21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T424,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample fa43a255473d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample fa43a255473d…. Threat score 100/100. 0/25 AV engines flagged this file. 3 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fa43a255473d1bdde08aa2360940212b9ef98990dec870487962ba057e1dcf5f","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","fa43a255473d1bdde08aa2360940212b9ef98990dec870487962ba057e1dcf5f"],"about":{"@type":"SoftwareApplication","name":"eis_nt32.exe","applicationCategory":["peexe","executable"],"identifier":"fa43a255473d1bdde08aa2360940212b9ef98990dec870487962ba057e1dcf5f","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":25},"behavioralIndicators":{"malicious":3,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T445,"eis_nt32.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}\eis_nt32.exe" "eis_nt32.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts\bootstrapper_20200803160026.log" "eis_nt32.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}\.erm\epi-base.zip" "eis_nt32.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}\sciter-x.dll" "eis_nt32.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}\eguiActivation.dll" "eis_nt32.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}\eguiActivationLang.dll" "eis_nt32.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}\plgInstaller.dll" "eis_nt32.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}\BootHelper.exe"23:T459,"eis_nt32.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "eis_nt32.exe" touched file "C:\Windows\SysWOW64\en-US\msctf.dll.mui" "eis_nt32.exe" touched file "C:\Windows\Fonts\StaticCache.dat" "eis_nt32.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "eis_nt32.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "eis_nt32.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db" "eis_nt32.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "eis_nt32.exe" touched file "C:\Windows\SysWOW64\shdocvw.dll" "eis_nt32.exe" touched file "C:\Windows\SysWOW64\en-US\shdocvw.dll.mui" "eis_nt32.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "eis_nt32.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "eis_nt32.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db" "eis_nt32.exe" touched file "C:\Windows\SysWOW64\rsaenh.dll"24:T2198,Pattern match: ".msi.eula/manifest.erm" Pattern match: ".msi.eula/eulabgr.html" Pattern match: ".msi.eula/eulachs.html" Pattern match: ".msi.eula/eulacht.html" Pattern match: ".msi.eula/eulahrv.html" Pattern match: ".msi.eula/eulacsy.html" Pattern match: ".msi.eula/eulanld.html" Pattern match: ".msi.eula/eulaenu.html" Pattern match: ".msi.eula/eulafin.html" Pattern match: ".msi.eula/eulafra.html" Pattern match: ".msi.eula/euladeu.html" Pattern match: ".msi.eula/eulahun.html" Pattern match: ".msi.eula/eulaita.html" Pattern match: ".msi.eula/eulajpn.html" Pattern match: ".msi.eula/eulanor.html" Pattern match: ".msi.eula/eulaplk.html" Pattern match: ".msi.eula/eulaptb.html" Pattern match: ".msi.eula/eularom.html" Pattern match: ".msi.eula/eularus.html" Pattern match: ".msi.eula/eulasky.html" Pattern match: ".msi.eula/eulaslv.html" Pattern match: ".msi.eula/eulaesn.html" Pattern match: ".msi.eula/eulasve.html" Pattern match: ".msi.eula/eulatrk.html" Pattern match: ".msi.eula/eulaukr.html" Pattern match: ".msi.eula/euladan.html" Pattern match: ".msi.eula/eulafrc.html" Pattern match: ".msi.eula/eulaell.html" Pattern match: ".msi.eula/eulaare.html" Pattern match: ".msi.eula/eulaheb.html" Pattern match: ".msi.eula/eulaeti.html" Pattern match: ".msi.eula/eulasrl.html" Pattern match: ".msi.eula/eulatha.html" Pattern match: ".msi.eula/eulakkz.html" Pattern match: ".msi.eula/eulakor.html" Pattern match: ".msi.eula/eulaesl.html" Pattern match: ".msi.eula/eulalvi.html" Pattern match: ".msi.eula/eulalth.html" Pattern match: ".msi.eula/eulavit.html" Pattern match: ".msi.eula/eulaind.html" Pattern match: ".msi.eula/manifest.ermPK" Pattern match: ".msi.eula/eulabgr.htmlPK" Pattern match: ".msi.eula/eulachs.htmlPK" Pattern match: ".msi.eula/eulacht.htmlPK" Pattern