24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Symmi.Generic Sample f09c383ab73e… — Score 86/100 — Hybrid Analysis","description":"Malicious verdict for sample f09c383ab73e…. Malware family: Symmi.Generic. Threat score 86/100. 20/26 AV engines flagged this file. 11 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f09c383ab73e21ea1c3c71518b758772c61c9f7cfe257d394dc03d38ec4a7a01","keywords":["Malicious","Symmi.Generic","malware analysis","sandbox report","threat intelligence","f09c383ab73e21ea1c3c71518b758772c61c9f7cfe257d394dc03d38ec4a7a01"],"about":{"@type":"SoftwareApplication","name":"82.exe","applicationCategory":["peexe","executable"],"identifier":"f09c383ab73e21ea1c3c71518b758772c61c9f7cfe257d394dc03d38ec4a7a01","additionalType":"Malicious sample"},"threatScore":86,"malwareFamily":"Symmi.Generic","antivirusDetections":{"malicious":20,"total":26},"behavioralIndicators":{"malicious":11,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T584,"" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460) "" monitors "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 268435461, Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461, Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461, Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461, Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461, Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461, Subtree: 1) "" monitors "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461, Subtree: 1) "" monitors "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 268435461, Subtree: 1) "" monitors "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 268435461, Subtree: 1)26:T5f7,"" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES")27:T5e5,"" wrote bytes "20150B75F0470B75" to virtual address "0x75266194" (part of module "CRYPT32.DLL") "" wrote bytes "4013007580120075A0130075" to virtual address "0x746D8000" (part of module "RSAENH.DLL") "" wrote bytes "70460B7520150B75" to virtual address "0x767074E4" (part of module "SHELL32.DLL") "" wrote bytes "80445277D0D85177" to virtual address "0x7541D094" (part of module "KERNELBASE.DLL") "" wrote bytes "B0393577" to virtual address "0x706A218C" (part of module "WINHTTP.DLL") "" wrote bytes "305DBE756068BE757045BD75" to virtual address "0x76707008" (part of module "SHELL32.DLL") "" wrote bytes "207F3C76D0A8F47510BF09765005097650FC147680101476806F087680B6F47580B80476E0CF15762003FC75B0FB1476E0C7637690A3F475" to virtual address "0x7541D1E8" (part of module "KERNELBASE.DLL") "" wrote bytes "D07F3577608A3577708B3577E0CE3477" to virtual address "0x706A2178" (part of module "WINHTTP.DLL") "" wrote bytes "00795C7540C85E75D0585B75609E6575704B5B75F0745C75807A5A75C09E5E75F0B9657510C16575F098657580035B7560025B7500035E75" to virtual address "0x748AE070" (part of module "DNSAPI.DLL") "" wrote bytes "20354D74809A4D7430854D74B0894D7450C94D7490244D74A09C4D7470204D74B0C74D74107C4D7400CA4D7420CB4D7470384D74E07B4D7430824D7400CB4D7490C74D7410C84D7490C94D74B0C94D74907C4D7470C84D7490384D74" to virtual address "0x7541D15C" (part of module "KERNELBASE.DLL")28:T530,"" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "DISABLECACHINGOFSSLPAGES") "" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK") "" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK")29:T12d9,Found malicious artifacts related to "165.254.207.57" (ASN: 2914, Owner: NTT America, Inc.): ... URL: http://www.funnyordie.com/articles/c77c112ed9/the-8-most-ridiculous-things-from-last-night-s-the-walking-dead (AV positives: 1/62 scanned on 04/06/2015 01:40:17) URL: http://www.funnyordie.com/videos/6bff9b5b67/office-space-w-michael-bolton (AV positives: 1/62 scanned on 04/06/2015 01:36:54) URL: http://www.funnyordie.com/videos/837308646f/carl-s-lactation-station (AV positives: 1/62 scanned on 04/06/2015 01:36:40) URL: http://img.ed4.net/fandango/common/redirect.html?u=http://www.fandango.com/&ed_rid=8ZTMU4S-JHF9I-T4KQL9-0GMU7PP-LQXMNJ-v1&fid=lovessummers@aol.com&wss=EMC&type=_c__ (AV positives: 1/62 scanned on 03/29/2015 01:33:45) URL: http://b.monetate.net/js/1/a-f26115ee/p/talbots.com/396307/g (AV positives: 1/62 scanned on 03/18/2015 19:04:16) File SHA256: 938c93ec5db9fc6a273785a59b22701d3d43f8fc7c647a7031923226822f519c (AV positives: 1/55 scanned on 04/12/2015 03:50:01) File SHA256: 62c6f2122419aafa1fa984f6fd00d0c55a19888b29c80f7b4d7782db5fb42b0f (AV positives: 1/57 scanned on 03/18/2015 18:46:50) File SHA256: 2705b231aa32d31584abf78cef9d35486400a70cdec5e311a4545a2f540f0bfa (AV positives: 1/57 scanned on 03/18/2015 18:34:19) File SHA256: 49411da38d14711e73231c2a853ef1fcfa9e8598444918f7d4a7b039fac4dc20 (AV positives: 1/57 scanned on 03/18/2015 18:23:34) File SHA256: 81e334dc648f02754022cf930c9a4d775830ca7ee73f684fd685c349260a6e8f (AV positives: 1/57 scanned on 03/18/2015 14:29:33) Found malicious artifacts related to "165.254.207.65" (ASN: 2914, Owner: NTT America, Inc.): ... URL: http://api.ning.com/files/WTzCtZrcDp1xLHK38FeIz6AsXQrxzeT9FB6eJuXNKqEiVj67k9h8VrTxTHTJVG4R22fMhWJVojCSV6x8HflG3MacRhqkspSK/TheHunterBlades_1_tysyacha_orkov.rtf (AV positives: 1/62 scanned on 04/12/2015 03:13:37) URL: http://files4.mirror6.net/download/1085002/dl?bc=1085002&pid=solutionswide&brand=solutionswide.com&aid=1257&s=102920e033c617b97890ea2344b193&c=972&country=US&cb=-1916008769&filename=JavaUpdate.exe&productKey=2gaqscd35c47y3pfp7yyeayvuuffgnns&osName=Windows (AV positives: 5/62 scanned on 04/06/2015 03:06:02) URL: http://files4.securedownload5.info/download/1080088/dl?bc=1080088&pid=downloadapps&brand=downloadapps.org&country=US&variation=chwebsite&cb=-447115582&filename=clashofclans-setup.exe&osName=Windows&osVersion=8.1&browserName=IE&browserVersion=11&zTmp=1 (AV positives: 1/62 scanned on 03/28/2015 20:45:34) URL: