Benign Download

Trojan.WinREG.StartPage.s

Code embeds cleartext HTTP URL literalReferences the Windows user account SID
SHA-2568a7c9c95318fdacd7ace6359644d35fbe43d45d11dbe6bb3f2c5e95e68f2dd02
MaleculeH₂(CmOs)

Evidence

Code embeds cleartext HTTP URL literal lines 1–4
1Windows Registry Editor Version 5.00
2
3[HKEY_USERS\S-1-5-21-527237240-1060284298-839522115-1003\Software\Microsoft\Internet Explorer\Main]
4"Start Page"="http://www.cm520.net/"

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.