match: ".msi.eula/eulahrv.htmlPK" Pattern match: ".msi.eula/eulacsy.htmlPK" Pattern match: ".msi.eula/eulanld.htmlPK" Pattern match: ".msi.eula/eulaenu.htmlPK" Pattern match: ".msi.eula/eulafin.htmlPK" Pattern match: ".msi.eula/eulafra.htmlPK" Pattern match: ".msi.eula/euladeu.htmlPK" Pattern match: ".msi.eula/eulahun.htmlPK" Pattern match: ".msi.eula/eulaita.htmlPK" Pattern match: ".msi.eula/eulajpn.htmlPK" Pattern match: ".msi.eula/eulanor.htmlPK" Pattern match: ".msi.eula/eulaplk.htmlPK" Pattern match: ".msi.eula/eulaptb.htmlPK" Pattern match: ".msi.eula/eularom.htmlPK" Pattern match: ".msi.eula/eularus.htmlPK" Pattern match: ".msi.eula/eulasky.htmlPK" Pattern match: ".msi.eula/eulaslv.htmlPK" Pattern match: ".msi.eula/eulaesn.htmlPK" Pattern match: ".msi.eula/eulasve.htmlPK" Pattern match: ".msi.eula/eulatrk.htmlPK" Pattern match: ".msi.eula/eulaukr.htmlPK" Pattern match: ".msi.eula/euladan.htmlPK" Pattern match: ".msi.eula/eulafrc.htmlPK" Pattern match: ".msi.eula/eulaell.htmlPK" Pattern match: ".msi.eula/eulaare.htmlPK" Pattern match: ".msi.eula/eulaheb.htmlPK" Pattern match: ".msi.eula/eulaeti.htmlPK" Pattern match: ".msi.eula/eulasrl.htmlPK" Pattern match: ".msi.eula/eulatha.htmlPK" Pattern match: ".msi.eula/eulakkz.htmlPK" Pattern match: ".msi.eula/eulakor.htmlPK" Pattern match: ".msi.eula/eulaesl.htmlPK" Pattern match: ".msi.eula/eulalvi.htmlPK" Pattern match: ".msi.eula/eulalth.htmlPK" Pattern match: ".msi.eula/eulavit.htmlPK" Pattern match: ".msi.eula/eulaind.htmlPK" Heuristic match: "cL2;^.rO" Heuristic match: "GYeO0s.TC" Pattern match: "http://www.openssl.org/" Pattern match: "http://www.ibsensoftware.com/" Pattern match: "https://github.com/eigenteam/eigen-git-mirror" Pattern match: "http://mozilla.org/MPL/2.0/" Pattern match: "https://code.google.com/p/libfixmath/" Pattern match: "http://pugixml.org" Pattern match: "http://www.apache.org/licenses/" Pattern match: "www.digicert.com1200" Pattern match: "http://crl3.digicert.com/ha-cs-2011a.crl0" Pattern match: "http://crl4.digicert.com/ha-cs-2011a.crl0L" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "http://ocsp.digicert.com0P" Pattern match: "cacerts.digicert.com/DigiCertHighAssuranceCodeSigningCA-1.crt0" Pattern match: "www.digicert.com1$0" Pattern match: "crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1!0" Pattern match: "crl3.digicert.com/DigiCertAssuredIDCA-1.crl08" Pattern match: "crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w" Pattern match: "http://ocsp.digicert.com0A" Pattern match: "cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0" Pattern match: "http://www.digicert.com/ssl-cps-repository.htm0" Pattern match: "http://ocsp.digicert.com0I" Pattern match: "http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0" Pattern match: "http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@" Pattern match: "http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0" Pattern match: "http://ocsp.digicert.com0C" Pattern match: "cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0" Pattern match: "crl3.digicert.com/DigiCertAssuredIDRootCA.crl0" Pattern match: "crl4.digicert.com/DigiCertAssuredIDRootCA.crl0" Pattern match: "http://sw.symcb.com/sw.crl0" Pattern match: "https://d.symcb.com/cps0%" Pattern match: "https://d.symcb.com/rpa0" Pattern match: "http://sw.symcd.com0" Pattern match: "http://sw1.symcb.com/sw.crt0" Pattern match: "http://s.symcb.com/pca3-g5.crl0" Pattern match: "http://s.symcd.com0_" Pattern match: "www.digicert.com110/" Pattern match: "http://crl3.digicert.com/sha2-assured-ts.crl02" Pattern match: "http://crl4.digicert.com/sha2-assured-ts.crl0" Pattern match: "http://ocsp.digicert.com0O" Pattern match: "cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0" Pattern match: "crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://www.microsoft.com/pki/certs/MicrosoftCodeVerifRoot.crt0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "http://crl.thawte.com/ThawteTimestampingCA.crl0" Pattern match: "http://ts-ocsp.ws.symantec.com07" Pattern match: "http://ts-aia.ws.symantec.com/tss-ca-g2.cer0" Pattern match: "http://ts-crl.ws.symantec.com/tss-ca-g2.crl0" Pattern