http://files4.download21.info/download/1173655/dl?bc=1173655&pid=bitberry&brand=bitberry.com&cb=365432226&osName=Windows&osVersion=9.0&browserName=Google+App+Engine%26zTmp%3D1 (AV positives: 9/62 scanned on 03/28/2015 19:21:21) URL: http://files4.download21.info/download/1172508/dl?bc=1172508&pid=gimpshop&brand=gimpshop.com&s=top&country=AU&cb=1472433347&osName=Windows&osVersion=7&browserName=IE&browserVersion=11&zTmp=1 (AV positives: 6/62 scanned on 03/28/2015 00:30:29) File SHA256: a01dce16cfd79b1a14cd0d916ff413626e940cca1e14839d163a096a97803cf2 (AV positives: 14/56 scanned on 03/18/2015 13:37:18) File SHA256: b1b905bfbb83eb93d0b11500313ad84a686e2853a4ecf6c219fc70af4d57da11 (AV positives: 22/57 scanned on 03/17/2015 16:51:16) File SHA256: c9862231a72550adb98be7c5ef74f18b2f7e11119ad4a5b5e9a681c9a06a7c58 (AV positives: 11/57 scanned on 03/10/2015 15:30:37) File SHA256: 36e2de7bb3f4cd00c3ff45e24fe6efb053e0d54e0db41ab1402baf444f75bc82 (AV positives: 17/57 scanned on 03/10/2015 12:36:42) File SHA256: 9f7a8373b457c38822a731359d3b6d9af6563dc4e1276efeade6088d4632bdb5 (AV positives: 15/57 scanned on 03/10/2015 12:27:44) Found malicious artifacts related to "165.254.207.56" (ASN: 2914, Owner: NTT America, Inc.): ... URL: http://www.in2life.gr/ (AV positives: 1/62 scanned on 03/15/2015 09:00:03) URL: http://install-cdn.megabrowse.biz/ (AV positives: 6/62 scanned on 03/11/2015 11:46:50) URL: http://images.thegolfchannel.com/ (AV positives: 1/62 scanned on 03/10/2015 19:08:46) URL: http://download.premiereradio.net/ (AV positives: 1/62 scanned on 03/10/2015 12:36:52) URL: http://dl.downloadahsaequouzet.com/n/3.1.56/12637546 (AV positives: 5/62 scanned on 03/10/2015 05:00:42) File SHA256: b180cd845dc170d5c1a69291ab740fff7cfd5bdaab8d4751979d177829dfd2a0 (AV positives: 1/55 scanned on 03/11/2015 14:08:45) File SHA256: cd4bfa69624a3adc0b0c7ad5045e0c9c95f152bb345af3ed2db19e45beba823b (AV positives: 2/46 scanned on 03/09/2015 04:24:39) File SHA256: a959a92b116f009eaf622f4970c590b5d78d5582f4f1c64b86a509240d069346 (AV positives: 13/57 scanned on 03/08/2015 21:24:43) File SHA256: 66ff963ab4e7688c336799c4c712f959cbeb03b7049f3466fc57931a8753db0b (AV positives: 13/57 scanned on 03/08/2015 20:53:54) File SHA256: 0313a7c04eaace4017020deda70e7d0d221255427355348b109f78afc1d57ce6 (AV positives: 1/57 scanned on 03/08/2015 17:42:54)2a:T44c,"" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS")2b:T5e8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQCSURBVFhHjZbLS1VRFMbv/+Ps0qygiIoKxAR72kOkEKy4WqaVIhHZC6KMMiqhyIkOdJAURJGQUZFRgQOhh6NGQcPGu/2ts7511tn3nPDAx953n7P391trr3P2rdX7LoR672imnuG8hY6eD/Xuc6HedTbUjwyF+sHBTPsHMu05XVTHqUztfbn4m/cgN6dm5gRJzaEycwJwUW9WJf8cJAA+AwSAOQFojjaNPDVsa+RtmficA8kzwMh99Ey9N/eR+8Vo0lohD4FW52UAyEIZAM3L9j0192Y7TzbL33cwGQBMfRZc9OP9e8N4o6M5eogL+cXLzKlKAG/u0g/jvz/mRALhzdPIvdH2E83y9x1EngGae4AY/Z+lR+HXwr0wceZAaNnRbQDhd01Ec/6WsWho/a29BlF4RiGaMwBz3X+YLs/fDstPb4Trx3cZgCwQJ7dsPpz1FaBlQ6dIxqKx70sbITiGuYAoAjADbv9hvjR3MweIqfcLSJ+LxpZmad+3AC4HIIQCSAYiwLvpsQwAk7AFMXosRK0FgH2KtZB9iLx58gYQYLRrm2WABQggiumFEfS/vszB2Fq3YPHJxTDW05pvgbtkG/SyYnMXjdPr/xnwRagZMAAUYbwYOS7Z0xiR9BVAIuUYIFiAeknWLAME8BBVAJoBLiB9pBNvgvbZMnLpa3bsOcxPX0MUGj44FAC+PbtVmQEpRvYTAF6y7/G+vwBeAIAxzb/OXhNj7PvDke7w/cXd8Gn2av4a4i2Ikn5cgMUoe4qtUDOAiHBPI+dvGYsQBoDonk8MWMTTV46JsbQvH8g2oCDFtOwsgLCgQtDMp12EZyidZwCIHFEz5T9fP5YP0OqbqbC6MCnZMACFALCXnBc0oGGFMV9neQsIACFyRA1TQAhAFMYAQQBkBGeEF+CxVQXDMmO0mkXJAD4ySzOXZAFoRSFWXt0Xc4BAgGOk2JZUCOD9VBaQGabGGnkOEDMAgA9TI5aFz/PjcggBBBAQzPGbz0CoGxYwTH1fCo1mqdQcmRSAoc5NUnDIAoSqF81kBxFaCFFiHM+YUayLKpWaqjGVfQkTCKQRBUmhKGGM+zCVc2FffL9p5P+qUd7Qm/KflcoA+nevl5RiK2D4dnLQADAGczNW89K/6hCNaFphjrmFDKDKYeYFEBjjvhnHz7TIA1TBpEqeL2QAUcKQxgsTjaIxqpjHtZ6YBbmFC0bpOOFjW8gAt4DmgGLKmw6rKpDEoKmlMC+uIQCt3Q2LnvIAPKzEPIVIYVIgb+il8wyAKo0eABQzUQXiRaPEVIS5UQJw+c5kWPz4RdqN7YdEFj22yJt7CGaEfQ9U9ZvSebV1W9oMABmAOcYseg+QiuaUW9j6ZWOm4fAPNvfub8PlFUUAAAAASUVORK5CYII=2c:T5e8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQCSURBVFhHjZbLS1VRFMbv/+Ps0qygiIoKxAR72kOkEKy4WqaVIhHZC6KMMiqhyIkOdJAURJGQUZFRgQOhh6NGQcPGu/2ts7511tn3nPDAx953n7P391trr3P2rdX7LoR672imnuG8hY6eD/Xuc6HedTbUjwyF+sHBTPsHMu05XVTHqUztfbn4m/cgN6dm5gRJzaEycwJwUW9WJf8cJAA+AwSAOQFojjaNPDVsa+RtmficA8kzwMh99Ey9N/eR+8Vo0lohD4FW52UAyEIZAM3L9j0192Y7TzbL33cwGQBMfRZc9OP9e8N4o6M5eogL+cXLzKlKAG/u0g/jvz/mRALhzdPIvdH2E83y9x1EngGae4AY/Z+lR+HXwr0wceZAaNnRbQDhd01Ec/6WsWho/a29BlF4RiGaMwBz3X+YLs/fDstPb4Trx3cZgCwQJ7dsPpz1FaBlQ6dIxqKx70sbITiGuYAoAjADbv9hvjR3MweIqfcLSJ+LxpZmad+3AC4HIIQCSAYiwLvpsQwAk7AFMXosRK0FgH2KtZB9iLx58gYQYLRrm2WABQggiumFEfS/vszB2Fq3YPHJxTDW05pvgbtkG/SyYnMXjdPr/xnwRagZMAAUYbwYOS7Z0xiR9BVAIuUYIFiAeknWLAME8BBVAJoBLiB9pBNvgvbZMnLpa3bsOcxPX0MUGj44FAC+PbtVmQEpRvYTAF6y7/G+vwBeAIAxzb/OXhNj7PvDke7w/cXd8Gn2av4a4i2Ikn5cgMUoe4qtUDOAiHBPI+dvGYsQBoDonk8MWMTTV46JsbQvH8g2oCDFtOwsgLCgQtDMp12EZyidZwCIHFEz5T9fP5YP0OqbqbC6MCnZMACFALCXnBc0oGGFMV9neQsIACFyRA1TQAhAFMYAQQBkBGeEF+CxVQXDMmO0mkXJAD4ySzOXZAFoRSFWXt0Xc4BAgGOk2JZUCOD9VBaQGabGGnkOEDMAgA9TI5aFz/PjcggBBBAQzPGbz0CoGxYwTH1fCo1mqdQcmRSAoc5NUnDIAoSqF81kBxFaCFFiHM+YUayLKpWaqjGVfQkTCKQRBUmhKGGM+zCVc2FffL9p5P+qUd7Qm/KflcoA+nevl5RiK2D4dnLQADAGczNW89K/6hCNaFphjrmFDKDKYeYFEBjjvhnHz7TIA1TBpEqeL2QAUcKQxgsTjaIxqpjHtZ6YBbmFC0bpOOFjW8gAt4DmgGLKmw6rKpDEoKmlMC+uIQCt3Q2LnvIAPKzEPIVIYVIgb+il8wyAKo0eABQzUQXiRaPEVIS5UQJw+c5kWPz4RdqN7YdEFj22yJt7CGaEfQ9U9ZvSebV1W9oMABmAOcYseg+QiuaUW9j6ZWOm4fAPNvfub8PlFUUAAAAASUVORK5CYII=2d:T5e8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQCSURBVFhHjZbLS1VRFMbv/+Ps0qygiIoKxAR72kOkEKy4WqaVIhHZC6KMMiqhyIkOdJAURJGQUZFRgQOhh6NGQcPGu/2ts7511tn3nPDAx953n7P391trr3P2rdX7LoR672imnuG8hY6eD/Xuc6HedTbUjwyF+sHBTPsHMu05XVTHqUztfbn4m/cgN6dm5gRJzaEycwJwUW9WJf8cJAA+AwSAOQFojjaNPDVsa+RtmficA8kzwMh99Ey9N/eR+8Vo0lohD4FW52UAyEIZAM3L9j0192Y7TzbL33cwGQBMfRZc9OP9e8N4o6M5eogL+cXLzKlKAG/u0g/jvz/mRALhzdPIvdH2E83y9x1EngGae4AY/Z+lR+HXwr0wceZAaNnRbQDhd01Ec/6WsWho/a29BlF4RiGaMwBz3X+YLs/fDstPb4Trx3cZgCwQJ7dsPpz1FaBlQ6dIxqKx70sbITiGuYAoAjADbv9hvjR3MweIqfcLSJ+LxpZmad+3AC4HIIQCSAYiwLvpsQwAk7AFMXosRK0FgH2KtZB9iLx58gYQYLRrm2WABQggiumFEfS/vszB2Fq3YPHJxTDW05pvgbtkG/SyYnMXjdPr/xnwRagZMAAUYbwYOS7Z0xiR9BVAIuUYIFiAeknWLAME8BBVAJoBLiB9pBNvgvbZMnLpa3bsOcxPX0MUGj44FAC+PbtVmQEpRvYTAF6y7/G+vwBeAIAxzb/OXhNj7PvDke7w/cXd8Gn2av4a4i2Ikn5cgMUoe4qtUDOAiHBPI+dvGYsQBoDonk8MWMTTV46JsbQvH8g2oCDFtOwsgLCgQtDMp12EZyidZwCIHFEz5T9fP5YP0OqbqbC6MCnZMACFALCXnBc0oGGFMV9neQsIACFyRA1TQAhAFMYAQQBkBGeEF+CxVQXDMmO0mkXJAD4ySzOXZAFoRSFWXt0Xc4BAgGOk2JZUCOD9VBaQGabGGnkOEDMAgA9TI5aFz/PjcggBBBAQzPGbz0CoGxYwTH1fCo1mqdQcmRSAoc5NUnDIAoSqF81kBxFaCFFiHM+YUayLKpWaqjGVfQkTCKQRBUmhKGGM+zCVc2FffL9p5P+qUd7Qm/KflcoA+nevl5RiK2D4dnLQADAGczNW89K/6hCNaFphjrmFDKDKYeYFEBjjvhnHz7TIA1TBpEqeL2QAUcKQxgsTjaIxqpjHtZ6YBbmFC0bpOOFjW8gAt4DmgGLKmw6rKpDEoKmlMC+uIQCt3Q2LnvIAPKzEPIVIYVIgb+il8wyAKo0eABQzUQXiRaPEVIS5UQJw+c5kWPz4RdqN7YdEFj22yJt7CGaEfQ9U9ZvSebV1W9oMABmAOcYseg+QiuaUW9j6ZWOm4fAPNvfub8PlFUUAAAAASUVORK5CYII=1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"f09c383ab73e21ea1c3c71518b758772c61c9f7cfe257d394dc03d38ec4a7a01","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":86,"unified_at_epoch_ms":1790344674414,"unified_at":"2026-09-25T13:57:54.414Z","metadata":{"hashes":{"sha256":"f09c383ab73e21ea1c3c71518b758772c61c9f7cfe257d394dc03d38ec4a7a01","sha1":"887421544197fa2467c0916b499ef661b528a755","md5":"17cfe88703b471940c22aa01a367a2a3","sha512":"5fa8075b28943fd130c8fa26fb951584e9147eb876da130f8b603c4ae94e16d1145275b4c76a04384a9075a04434ffbc18af3c4b32039a527e1396274e6a9b1f","ssdeep":"1536:Mr/CbYIrPan7x8J3WAhrwI/NR8PxR0nfTbqhC61EiunVwhs+P5NVz4:MrmYIrC+F/rwSNWxRqyGnUs+P5NVs","ssdeep_chunks":["1536:Mr/CbYI","1536:r/CbYIr","1536:/CbYIrP","1536:CbYIrPa","1536:bYIrPan","1536:YIrPan7","1536:IrPan7x","1536:rPan7x8","1536:Pan7x8J","1536:an7x8J3","1536:n7x8J3W","1536:7x8J3WA","1536:x8J3WAh","1536:8J3WAhr","1536:J3WAhrw","1536:3WAhrwI","1536:WAhrwI/","1536:AhrwI/N","1536:hrwI/NR","1536:rwI/NR8","1536:wI/NR8P","1536:I/NR8Px","1536:/NR8PxR","1536:NR8PxR0","1536:R8PxR0n","1536:8PxR0nf","1536:PxR0nfT","1536:xR0nfTb","1536:R0nfTbq","1536:0nfTbqh","1536:nfTbqhC","1536:fTbqhC6","1536:TbqhC61","1536:bqhC61E","1536:qhC61Ei","1536:hC61Eiu","1536:C61Eiun","1536:61EiunV","1536:1EiunVw","1536:EiunVwh","1536:iunVwhs","1536:unVwhs+","1536:nVwhs+P","1536:Vwhs+P5","1536:whs+P5N","1536:hs+P5NV","1536:s+P5NVz","1536:+P5NVz4","3072:Mr/CbYI","3072:r/CbYIr","3072:/CbYIrP","3072:CbYIrPa","3072:bYIrPan","3072:YIrPan7","3072:IrPan7x","3072:rPan7x8","3072:Pan7x8J","3072:an7x8J3","3072:n7x8J3W","3072:7x8J3WA","3072:x8J3WAh","3072:8J3WAhr","3072:J3WAhrw","3072:3WAhrwI","3072:WAhrwI/","3072:AhrwI/N","3072:hrwI/NR","3072:rwI/NR8","3072:wI/NR8P","3072:I/NR8Px","3072:/NR8PxR","3072:NR8PxR0","3072:R8PxR0n","3072:8PxR0nf","3072:PxR0nfT","3072:xR0nfTb","3072:R0nfTbq","3072:0nfTbqh","3072:nfTbqhC","3072:fTbqhC6","3072:TbqhC61","3072:bqhC61E","3072:qhC61Ei","3072:hC61Eiu","3072:C61Eiun","3072:61EiunV","3072:1EiunVw","3072:EiunVwh","3072:iunVwhs","3072:unVwhs+","3072:nVwhs+P","3072:Vwhs+P5","3072:whs+P5N","3072:hs+P5NV","3072:s+P5NVz","3072:+P5NVz4","1536:MrmYIrC","1536:rmYIrC+","1536:mYIrC+F","1536:YIrC+F/","1536:IrC+F/r","1536:rC+F/rw","1536:C+F/rwS","1536:+F/rwSN","1536:F/rwSNW","1536:/rwSNWx","1536:rwSNWxR","1536:wSNWxRq","1536:SNWxRqy","1536:NWxRqyG","1536:WxRqyGn","1536:xRqyGnU","1536:RqyGnUs","1536:qyGnUs+","1536:yGnUs+P","1536:GnUs+P5","1536:nUs+P5N","1536:Us+P5NV","1536:s+P5NVs"],"imphash":"19ea617cb2ccb2def12975f7d2a753a7"},"file_info":{"file_name":"82.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":114688,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1522898022000,"last_seen":1713413245000,"last_multi_scan":1713413245000}},"detections":{"summary":{"verdict":"malicious","score":86,"tags":null},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":8,"suspicious_count":19,"malicious_count":11,"total":38},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Dridex","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.SGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.ZPACK.Gen4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Symmi.54582","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bkavpro":{"name":"Bkav Pro","success":true,"verdict":"malicious","threat_name":"W32.Malware.A0DA658B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Symmi.54582 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Dridex.P trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Drixed-FAS!17CFE88703B4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Cridex.dtssan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_99","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Dridex-FB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Dridld.MWLD-1745","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Zyx.ANL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Worm.Cridex","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Dridex.Win32.165","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Symmi.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts server","description":"\"62.210.214.106:448\"\n \"165.254.207.57:80\"\n \"165.254.207.65:80\"\n \"165.254.207.72:80\"\n \"165.254.207.56:80\"\n \"184.24.34.145:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Global\\9f61a776cd4244038259dcdcc1944e21\"\n \"Global\\ee5d5b2f29002bfa4e44e1060e4cc750\"\n \"Global\\65e0622ddd2825e52e2004eec9479fc6\"\n \"Global\\024334684efb284ee5fca20334cd1b26\"\n \"Global\\4070167c5137581cfcbe0ef1d25719a7\"\n \"Global\\7bcc2570c23b306d4cd731fd126d4d58\"\n \"Global\\5144b5ec31a447d2592be25a6529cab8\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"CRYPT32.DLL\" at base 75180000\n \"\" loaded module \"URLMON.DLL\" at base 6FFD0000\n \"\" loaded module \"API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL\" at base 75BD0000\n \"\" loaded module \"DNSAPI.DLL\" at base 74840000\n \"\" loaded module \"SECUR32.DLL\" at