeZhg","6144:CXeZhg4","6144:XeZhg4Y","6144:eZhg4Yj","6144:Zhg4Yj6","6144:hg4Yj6L","6144:g4Yj6Lo","6144:4Yj6LoB","6144:Yj6LoBf","6144:j6LoBfJ","6144:6LoBfJ1","6144:LoBfJ1S","6144:oBfJ1SN","6144:BfJ1SNn","6144:fJ1SNnd","6144:J1SNnd9","6144:1SNnd9r","6144:SNnd9rw","6144:Nnd9rwB","6144:nd9rwB0","6144:d9rwB0D","6144:9rwB0D9","6144:rwB0D9/","6144:wB0D9/1","6144:B0D9/1S","6144:0D9/1Ss","6144:D9/1Ssw","6144:9/1SswT","6144:/1SswTP","6144:1SswTPc","6144:SswTPcK","6144:swTPcKA","6144:wTPcKAo","6144:TPcKAoA","6144:PcKAoAZ","6144:cKAoAZi","6144:KAoAZiu","6144:AoAZiup","6144:oAZiupM","6144:AZiupMv","6144:ZiupMvy","6144:iupMvye","6144:upMvyef","6144:pMvyefx","6144:MvyefxG","6144:vyefxG9","6144:yefxG9F","6144:efxG9FM","6144:fxG9FMk","6144:xG9FMkS","12288:PFOTeCX","12288:FOTeCXe","12288:OTeCXeZ","12288:TeCXeZh","12288:eCXeZhg","12288:CXeZhg4","12288:XeZhg4Y","12288:eZhg4Yj","12288:Zhg4Yj6","12288:hg4Yj6L","12288:g4Yj6Lo","12288:4Yj6LoB","12288:Yj6LoBf","12288:j6LoBfJ","12288:6LoBfJ1","12288:LoBfJ1S","12288:oBfJ1SN","12288:BfJ1SNn","12288:fJ1SNnd","12288:J1SNnd9","12288:1SNnd9r","12288:SNnd9rw","12288:Nnd9rwB","12288:nd9rwB0","12288:d9rwB0D","12288:9rwB0D9","12288:rwB0D9/","12288:wB0D9/1","12288:B0D9/1S","12288:0D9/1Ss","12288:D9/1Ssw","12288:9/1SswT","12288:/1SswTP","12288:1SswTPc","12288:SswTPcK","12288:swTPcKA","12288:wTPcKAo","12288:TPcKAoA","12288:PcKAoAZ","12288:cKAoAZi","12288:KAoAZiu","12288:AoAZiup","12288:oAZiupM","12288:AZiupMv","12288:ZiupMvy","12288:iupMvye","12288:upMvyef","12288:pMvyefx","12288:MvyefxG","12288:vyefxG9","12288:yefxG9F","12288:efxG9FM","12288:fxG9FMk","12288:xG9FMkS","6144:tz0eZhg","6144:z0eZhg4","6144:0eZhg4Y","6144:Zhg4Yjg","6144:hg4Yjgo","6144:g4YjgoB","6144:4YjgoBm","6144:YjgoBmb","6144:jgoBmbw","6144:goBmbwu","6144:oBmbwuD","6144:BmbwuDl","6144:mbwuDl1","6144:bwuDl1u","6144:wuDl1uP","6144:uDl1uPc","6144:Dl1uPcK","6144:l1uPcKz","6144:1uPcKzA","6144:uPcKzA/","6144:PcKzA/p","6144:cKzA/pM","6144:KzA/pMv","6144:zA/pMvn","6144:A/pMvnK"],"imphash":"1082b0d24057c525706f0420d775d7ac"},"file_info":{"file_name":"2018-03-08_14-10-15.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":311808,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1520488007000,"last_seen":1678113750000,"last_multi_scan":1678113750000}},"detections":{"summary":{"verdict":"malicious","score":80,"tags":null},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":17,"suspicious_count":25,"malicious_count":3,"total":45},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win32/Expiro5.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Virus/Win32.Expiro.cg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"W32/Infector.Gen8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Win32.Expiro.Gen.4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Expiro.CG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Expiro.A!Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Win32.Expiro.Gen.4 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Expiro.CG virus","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Virus/Expiro.e@U","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Virus ( 0052ed0c1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Expiro.rc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"W32/Expiro.gen.rc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Gen.ccmw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"W32/Expiro-AC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Virus/W32.Expiro","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_FR.91522159","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_FR.91522159","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Win32.Expiro.CQ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Vilsel","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TROJ_FR.91522159","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 25944-441-2E06E7F2\n SetUnhandledExceptionFilter@KERNEL32.dll at 25944-462-2E072668\n SetUnhandledExceptionFilter@KERNEL32.dll at 25944-2215-2E02A658","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"$36","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 25944-836-2E04ED78","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00055225-00002256-19788-567-010567BF\n