match: "https://www.verisign.com/rpa" Pattern match: "http://sf.symcb.com/sf.crl0a" Pattern match: "http://sf.symcd.com0&" Pattern match: "http://sf.symcb.com/sf.crt0" Pattern match: "https://www.verisign.com/cps0*" Pattern match: "https://www.verisign.com/rpa0" Pattern match: "http://logo.verisign.com/vslogo.gif04" Pattern match: "http://crl.verisign.com/pca3-g5.crl04" Pattern match: "http://ocsp.verisign.com0" Pattern match: "www.microsoft.com/pkiops/crl/Microsoft%20Windows%20Third%20Party%20Component%20CA%202014.crl0" Pattern match: "www.microsoft.com/pkiops/certs/Microsoft%20Windows%20Third%20Party%20Component%20CA%202014.crt0" Pattern match: "www.microsoft.com/pkiops/Docs/Repository.htm0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0" Pattern match: "https://www.microsoft.com/en-us/windows" Pattern match: "crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0" Pattern match: "www.microsoft.com/PKI/docs/CPS/default.htm0@" Pattern match: "http://s.symcd.com06" Pattern match: "http://s.symcb.com/universal-root.crl0" Pattern match: "https://d.symcb.com/rpa0@" Pattern match: "http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0" Pattern match: "http://ts-ocsp.ws.symantec.com0" Pattern match: "http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0" Heuristic match: "Qt*:bg.vi" Pattern match: "d.kib/+9" Pattern match: "http://www.eset.com/ecp" Heuristic match: "trace.eset.com" Pattern match: "http://go.eset.eu|${ProductType}=%s|${Version}=%s|${LangID}=%s" Pattern match: "http://tisdk.mailshell.net/cgi-bin/mailsh.cgi" Heuristic match: "mailshell.net" Pattern match: "http://go.eset.eu/knowledgebase?lng=%s&product=%s&version=%s&KBID=%s" Pattern match: "http://go.eset.eu/installerror?lng=%d&product=%s&version=%s&platform=%s&id=%d" Pattern match: "http://go.eset.eu/sha1eol?lng=%d&product=%s&version=%s&platform=%s&osbuild=%d" Pattern match: "http://help.eset.com/getHelp?product=%s&version=%s&lang=%d&topic=%s" Heuristic match: "ts.eset.com" Heuristic match: "<.info" Pattern match: "http://repository.eset.com/prerelease/v1" Pattern match: "http://repository.eset.com/v1" Pattern match: "http://repository.eset.com/beta"25:T4d5,Heuristic match: "1.3.6.1.4.1.311.2.1.4" Heuristic match: "1.3.6.1.4.1.311.10.1" Heuristic match: "1.3.6.1.4.1.311.2.4.1" Heuristic match: "1.3.6.1.4.1.311.3.3.1" Heuristic match: "1.2.840.113549.1.9.16.1.4" Heuristic match: "1.3.14.3.2.29" Heuristic match: "1.3.14.3.2.26" Heuristic match: "2.16.840.1.101.3.4.2.1" Heuristic match: "2.16.840.1.101.3.4.2.2" Heuristic match: "2.16.840.1.101.3.4.2.3" Heuristic match: "2.16.840.1.101.3.4.2.4" "2.5.29.35" "2.5.29.19" "2.5.29.14" "10.15.29.0" "13.2.16.0" Heuristic match: "--watchdog 3944 --product "ESET Internet Security" 13.2.16.0 1033" Heuristic match: "[2020.08.03 16:00:28] BTS dbg Setting property "bts.product.version" to value "13.2.16.0"." Heuristic match: "[2020.08.03 16:00:28] BTS dbg Setting property "version" to value "13.2.16.0"." Heuristic match: "[2020.08.03 16:00:28] BTS dbg Setting property "bts.net.useragent" to value "EIS/13.2.16.0 (Windows; U; 64bit; OS: 6.1.7601 SP 1.0 NT; SHA256 0)"." Heuristic match: "[2020.08.03 16:00:28] BTS inf Running Product: ESET Internet Security 13.2.16.0" Heuristic match: "[2020.08.03 16:00:28] BTS inf Executing command 'BootHelper.exe --watchdog 3944 --product "ESET Internet Security" 13.2.16.0 1033'."26:T6e3," PADPK" (Indicator: "cmd=")27:T54a,"eis_nt32.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}\.erm\epi-base.zip" with delete access "eis_nt32.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}\.erm" with delete access "eis_nt32.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}\BootHelper.exe" with delete access "eis_nt32.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}\eguiActivation.dll" with delete access "eis_nt32.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}\eguiActivationLang.dll" with delete access "eis_nt32.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}\eis_nt32.exe" with delete access "eis_nt32.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}\plgInstaller.dll" with delete access "eis_nt32.