base 74060000\n \"\" loaded module \"OLEAUT32.DLL\" at base 75940000\n \"\" loaded module \"WINHTTP.DLL\" at base 70610000\n \"\" loaded module \"C:\\WINDOWS\\SYSTEM32\\MSWSOCK.DLL\" at base 749D0000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"\" queried SystemProcessInformation at 00276343-00003236-778BA1F0-285528\n \"\" queried SystemProcessInformation at 00276343-00003236-778BA1F0-285601\n \"\" queried SystemProcessInformation at 00276343-00003236-778BA1F0-285618\n \"\" queried SystemProcessInformation at 00276343-00003236-778BA1F0-285743\n \"\" queried SystemProcessInformation at 00276343-00003236-778BA1F0-285921\n \"\" queried SystemProcessInformation at 00276343-00003236-778BA1F0-285980\n \"\" queried SystemProcessInformation at 00276343-00003236-778BA1F0-286040\n \"\" queried SystemProcessInformation at 00276343-00003236-778BA1F0-286101\n \"\" queried SystemProcessInformation at 00276343-00003236-778BA1F0-286163\n \"\" queried SystemProcessInformation at 00276343-00003236-778BA1F0-286226","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"CODE with unusual entropies 7.02439226331","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\", Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"$25","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"level":"suspicious","category":"Network Related","name":"Found potential URL in binary/memory","description":"\"http://www.mp3dev.org/\"","origin":"File/Memory","relevance":2,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-3415856703-3035846784-2657674405-1001\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"suspicious","category":"System Security","name":"Alters Software Policy Settings","description":"$26","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"Claimed CRC 2918613665 does not match actual CRC 165617","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetComputerNameW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$27","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Queries/modifies the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$28","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"Wrote 161 instructions to foreign process \"Explorer.EXE\" (UID: 00285625-00001516)\n Wrote 375 instructions to foreign process \"Explorer.EXE\" (UID: 00285625-00001516)\n Wrote 375 instructions to foreign process \"taskhostex.exe\" (UID: 00314875-00001372)\n Wrote 161 instructions to foreign process \"taskhostex.exe\" (UID: 00314875-00001372)","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"malicious","category":"General","name":"Sample was identified as malicious by at least one Antivirus engine","description":"8/54 Antivirus vendors marked sample as malicious (14% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00004695 bytes of memory in \"explorer.exe\" (Protection: \"execute/read/write\")\n \"\" allocated 00524288 bytes of memory in \"explorer.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"Explorer.EXE\" (UID: 00285625-00001516)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 524288 bytes to a foreign process \"explorer.exe\" (PID: 00001516)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$29","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"level":"malicious","category":"System Security","name":"Alters System Certificates Settings","description":"$2a","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"malicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-3415856703-3035846784-2657674405-1001\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-3415856703-3035846784-2657674405-1001\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-3415856703-3035846784-2657674405-1001\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-3415856703-3035846784-2657674405-1001\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\", Value: \"01000000\")","origin":"Registry Access","relevance":8,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00123328-00002944-5052-215-00408E94","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab48D6.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar48F7.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab4C24.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar4C25.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"ConvertSidToStringSidW@sechost.dll\"\n \"2147483648@profapi.dll\"\n \"AddMandatoryAce@ADVAPI32.dll\"\n \"GetMartaExtensionInterface@ntmarta.dll\"\n \"2147483648@SHLWAPI.dll\"\n \"CryptAcquireContextW@ADVAPI32.dll\"\n \"CryptAcquireContextW@CRYPTSP.dll\"\n \"CPAcquireContext@rsaenh.dll\"\n \"CPReleaseContext@rsaenh.dll\"\n \"CPGenKey@rsaenh.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameExW@SSPICLI.DLL at 00123328-00002944-7745228D-141345","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Cab48D6.tmp\" has type \"Microsoft Cabinet archive data, 48151 bytes, 1 file\"\n \"Tar48F7.tmp\" has type \"data\"\n \"Cab4C24.tmp\" has type \"Microsoft Cabinet archive data, 48151 bytes, 1 file\"\n \"Tar4C25.tmp\" has type \"data\"\n \"94308059B57B3142E455B38A6EB92015\" has type \"data\"\n \"62_210_214_106[1].htm\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"RasRpcGetVersion@RASMAN.DLL at 00123328-00002944-7745228D-140222","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting a value in the registry","description":"\"\" (Access type: \"CREATE\", Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"listen@WS2_32.DLL at 00123328-00002944-7745228D-132360\n RasPortListen@RASMAN.DLL at 00123328-00002944-7745228D-139736","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00123328-00002944-7745228D-171564\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00123328-00002944-5052-68-004015C8\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00123328-00002944-5052-100-00407DEB\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00123328-00002944-5052-76-00407BF0","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"Z:\\f09c383ab73e21ea1c3c71518b758772c61c9f7cfe257d394dc03d38ec4a7a01\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab48D6.tmp\" for deletion\n \"Z:\\f09c383ab73e21ea1c3c71518b758772c61c9f7cfe257d394dc03d38ec4a7a01\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar48F7.tmp\" for deletion\n \"Z:\\f09c383ab73e21ea1c3c71518b758772c61c9f7cfe257d394dc03d38ec4a7a01\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab4C24.tmp\" for deletion\n \"Z:\\f09c383ab73e21ea1c3c71518b758772c61c9f7cfe257d394dc03d38ec4a7a01\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar4C25.