GetVersionExA@KERNEL32.DLL at 00055225-00002256-19788-561-010578C8\n GetVersionExW@KERNEL32.dll at 25944-788-2E04F891\n GetVersionExA@KERNEL32.dll at 25944-1844-2E03D377\n GetVersion@KERNEL32.dll at 25944-2715-2E04B8B4\n GetVersion@KERNEL32.dll at 25944-2727-2E04BBE1\n GetVersionExA@KERNEL32.dll at 25944-2296-2E0635E7\n GetVersion@KERNEL32.dll at 25944-2674-2E04A6EF\n GetVersionExW@KERNEL32.dll at 25944-2256-2E02AB71\n GetVersion@KERNEL32.dll at 25944-2557-2E04A4CF\n GetVersionExW@KERNEL32.dll at 25944-2040-2E06DCF9\n GetVersionExA@KERNEL32.dll at 25944-2658-2E044A40\n GetVersionExA@KERNEL32.dll at 25944-2295-2E061E28\n GetVersion@KERNEL32.dll at 25944-2556-2E04A606\n GetVersion@KERNEL32.dll at 25944-2673-2E04A514\n GetVersion@KERNEL32.dll at 25944-2739-2E04C608","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"$37","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00055225-00002256-15574-640-010569D5\n GetDiskFreeSpaceExW@KERNEL32.dll at 25944-822-2E04EE28","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$38","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 31267-2879-004B8430\n GetProcessHeap@KERNEL32.dll at 31267-3014-00465B90\n GetProcessHeap@KERNEL32.dll at 31267-2969-004658B0\n GetProcessHeap@KERNEL32.dll at 31267-2947-004B7480\n GetProcessHeap@KERNEL32.dll at 31267-2971-00467740\n GetProcessHeap@KERNEL32.dll at 25944-722-2E049938\n GetProcessHeap@KERNEL32.dll at 25944-2300-2E0446E0\n GetProcessHeap@KERNEL32.dll at 25944-2254-2E02ABEB\n GetProcessHeap@KERNEL32.dll at 25944-2302-2E043C7B","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"C:\\\" at 00055225-00002256-0000010C-129313514\n \"\" queries volume information of \"C:\\\" at 00055225-00002256-0000010C-129313787\n \"\" queries volume information of \"C:\\\" at 00055225-00002256-0000010C-152493262","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"\" queries volume information of \"C:\\\" at 00055225-00002256-0000010C-129313514\n \"\" queries volume information of \"C:\\\" at 00055225-00002256-0000010C-129313787\n \"\" queries volume information of \"C:\\\" at 00055225-00002256-0000010C-152493262","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"MS_WINHELP\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.DLL at 00055225-00002256-15574-655-0105C3BD\n GetUserNameExW@Secur32.dll at 25944-776-2E06E10B\n GetUserNameA@ADVAPI32.dll at 25944-1919-2E0322FF","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$39","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Fonts\\StaticCache.dat\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\System32\\tzres.dll\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\tzres.dll.mui\"\n \"\" touched file \"%WINDIR%\\system32\\gzv_41-dsbd\"\n \"\" touched file \"%WINDIR%\\system32\\alg.exe\"\n \"\" touched file \"%WINDIR%\\system32\\svchost.exe\"\n \"\" touched file \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_state.exe\"\n \"\" touched file \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\okpmgclk.tmp\"\n \"\" touched file \"%WINDIR%\\microsoft.net\\framework\\v2.0.50727\\mscorsvw.exe\"\n \"\" touched file \"%WINDIR%\\system32\\dllhost.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"%USERPROFILE%\\desktop\\cefcode1750_1\\chromium\\src\\base\\threading\\thread_local_storage_win.cc\"\n Pattern match: \"http://watson.microsoft.com/dw/dcp.asp\"\n Pattern match: \"http://watson.microsoft.com/dw/watsoninfo.asp\"\n Heuristic match: \".msn.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open/control a service","description":"OpenServiceA@ADVAPI32.DLL at 00055225-00002256-19788-587-0105050F\n OpenServiceA@ADVAPI32.DLL at 00055225-00002256-15574-620-01056C58","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00055225-00002256-00000105-152698185","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 10 calls to GetProcAddress@KERNEL32.DLL at 00055225-00002256-15574-656-01061BFF\n Found 10 calls to GetProcAddress@KERNEL32.DLL at 00055225-00002256-26669-276-01061BFF","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc\n .reloc\n .reloc\n .data\n .reloc with unusual entropies 7.77586794188\n 