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}\sciter-x.dll" with delete access "eis_nt32.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}" with delete access28:T547,RegDeleteKeyW OutputDebugStringW GetModuleFileNameW LockResource GetCommandLineW LoadLibraryExW GetStartupInfoW GetCommandLineA GetProcAddress WriteFile UnhandledExceptionFilter LoadLibraryW FindNextFileW FindResourceExW FindFirstFileExW GetModuleHandleW TerminateProcess FindResourceW Sleep GetTickCount GetFileSize GetCursorPos LoadLibraryA GetThreadContext GetTempFileNameW GetTempPathW DeleteFileW WSAStartup connect closesocket send recv socket CopyFileW LoadLibraryExA GetVersionExW VirtualProtect CreateDirectoryW FindFirstFileW MapViewOfFile GetModuleHandleA CreateProcessW VirtualAlloc RegDeleteValueW OpenProcessToken RegEnumKeyW RegEnumKeyExW GetFileAttributesW OpenFileMappingW ExitThread CreateToolhelp32Snapshot OpenProcess Process32NextW Process32FirstW GetFileAttributesExW GetComputerNameExW ShellExecuteExW ShellExecuteW FindWindowExW GetUserNameA CreateFileMappingA GetTempPathA IsDebuggerPresent GetModuleFileNameA CreateThread GetModuleHandleExW GetVersionExA GetFileSizeEx GetTempFileNameA GetComputerNameA CreateFileW CreateFileA FindResourceA ShellExecuteExA GetUpdateRect SetWindowsHookExW GetWindowThreadProcessId HttpSendRequestA InternetCloseHandle InternetReadFile InternetOpenA InternetConnectA InternetQueryOptionA HttpQueryInfoA accept29:T88b,"eis_nt32.exe" wrote bytes "a0114c74" to virtual address "0x7584E324" (part of module "WININET.DLL") "eis_nt32.exe" wrote bytes "b4360200" to virtual address "0x74EB4D68" (part of module "SSPICLI.DLL") "eis_nt32.exe" wrote bytes "b436eb74" to virtual address "0x74EC01E4" (part of module "SSPICLI.DLL") "eis_nt32.exe" wrote bytes "d83aeb74" to virtual address "0x74EC01E0" (part of module "SSPICLI.DLL") "eis_nt32.exe" wrote bytes "b436eb74" to virtual address "0x74EC0200" (part of module "SSPICLI.DLL") "eis_nt32.exe" wrote bytes "c0df61771cf96077ccf860770d64627700000000c011127500000000fc3e127500000000e0131275000000009457277525e06177c6e0617700000000bc6a267500000000cf3112750000000093192775000000002c32127500000000" to virtual address "0x758F1000" (part of module "NSI.DLL") "eis_nt32.exe" wrote bytes "b4360200" to virtual address "0x74EB4EA4" (part of module "SSPICLI.DLL") "eis_nt32.exe" wrote bytes "b436eb74" to virtual address "0x74EC025C" (part of module "SSPICLI.DLL") "eis_nt32.exe" wrote bytes "d83aeb74" to virtual address "0x74EC01FC" (part of module "SSPICLI.DLL") "eis_nt32.exe" wrote bytes "68130000" to virtual address "0x75B01680" (part of module "WS2_32.DLL") "eis_nt32.exe" wrote bytes "b890124c74ffe0" to virtual address "0x74EB3AD8" (part of module "SSPICLI.DLL") "eis_nt32.exe" wrote bytes "d83a0200" to virtual address "0x74EB4E38" (part of module "SSPICLI.DLL") "eis_nt32.exe" wrote bytes "d83a0200" to virtual address "0x74EB4D78" (part of module "SSPICLI.DLL") "eis_nt32.exe" wrote bytes "711157007a3b5600ab8b02007f950200fc8c0200729602006cc805001ecd53007d265300" to virtual address "0x771007E4" (part of module "USER32.DLL") "eis_nt32.exe" wrote bytes "d83aeb74" to virtual address "0x74EC0258" (part of module "SSPICLI.DLL") "eis_nt32.exe" wrote bytes "b436eb74" to virtual address "0x74EC0278" (part of module "SSPICLI.DLL") "eis_nt32.exe" wrote bytes "d83aeb74" to virtual address "0x74EC0274" (part of module "SSPICLI.DLL") "eis_nt32.exe" wrote bytes "b880114c74ffe0" to virtual address "0x75B01368" (part of module "WS2_32.DLL") "eis_nt32.exe" wrote bytes "b810154c74ffe0" to virtual address "0x74EB36B4" (part of module "SSPICLI.DLL")2a:T4bc,"eis_nt32.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}\eis_nt32.exe" (Handle: 728) "eis_nt32.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}\eis_nt32.exe" (Handle: 728) "eis_nt32.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}\eis_nt32.exe" (Handle: 728) "eis_nt32.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}\eis_nt32.exe" (Handle: 728) "eis_nt32.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}\BootHelper.exe" (Handle: 264) "eis_nt32.