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab48D6.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar48F7.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab4C24.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar4C25.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtSetSystemInformation@NTDLL.DLL at 00123328-00002944-7745228D-154500\n NtQueryInformationProcess@NTDLL.DLL at 00123328-00002944-7745228D-171736\n NtQueryVirtualMemory@NTDLL.DLL at 00123328-00002944-7745228D-176609","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":39,"imported_dlls_count":292,"dropped_files_count":0,"extracted_files_count":6,"files_written_count":45,"files_deleted_count":0,"registry_keys_created_count":157,"registry_keys_modified_count":0,"registry_keys_deleted_count":3,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":160,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":6,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"559e71fd0e316dc724812abe","environment_id":3,"environment_description":"Windows 8.1 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":82,"malware_family":"LooksLike.Dridex","contacted_countries":["FRA","USA"],"submit_name":"82.exe","analysis_start_time":"2015-07-09T08:07:22+00:00","indicators_count":{"informative":3,"suspicious":12,"malicious":10},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"559e4cb00e316d566a0ebd2a","environment_id":4,"state":"ERROR","error_type":"Failed to save report to webservice","verdict":"undetected","submit_name":"82.exe","analysis_start_time":"2015-07-09T10:28:00+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"559e41620e316d6608caeb97","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":86,"malware_family":"LooksLike.Dridex","contacted_countries":["FRA"],"submit_name":"82.exe","analysis_start_time":"2015-07-09T04:39:59+00:00","indicators_count":{"informative":8,"suspicious":27,"malicious":13},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"62.210.214.106","port":448,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"address":"165.254.207.57","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"address":"165.254.207.65","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"address":"165.254.207.72","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"address":"165.254.207.56","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"address":"184.24.34.145","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}],"processes":[{"pid":3236,"ppid":0,"name":"f09c383ab73e21ea1c3c71518b758772c61c9f7cfe257d394dc03d38ec4a7a01","command_line":"","normalized_path":"","uid":"00276343-00003236","icon":"$2b"},{"pid":1516,"ppid":0,"name":"Explorer.EXE","command_line":"","normalized_path":"","uid":"00285625-00001516","icon":"$2c"},{"pid":1372,"ppid":0,"name":"taskhostex.exe","command_line":"","normalized_path":"","uid":"00314875-00001372","icon":"$2d"}],"all_imported_dlls":["Windows.Devices.Geolocation.dll","sxs.dll","msiltcfg.dll","es.dll","DevDispItemProvider.dll","profapi.dll","cfgmgr32.dll","UxTheme.dll","SHELL32.dll","MSCTF.dll","schannel.DLL","wwanapi.dll","UIRibbonRes.dll","SHLWAPI.dll","msxml6.dll","Windows.Web.dll","WLDP.DLL","mswsock.dll","iertutil.dll","SHCORE.dll","KERNEL32.DLL","MrmCoreR.dll","AuthBroker.dll","bcrypt.dll","TWINAPI.dll","wlanapi.dll","d3d11.dll","davclnt.dll","ElsLad.dll","rsaenh.dll","npmproxy.dll","WTSAPI32.dll","drprov.dll","dwmapi.dll","gpapi.dll","WSSync.dll","windowscodecs.dll","SettingSyncCore.dll","WINTRUST.dll","IPHLPAPI.DLL","Secur32.dll","msi.dll","Comctl32.dll","XmlLite.dll","tquery.dll","rasadhlp.dll","ADVAPI32.dll","urlmon.dll","DEVOBJ.dll","ole32.dll","UIAutomationCore.DLL","SyncCenter.dll","Syncreg.dll","gdiplus.dll","GDI32.dll","MPR.dll","fwpuclnt.dll","NSI.dll","shacct.dll","PlaySndSrv.dll","Windows.Globalization.Fontgroups.dll","msauserext.dll","wpc.dll","LINKINFO.dll","wer.dll","sfc_os.dll","FLTLIB.DLL","Windows.Globalization.dll","Windows.UI.Xaml.dll","NETAPI32.dll","AUDIOSES.DLL","BatMeter.dll","dxgi.dll","KERNELBASE.dll","VERSION.dll","IDStore.dll","bitsprx7.dll","AVRT.dll","lockscreencn.dll","MSIMG32.dll","AltTab.dll","apphelp.dll","samcli.dll","OLEACC.dll","elscore.dll","wscinterop.dll","netutils.dll","WINMM.dll","VBoxMRXNP.dll","VirtDisk.dll","MsftEdit.dll","dhcpcsvc.DLL","WINSTA.dll","WinTypes.dll","PROPSYS.dll","ondemandconnroutehelper.dll","globinputhost.dll","syncui.dll","Normaliz.dll","dhcpcsvc6.DLL","pcacli.dll","CHARTV.dll","shcore.dll","mssprxy.dll","HID.DLL","hgcpl.dll","wpncore.dll","tiptsf.dll","DUser.dll","SndVolSSO.DLL","ncrypt.dll","combase.dll","PackageStateRoaming.dll","prnfldr.dll","dxp.dll","PhotoMetadataHandler.dll","PSAPI.DLL","ieframe.dll","midimap.dll","bitsprx2.dll","gameux.dll","windows.immersiveshell.serviceprovider.dll","wwapi.dll","SETUPAPI.dll","USERENV.dll","SettingMonitor.dll","actxprxy.dll","WINMMBASE.dll","bcryptPrimitives.dll","WSCAPI.dll","threadpoolwinrt.dll","Windows.UI.dll","dcomp.dll","DAVHLPR.dll","CFGMGR32.dll","NetworkExplorer.dll","wlidprov.dll","NInput.dll","Windows.Networking.Sockets.PushEnabledApplication.dll","bitsprx6.dll","bitsprx3.dll","Windows.UI.Immersive.dll","ntmarta.dll","SHDOCVW.