7.79406792397\n 7.89506679113\n 7.60830453625\n 7.89529127472","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to enumerate services","description":"EnumServicesStatusA@ADVAPI32.DLL at 00055225-00002256-15574-619-01052F41","origin":"Hybrid Analysis Technology","relevance":7,"id":"stream-27","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 25944-787-2E04F520","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"\" (Thread ID: 3504) slept \"520\" times (threshold: 500)","origin":"API Call","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/65 reputation engines marked \"http://win.cc\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ENUMERATE_SERVICE\" (0x4)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to create a remote thread (often used for process injection)","description":"CreateRemoteThread@KERNEL32.dll at 25944-2598-2E03EAC4","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-5","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to download files from the internet","description":"InternetReadFileExA@WININET.dll at 25944-2419-2E030926","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"$3a","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"root\\cimv2\" (Indicator: \"root\\cimv2\")","origin":"File/Memory","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00055225-00002256-15574-628-01051E33","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.dll at 10111-93-01002B7D\n OpenClipboard@USER32.DLL at 00055225-00002256-19788-48-01002B7D","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$3b","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$3c","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetSecurityDescriptorDacl@ADVAPI32.DLL at 00055225-00002256-15574-622-0105722A\n SetSecurityDescriptorDacl@ADVAPI32.dll at 25944-726-2E04988A\n SetSecurityDescriptorDacl@ADVAPI32.dll at 25944-702-2E049ABB\n SetSecurityDescriptorDacl@ADVAPI32.dll at 25944-715-2E049FC1\n SetSecurityDescriptorDacl@ADVAPI32.dll at 25944-729-2E0497D7\n SetSecurityDescriptorDacl@ADVAPI32.dll at 25944-720-2E0499AF","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to lookup privileges","description":"GetSecurityDescriptorDacl@ADVAPI32.dll at 25944-699-2E049B8D\n GetSecurityDescriptorDacl@ADVAPI32.dll at 25944-1968-2E02D6C6","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-43","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"gkbpadmi.tmp\" claimed CRC 1018419 while the actual is CRC 314922\n \"eahookpn.tmp\" claimed CRC 438956 while the actual is CRC 1018419\n \"mnclgkoo.tmp\" claimed CRC 823829 while the actual is CRC 438956\n \"fijffced.tmp\" claimed CRC 563676 while the actual is CRC 823829\n \"klncjook.tmp\" claimed CRC 464461 while the actual is CRC 563676\n \"bglnccaf.tmp\" claimed CRC 1097852 while the actual is CRC 464461\n \"cpgeqlhc.tmp\" claimed CRC 406522 while the actual is CRC 1097852\n \"dnmejccm.tmp\" claimed CRC 1851074 while the actual is CRC 406522\n \"okpmgclk.tmp\" claimed CRC 293838 while the actual is CRC 1851074\n \"ckjgpiji.tmp\" claimed CRC 1353775 while the actual is CRC 293838\n \"iinnmpgl.tmp\" claimed CRC 374482 while the actual is CRC 1353775\n \"pnhochhl.tmp\" claimed CRC 1378059 while the actual is CRC 374482\n \"ejlkpjei.tmp\" claimed CRC 320837 while the actual is CRC 1378059\n \"ghpbhbif.tmp\" claimed CRC 283488 while the actual is CRC 320837\n \"moflgfgd.tmp\" claimed CRC 1043354 while the actual is CRC 283488","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$3d","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"2018-03-08_14-10-15.exe.bin\" claims program is from Sun May 23 18:00:22 1999","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Drops executable files to the Windows system directory","description":"File type \"PE32 executable (console) Intel 80386 for MS Windows\" was dropped at \"%WINDIR%\\microsoft.net\\framework\\v4.0.30319\\okpmgclk.tmp\"","origin":"Binary File","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\"wscsvc\" (Indicator: \"wscsvc\")\n \"wuauserv\" (Indicator: \"wuauserv\")\n \"|wscsvc|WinDefend|MsMpSvc|NisSrv|gupdate|gupdatem|wuauserv|\" (Indicator: \"wscsvc\")\n \"|wscsvc|WinDefend|MsMpSvc|NisSrv|gupdate|gupdatem|wuauserv|\" (Indicator: \"wuauserv\")","origin":"File/Memory","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to access unusual system drive letters","description":"\"\" touched \"K:\"\n \"\" touched \"L:\"\n \"\" touched \"M:\"\n \"\" touched \"N:\"\n \"\" touched \"O:\"\n \"\" touched \"P:\"\n \"\" touched \"Q:\"\n \"\" touched \"R:\"\n \"\" touched \"S:\"\n \"\" touched \"T:\"\n \"\" touched \"U:\"\n \"\" touched \"V:\"\n \"\" touched \"W:\"\n \"\" touched \"X:\"\n \"\" touched \"Y:\"","origin":"API Call","relevance":9,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]}],"incidents":[{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"References security related windows services"}],"sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Tries to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":39,"dropped_files_count":0,"extracted_files_count":15,"files_written_count":51,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"5aa0cad47ca3e13347163ed4","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":80,"submit_name":"2018-03-08_14-10-15.exe","analysis_start_time":"2018-03-08T06:33:15+00:00","indicators_count":{"informative":17,"suspicious":29,"malicious":3},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}],"processes":[{"pid":2256,"ppid":0,"name":"2018-03-08_14-10-15.exe","command_line":"","sha256":"ed7100eb093e0921ee4c9bb3c1c8146f41019b7f1725978c51172611be469642","normalized_path":"C:\\2018-03-08_14-10-15.exe","uid":"00055225-00002256","icon":"$3e"}],"all_imported_dlls":["shell32.dll","msctf.dll","cryptsp.dll","comdlg32.dll","clbcatq.dll","rsaenh.dll","KernelBase.dll","user32.dll","dwmapi.dll","sfc.dll","ole32.dll","kernel32.dll","comctl32.dll","imm32.dll","tzres.dll","sechost.dll","ntdll.dll","msvcrt.dll","gdi32.dll","wbemsvc.dll","lpk.dll","rpcrt4.dll","uxtheme.dll","sfc_os.dll","sspicli.dll","nsi.dll","RpcRtRemote.dll","fastprox.dll","usp10.dll","oleaut32.dll","cryptbase.dll","wbemprox.dll","wbemcomn.dll","ntdsapi.dll","profapi.dll","crtdll.dll","ws2_32.dll","shlwapi.dll","advapi32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"cpgeqlhc.tmp","sha256":"1e55a5c1b1c2b1edd97a335052ce8cedaf9d0bb4ba23b7345319616ca8205208","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"name":"pnhochhl.tmp","sha256":"403bf78e3dfac49cb19bb26f89efd62c2b03c411c339b02ce2f5c3349d6121dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"name":"dnmejccm.tmp","sha256":"b14e223e7c648e1dcac66f51cb89eef6f86650118f16dc7cc1a33b79ade500c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"name":"ejlkpjei.tmp","sha256":"060d771d4135e8319197f798a1acbdc724d415e1f87757a77d04d61145a72c33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"name":"fijffced.tmp","sha256":"e747f20fcf34b457787fb58e3287b1d8765376b73f5bff71a26087fda8137c06","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"name":"ghpbhbif.tmp","sha256":"c76b488575f7cb2a6064e6a28c813ef97c22f2a1c344de3d85c9b73c1cf42b03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"name":"gkbpadmi.tmp","sha256":"04bfa734c828a06a15e02c9ccca591f45af44feb226e9dfb0337b72176994d57","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"name":"moflgfgd.tmp","sha256":"9f632ad7243a5106a66c5e75b74a5a876351132fd7960c39ff82e3b0690820ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"name":"eahookpn.tmp","sha256":"372b3ecbd536e84f340182d2df5c69b0ab7fe6eadcd410c32a8d5603cec4227f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"name":"ncboidmi.tmp","sha256":"2a2a6783f50c3c4941defe487b06892b466e86ab30863c22f708553c955e2beb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"name":"iinnmpgl.tmp","sha256":"49836f4da4b0c25747e922576c115f544b91d215a072d110b76359b34d183ad5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"name":"okpmgclk.tmp","sha256":"2c6d9041f4ab198d82cc381c5702636031178a4f507632bd1dc04011d199c901","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"name":"cignnaqe.tmp","sha256":"4fc464120a24e171000ca6ce8fa90ba5da76dc47b28acb3ce79dfb0e662a48bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"name":"ckjgpiji.tmp","sha256":"b8fcecd246dfa7d6d17d676cc6554234b70acc6c92dd147b57dacc58f76e02bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"name":"klncjook.tmp","sha256":"31fd737126d4d87f5356d56484204aa67d81e9e5922021c85d44ae004adc4fa5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]}],"files_written":[{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%WINDIR%\\system32\\gzv_41-dsbd","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\okpmgclk.tmp","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_state.exe","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%PROGRAMFILES%\\Google\\Update\\eahookpn.tmp","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%PROGRAMFILES%\\Google\\Update\\GoogleUpdate.exe","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%WINDIR%\\System32\\cignnaqe.tmp","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%WINDIR%\\System32\\srvany.exe","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%PROGRAMFILES%\\Mozilla Maintenance Service\\ncboidmi.tmp","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%PROGRAMFILES%\\Mozilla Maintenance Service\\maintenanceservice.exe","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\Source Engine\\cpgeqlhc.tmp","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\Source Engine\\OSE.EXE","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%PROGRAMFILES%\\WinPcap\\iinnmpgl.tmp","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%PROGRAMFILES%\\WinPcap\\rpcapd.exe","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Oracle VM VirtualBox Guest Additions\\Uninstall.lnk","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Oracle VM VirtualBox Guest Additions\\Website.lnk","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%USERPROFILE%\\Desktop\\Calculator.lnk","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%USERPROFILE%\\Desktop\\MineSweeper.lnk","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%PROGRAMFILES%\\Microsoft Games\\Minesweeper\\MineSweeper.exe","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%USERPROFILE%\\Desktop\\Paint.lnk","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%USERPROFILE%\\Desktop\\Sticky Notes.lnk","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%USERPROFILE%\\Desktop\\Windows Media Player.lnk","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\ose.exe","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\setup.exe","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\DW20.EXE","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\dwtrig20.exe","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroBroker.exe","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\AcroExt.exe","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroRd32Info.exe","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroTextExtractor.exe","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AdobeCollabSync.exe","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\arh.exe","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\NOTEPAD\\","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5aa0cad47ca3e13347163ed4"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5aa0cad47ca3e13347163ed4"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious TROJ_FR.91522159 Sample ed7100eb093e… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ed7100eb093e…. Malware family: TROJ_FR.91522159. Threat score 80/100. 22/28 AV engines flagged this file. 3 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ed7100eb093e0921ee4c9bb3c1c8146f41019b7f1725978c51172611be469642"}],["$","meta","4",{"property":"og:title","content":"Malicious TROJ_FR.91522159 Sample ed7100eb093e… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ed7100eb093e…. Malware family: TROJ_FR.91522159. Threat score 80/100. 22/28 AV engines flagged this file. 3 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ed7100eb093e0921ee4c9bb3c1c8146f41019b7f1725978c51172611be469642"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious TROJ_FR.91522159 Sample ed7100eb093e… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ed7100eb093e…. Malware family: TROJ_FR.91522159. Threat score 80/100. 22/28 AV engines flagged this file. 3 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3f","11",{}]] 32:null