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}\BootHelper.exe" (Handle: 264) "eis_nt32.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}\BootHelper.exe" (Handle: 264)2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAADmZmZmZmZmZm4AAAAAAABmZmZmZmZmZmZmZgAAAAAGZmZmZmZmZmZmZmZgAAAAZmZmeI/////4h2ZmZgAABmZmj//////////4ZmZgAGZmb/////////////ZmZgBmZv//////////////ZmYOZmj//////////////4ZmZmZv////+Id3eI/////2ZmZmf///+GZmZmZmf///92ZmZo///4ZmZmZmZmf///hmZmaP//92ZmaIdmZm///4ZmZm////ZmZv//hmZo///2ZmZv///2Zmj///iIj///9mZmb///hmZo//////////ZmZm///4ZmZmZmZmZo///2ZmZv//+GZmZmZmZmaP//9mZmb///hmZmd3dmZmj///ZmZm////ZmaP//hmZv///2ZmZv///2Zmb//2Zmb///9mZmaP//92ZmZ3ZmZn///4ZmZmj///hmZmZmZmb///+GZmZn////hmZmZmZo////dmZmZv/////4iIiI/////2Zm5maP//////////////hmbgZmb//////////////2ZmAGZmb/////////////ZmZgAGZmaP//////////hmZmAAAGZmZniP////+IdmZmYAAAAGZmZmZmZmZmZmZmZgAAAAAGZmZmZmZmZmZmZmAAAAAAAA5mZmZmZmZmZuAAAAD+AAB/+AAAH/AAAA/gAAAHwAAAA4AAAAGAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAHAAAAD4AAAB/AAAA/4AAAf/gAAfw==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"fa43a255473d1bdde08aa2360940212b9ef98990dec870487962ba057e1dcf5f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790553243022,"unified_at":"2026-09-27T23:54:03.022Z","metadata":{"hashes":{"sha256":"fa43a255473d1bdde08aa2360940212b9ef98990dec870487962ba057e1dcf5f","sha1":"566e94a56484bf6c99853b20af3514857aeb6ecf","md5":"0b878c501025e5e96354af609d90f7a6","sha512":"5d3eb31d81622d22d4546454ebb7ce901503bef13f8878848dab0cb8a32c083926d9e64b27100f9b273d46b91e6d6b7da159ee0df5295fe98a82ea0def2d7712","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"eis_nt32.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":54808160,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1596470316000,"last_seen":1665057830000,"last_multi_scan":1665057830000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":9},"sandbox_signatures":{"informative_count":17,"suspicious_count":16,"malicious_count":3,"total":36},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/techniques/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1063","attack_id_wiki":"https://attack.mitre.org/techniques/T1063","identifiers":[{"type":"malicious","value":"Reads Antivirus engine related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"tactic":"Command and Control","technique":"Custom Command and Control Protocol","attack_id":"T1094","attack_id_wiki":"https://attack.mitre.org/techniques/T1094","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"}],"sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"eis_nt32.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\EIS_NT32.EXE\")\n \"eis_nt32.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\EIS_NT32.EXE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/65 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"BootContainer.pdb\"\n \"em000_32.pdb\"\n \"em000k_32.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"$22","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\zCSMComm.Server.Id.BTS-Container-Comm.3692\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"zCSMComm.Server.Id.BTS-Container-Comm.3692\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\ESET-Instance-Lock-INSTALLER-010054F1-138D-B7EF-6332-EC05C2CF9154\"\n \"Global\\ESET-Instance-Lock-INSTALLER-010054F1-138D-B7EF-6332-EC05C2CF9154\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"BootHelper.exe\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"eguiActivationLang.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"eis_nt32.exe\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"sciter-x.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"eis_nt32.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"eis_nt32.