dll","MSACM32.dll","ntshrui.dll","NetworkStatus.dll","pnidui.dll","srvcli.dll","clbcatq.dll","twinui.dll","sppc.dll","wpnprv.dll","SYNCENG.dll","ESENT.dll","SspiCli.dll","framedynos.dll","DUI70.dll","NTASN1.dll","twinapi.appcore.dll","netprofm.dll","werconcpl.dll","EhStorShell.dll","EhStorAPI.dll","MsCtfMonitor.dll","ncryptsslp.dll","PortableDeviceTypes.dll","WSClient.dll","BluetoothApis.dll","MSWB7.dll","wercplsupport.dll","Windows.UI.Search.dll","taskschd.dll","imapi2.dll","OLEAUT32.dll","CRYPTBASE.dll","D3D10Warp.dll","thumbcache.dll","POWRPROF.dll","Actioncenter.dll","SLC.dll","Windows.Security.Authentication.OnlineId.dll","TimeBrokerClient.dll","wininet.dll","SETTINGSYNCPOLICY.dll","provsvc.dll","DPAPI.DLL","user32.dll","UIAnimation.dll","explorerframe.dll","twinui.appcore.dll","IconCodecService.dll","powrprof.dll","MMDevApi.dll","wpdshserviceobj.dll","stobject.dll","RPCRT4.dll","searchfolder.dll","PortableDeviceApi.dll","qmgrprxy.dll","d2d1.dll","ksuser.dll","msvcrt.dll","dwrite.dll","cscapi.dll","srchadmin.dll","wevtapi.dll","dlnashext.dll","WSShared.dll","Bcp47Langs.dll","InputSwitch.dll","ntlanman.dll","WINNSI.DLL","Windows.Networking.Connectivity.dll","bitsprx5.dll","StructuredQuery.dll","ntdll.dll","DNSAPI.dll","AepRoam.dll","nlaapi.dll","sechost.dll","USER32.dll","SqmApi.dll","CRYPTSP.dll","IMM32.DLL","CRYPT32.dll","advapi32.dll","WININET.dll","MSUTB.dll","sqmapi.dll","WS2_32.dll","authui.dll","atlthunk.dll","kernel.appcore.dll","shell32.dll","winhttp.dll","hcproviders.dll","MSASN1.dll","PlayToDevice.dll","wkscli.dll","wincorlib.DLL","SAMLIB.dll","uxtheme.dll","comctl32.dll","credssp.dll","GPAPI.dll","wship6.dll","shdocvw.dll","winrnr.dll","dnsapi.DLL","wlanutil.dll","fxsst.dll","USP10.dll","QUtil.dll","WindowsCodecs.dll","pnrpnsp.dll","napinsp.dll","ATL.DLL","CRYPTUI.dll","WLDAP32.dll","CLBCatQ.DLL","wshtcpip.DLL","QAgent.dll","secur32.dll","Cabinet.dll","iphlpapi.DLL","Wlanapi.dll","LPK.dll","SXS.DLL","netshell.dll","DEVRTL.dll","WINHTTP.dll","RASAPI32.dll","bcryptprimitives.dll","ws2_32.DLL","kernel32.dll","wintrust.dll","FXSAPI.dll","sensapi.dll","wshqos.dll","EXPLORERFRAME.dll","ehSSO.dll","rtutils.dll","slc.dll","rasman.dll","msls31.dll","cryptnet.dll","FXSRESM.DLL","NLAapi.dll","IMM32.dll","SSPICLI.DLL","RpcRtRemote.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"94308059B57B3142E455B38A6EB92015","sha256":"c50358a07427e39921e25d6e006a1135d98a63ac2bfdf6e8e3d967dfa58d99be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"name":"62_210_214_106[1].htm","sha256":"c024529c5b48904f3ed274b033ef9eb4e2e449916bd5e9ee845ccf12aefddbe9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"name":"Cab48D6.tmp","sha256":"459e3eb1819fd94f6cb0d6a9c790e53720cf0733370f92823f31ba7545036f8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"name":"Cab4C24.tmp","sha256":"459e3eb1819fd94f6cb0d6a9c790e53720cf0733370f92823f31ba7545036f8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"name":"Tar48F7.tmp","sha256":"0efe8455a273c22d2fdcf3d02be7f446a515a5504182a65d64a347c82972ce4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"name":"Tar4C25.tmp","sha256":"0efe8455a273c22d2fdcf3d02be7f446a515a5504182a65d64a347c82972ce4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\counters.dat","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"path":"C:\\Users\\Payload","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"path":"%WINDIR%\\system32\\en-US\\mswsock.dll.mui","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"path":"%WINDIR%\\System32\\en-US\\wshqos.dll.mui","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"path":"%WINDIR%\\system32\\en-US\\CRYPT32.dll.mui","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-3415856703-3035846784-2657674405-1001","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-3415856703-3035846784-2657674405-1001\\b72d34a8e89960dad17395ae988d342e_db02cb2a-b93a-4b07-a99a-e0efc13dbb68","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"path":"C:\\node.config","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"path":"C:\\nonode","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"path":"C:\\nolisten","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"path":"\\Device\\DeviceApi\\Dev\\Query","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"%WINDIR%\\system32\\en-US\\WINHTTP.dll.mui","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\E9S7QCHY\\62_210_214_106[1].htm","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{791DAE2A-1BBE-3176-7D53-938CB81AF29B}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{791DAE2A-1BBE-3176-7D53-938CB81AF29B}\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{81996A1B-3717-C4CC-B35D-9688172A6CD0}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{81996A1B-3717-C4CC-B35D-9688172A6CD0}\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{68B8D88F-D725-B651-406B-427B4CA376FF}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{68B8D88F-D725-B651-406B-427B4CA376FF}\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{B05F5701-569A-CADE-4220-403CEA09A2A7}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{B05F5701-569A-CADE-4220-403CEA09A2A7}\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{FEA8688B-7664-15EA-17B7-13A9D44C5FF5}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{FEA8688B-7664-15EA-17B7-13A9D44C5FF5}\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{1B831649-9328-349C-DDA9-07C97D0AA4AE}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{F2B77518-1B5C-9594-0500-83569DC6E8C6}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{FA536E9B-4BEF-3A51-BC66-F885A3E09054}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{95370519-D415-EBF2-BDCE-DD0350733E28}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.3G2\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.3GP\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