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")\n \"eis_nt32.exe\" touched \"UsersFiles\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\\SHELLFOLDER\")\n \"eis_nt32.exe\" touched \"Property System Both Class Factory\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\\TREATAS\")\n \"eis_nt32.exe\" touched \"delegate folder that appears in Users Files Folder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\SHELLFOLDER\")\n \"eis_nt32.exe\" touched \"Shell File System Folder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\\INPROCSERVER32\")\n \"eis_nt32.exe\" touched \"Security Manager\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\\TREATAS\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"eis_nt32.exe\" (UID: 00074753-00003944) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"eis_nt32.exe\" (UID: 00074753-00003944) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"eis_nt32.exe\" searching for class \"_EsetBootstrapperWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"eis_nt32.exe\" with commandline \"--bts-container 3692 \"C:\\eis_nt32.exe\"\" (UID: 00074753-00003944)\n Spawned process \"BootHelper.exe\" with commandline \"--watchdog 3944 --product \"ESET Internet Security\" 13.2.16.0 103 ...\" (UID: 00075028-00003996)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"eis_nt32.exe\" with commandline \"--bts-container 3692 \"C:\\eis_nt32.exe\"\" (UID: 00074753-00003944)\n Spawned process \"BootHelper.exe\" with commandline \"--watchdog 3944 --product \"ESET Internet Security\" 13.2.16.0 103 ...\" (UID: 00075028-00003996)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"eis_nt32.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"eguiActivation.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"BootHelper.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"eguiActivationLang.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"eis_nt32.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"plgInstaller.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"sciter-x.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"epi-base.zip\" has type \"Zip archive data at least v2.0 to extract\"\n \"bootstrapper_20200803160026.log\" has type \"ASCII text with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$23","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$24","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"eis_nt32.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"eguiActivation.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"BootHelper.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"eguiActivationLang.dll\" was detected as \"Microsoft visual C++ vx.x DLL\"\n \"eis_nt32.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"plgInstaller.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"sciter-x.dll\" was detected as \"Borland Delphi 3.0 (???)\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"eis_nt32.exe\" at 00074753-00003944-00000033-3177125","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc\n .rsrc with unusual entropies 7.75394531828\n 7.80949995972","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"eis_nt32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"eis_nt32.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"2/79 reputation engines marked \"http://www.ibsensoftware.com\" as malicious (2% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"eis_nt32.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"eis_nt32.exe\" read file \"%USERPROFILE%\\Searches\\desktop.ini\"\n \"eis_nt32.exe\" read file \"%USERPROFILE%\\Videos\\desktop.ini\"\n \"eis_nt32.exe\" read file \"%USERPROFILE%\\Pictures\\desktop.ini\"\n \"eis_nt32.exe\" read file \"%USERPROFILE%\\Contacts\\desktop.ini\"\n \"eis_nt32.exe\" read file \"%USERPROFILE%\\Favorites\\desktop.ini\"\n \"eis_nt32.exe\" read file \"%USERPROFILE%\\Music\\desktop.ini\"\n \"eis_nt32.exe\" read file \"%USERPROFILE%\\Downloads\\desktop.ini\"\n \"eis_nt32.exe\" read file \"%USERPROFILE%\\Documents\\desktop.ini\"\n \"eis_nt32.exe\" read file \"%USERPROFILE%\\Links\\desktop.ini\"\n \"eis_nt32.exe\" read file \"%USERPROFILE%\\Saved Games\\desktop.ini\"\n \"eis_nt32.exe\" read file \"C:\\Users\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"eguiActivation.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"BootHelper.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"eguiActivationLang.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"eis_nt32.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"plgInstaller.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"sciter-x.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$25","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"$26","origin":"File/Memory","mitre_attack_id":"T1094","relevance":10,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$27","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"eis_nt32.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"eis_nt32.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"eis_nt32.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"BootHelper.exe\" claimed CRC 500065 while the actual is CRC 1426187\n \"eguiActivationLang.dll\" claimed CRC 2222634 while the actual is CRC 500065\n \"eis_nt32.exe\" claimed CRC 1723400 while the actual is CRC 2222634\n \"plgInstaller.dll\" claimed CRC 2413511 while the actual is CRC 1723400\n \"sciter-x.dll\" claimed CRC 3243388 while the actual is CRC 2413511","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$28","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$29","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"eis_nt32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Reads Antivirus engine related registry keys","description":"\"eis_nt32.exe\" (Path: \"HKLM\\SOFTWARE\\ESET\\ESET SECURITY\\CURRENTVERSION\\INFO\")\n \"eis_nt32.exe\" (Path: \"HKLM\\SOFTWARE\\ESET\\ESET FULL DISK ENCRYPTION\\CURRENTVERSION\\INFO\")\n \"eis_nt32.exe\" (Path: \"HKLM\\SOFTWARE\\ESET\\REMOTEADMINISTRATOR\\AGENT\\CURRENTVERSION\\INFO\")","origin":"Registry Access","mitre_attack_id":"T1063","relevance":8,"id":"registry-32","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"eis_nt32.exe\" allocated memory in \"%WINDIR%\\SysWOW64\\oleacc.dll\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$2a","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Reads Antivirus engine related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":77,"dropped_files_count":0,"extracted_files_count":8,"files_written_count":32,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"5f28342a42c38749203535f3","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"eis_nt32.exe","analysis_start_time":"2020-08-03T15:58:59+00:00","indicators_count":{"informative":17,"suspicious":21,"malicious":4},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}],"processes":[{"pid":3692,"ppid":0,"name":"eis_nt32.exe","command_line":"","sha256":"fa43a255473d1bdde08aa2360940212b9ef98990dec870487962ba057e1dcf5f","normalized_path":"C:\\eis_nt32.exe","uid":"00074541-00003692","icon":"$2b"},{"pid":3944,"ppid":3692,"name":"eis_nt32.exe","command_line":"--bts-container 3692 \"C:\\eis_nt32.exe\"","sha256":"e640507b5092789121559ebaaf3f7ecb99b3784fea87fd47204236562722611d","normalized_path":"%TEMP%\\eset\\bts.session\\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}\\eis_nt32.exe","parent_uid":"00074541-00003692","uid":"00074753-00003944"},{"pid":3996,"ppid":3944,"name":"BootHelper.exe","command_line":"--watchdog 3944 --product \"ESET Internet Security\" 13.2.16.0 1033","sha256":"519c4c00b87418af5809501c6073b076fc5ae9979ebec6288e72c446824474ed","normalized_path":"%TEMP%\\eset\\bts.session\\{02D83BBE-0A6B-ED74-699A-05FB292B7AF7}\\BootHelper.exe","parent_uid":"00074753-00003944","uid":"00075028-00003996"}],"all_imported_dlls":["lpk.dll","shlwapi.dll","ws2_32.dll","msasn1.dll","ncrypt.dll","bcrypt.dll","uxtheme.dll","dwmapi.dll","ntdll.dll","ntmarta.dll","secur32.dll","webio.dll","shell32.dll","ole32.dll","comctl32.dll","normaliz.dll","rsaenh.dll","IPHLPAPI.DLL","sechost.dll","rpcrt4.dll","wow64win.dll","kernel32.dll","version.dll","comdlg32.dll","Wldap32.dll","profapi.dll","urlmon.dll","imagehlp.dll","iertutil.dll","winhttp.dll","wow64.dll","msctf.dll","propsys.dll","api-ms-win-downlevel-version-l1-1-0.dll","cryptsp.dll","winnsi.dll","clbcatq.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","dhcpcsvc.dll","sciter-x.dll","plgInstaller.dll","sspicli.dll","cfgmgr32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","oleaut32.dll","msvcrt.dll","usp10.dll","apphelp.dll","wintrust.dll","bcryptprimitives.dll","WindowsCodecs.dll","user32.dll","imm32.dll","crypt32.dll","dbghelp.dll","wininet.dll","KernelBase.dll","devobj.