.3GP2\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.3GPP\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AAC\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.ADT\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.ADTS\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AIF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AIFC\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AIFF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.ASF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.ASX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AU\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AU3\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AVI\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.BMP\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.CAB\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.CDXML\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.CONTACT\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.CSS\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.CSV\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.DDS\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.DIB\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.DLL\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.DOC\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.DOCM\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.DOCX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.DOT\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.DOTM\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.DOTX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.DWFX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.EASMX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.EDRWX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.EMF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.EPRTX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.EXE\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.FON\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.GIF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.HTM\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.HTML\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.ICO\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.INI\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.JFIF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.JPE\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.JPEG\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.JPG\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.JTX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.JXR\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.LNK\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.M1V\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.M2T\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.M2TS\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.M2V\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.M3U\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.M4A\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.M4V\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MHT\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MHTML\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MID\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MIDI\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MOD\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MOV\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MP2\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MP2V\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MP3\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MP4\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MP4V\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MPA\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MPE\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MPEG\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MPG\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MPV2\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MSG\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.MTS\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.OCX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.ODT\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.OTF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.OXPS\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.PANO\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.PNG\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.POT\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.POTM\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.POTX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.PPAM\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.PPSM\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.PPSX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.PPT\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.PPTM\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.PPTX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.PS1XML\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.PSSC\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.RLE\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.RMI\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.RTF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.SCF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.SEARCH-MS\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.SHTML\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.SLDM\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.SLDX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.SND\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.SYS\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.TIF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.TIFF