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","oleacc.dll","msi.dll","wow64cpu.dll","advapi32.dll","shdocvw.dll","setupapi.dll","oleaccrc.dll","userenv.dll","cabinet.dll","gdi32.dll","cryptbase.dll","GdiPlus.dll","api-ms-win-core-synch-l1-2-0.dll","nsi.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","winmm.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"BootHelper.exe","sha256":"519c4c00b87418af5809501c6073b076fc5ae9979ebec6288e72c446824474ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"name":"eguiActivationLang.dll","sha256":"3dabcf010e11071d34f5c2ad9af5f0d775cedcb6311f215959c522b860ff3402","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"name":"eis_nt32.exe","sha256":"e640507b5092789121559ebaaf3f7ecb99b3784fea87fd47204236562722611d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"name":"sciter-x.dll","sha256":"48b109b4ba4f40796b5b737f6cf8b87da5cfe027be27385c8d636e1c2bc26fb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"name":"epi-base.zip","sha256":"0b5bdf0b96f3e3a927d8dd58f926387fa9f04d61591def90ea5df8335714dc94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"name":"eguiActivation.dll","sha256":"5661dd8b7696f0a6c45f5ac241ac9bab47c78834a475906d258a46080c0cee24","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"name":"plgInstaller.dll","sha256":"695052cdbf8791a1640525b469c87d9ea665eeec427bfaa473a66c2b5b8fa884","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"name":"bootstrapper_20200803160026.log","sha256":"5a72d8c5b1cfd1014895f1bba22efa25f76217a6f749ed46b8791d5d4e1d71f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%TEMP%\\eset","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%TEMP%\\eset\\bts","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%TEMP%\\eset\\bts\\bootstrapper_20200803160026.log","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"C:\\eis_nt32.exe","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%TEMP%\\eset\\bts.session","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%USERPROFILE%\\Searches\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%USERPROFILE%\\Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%USERPROFILE%\\Contacts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%USERPROFILE%\\Downloads\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%USERPROFILE%\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%USERPROFILE%\\Saved Games\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%WINDIR%\\SysWOW64\\shdocvw.dll","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%TEMP%\\eset\\bts.cache","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%WINDIR%\\SysWOW64\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\zCSMComm.Server.Id.BTS-Container-Comm.3692","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"name":"zCSMComm.Server.Id.BTS-Container-Comm.3692","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\ESET-Instance-Lock-INSTALLER-010054F1-138D-B7EF-6332-EC05C2CF9154","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]},{"name":"Global\\ESET-Instance-Lock-INSTALLER-010054F1-138D-B7EF-6332-EC05C2CF9154","sources":[{"report_type":"sandbox","report_id":"5f28342a42c38749203535f3"}]}]}},"report_ids":{"sandbox_job_ids":["5f28342a42c38749203535f3"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Sample fa43a255473d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample fa43a255473d…. Threat score 100/100. 0/25 AV engines flagged this file. 3 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/fa43a255473d1bdde08aa2360940212b9ef98990dec870487962ba057e1dcf5f"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample fa43a255473d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample fa43a255473d…. Threat score 100/100. 0/25 AV engines flagged this file. 3 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/fa43a255473d1bdde08aa2360940212b9ef98990dec870487962ba057e1dcf5f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample fa43a255473d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample fa43a255473d…. Threat score 100/100. 0/25 AV engines flagged this file. 3 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]