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.TS\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.TTC\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.TTF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.TTS\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.TXT\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.WAV\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.WAX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.WDP\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.WM\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.WMA\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.WMF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.WMV\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.WMX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.WPL\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.WVX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.XLAM\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.XLS\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.XLSB\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.XLSM\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.XLSX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.XLT\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.XLTM\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.XLTX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.XML\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.XPS\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.XSL\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.ZIP\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SESSIONINFO\\1\\WHCICONSTARTUP\\","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{603745C8-8510-1718-A739-1DDC9059E44D}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{603745C8-8510-1718-A739-1DDC9059E44D}\\","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{95370519-D415-EBF2-BDCE-DD0350733E28}\\SHELLFOLDER\\01D0BA487A492E1D\\01D0BA487A492E1D","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"},{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"name":"Global\\9f61a776cd4244038259dcdcc1944e21","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\ee5d5b2f29002bfa4e44e1060e4cc750","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\65e0622ddd2825e52e2004eec9479fc6","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\024334684efb284ee5fca20334cd1b26","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\4070167c5137581cfcbe0ef1d25719a7","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\7bcc2570c23b306d4cd731fd126d4d58","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\5144b5ec31a447d2592be25a6529cab8","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\699b8a2d0757bfc25fdd667670ac6236","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\122c601c39aca7e00d67fa196a8e1ee7","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\0c6631dba6f8630f4ee6dac205d8bcbe","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\517e84197dc02abd23b549e1a6211e0a","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\a400d70038d44f1535d8c6ec84329be2","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\2a7bb14994a1939763391b02e9d34990","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\5dc5f7ad8caac9cd4e62faeb144a7ca5","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\bb9c196d95bb89d222b359491a60ee55","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\af916fb3f95ff8d6d4a7814ce3978f78","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\bb7c62b19728718dfb0ae82159775006","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\8729676c9dbfcc5f802440aa39351890","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\01936bfe2b9e120f0836b78a81cf3e80","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\977a01bd7dc39816636e2e08cf722104","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\c26903bf3c88d3c4aae6066a70657955","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\81ae52981bc5f839c4f5d3acebc26c2d","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\311007fc0645c6a214679eebdf67cb8f","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\9790050107edc2391f152bc2a56c76d3","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\756875a9ab92e1272062116d4070d5db","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"Global\\f6ff242cc9a1aee6c7e50d12df79c544","sources":[{"report_type":"sandbox","report_id":"559e71fd0e316dc724812abe"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"name":"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]},{"name":"Global\\75058011b31c0df257fd601eb8f5318e","sources":[{"report_type":"sandbox","report_id":"559e41620e316d6608caeb97"}]}]}},"report_ids":{"sandbox_job_ids":["559e41620e316d6608caeb97","559e71fd0e316dc724812abe"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Symmi.Generic Sample f09c383ab73e… — Score 86/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f09c383ab73e…. Malware family: Symmi.Generic. Threat score 86/100. 20/26 AV engines flagged this file. 11 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f09c383ab73e21ea1c3c71518b758772c61c9f7cfe257d394dc03d38ec4a7a01"}],["$","meta","4",{"property":"og:title","content":"Malicious Symmi.Generic Sample f09c383ab73e… — Score 86/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f09c383ab73e…. Malware family: Symmi.Generic. Threat score 86/100. 20/26 AV engines flagged this file. 11 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f09c383ab73e21ea1c3c71518b758772c61c9f7cfe257d394dc03d38ec4a7a01"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Symmi.Generic Sample f09c383ab73e… — Score 86/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f09c383ab73e…. Malware family: Symmi.Generic. Threat score 86/100. 20/26 AV engines flagged this file. 11 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]