The following is a list of md5sums of malware samples which have displayed the behavior detected by SID 16856:
00b8f706a94089abca14a66087e22979
0503f78943fabbd0eb3209df6aebde43
0611b8d77e970340622f7314203398e6
0670eef2bbe923bb230a913f1db8e32a
08f1f8ceff46a216acc34b01091187e7
09e76a76ac9f35c1c7fc0e7bff7a03ea
0a9310fb5d5a90886f79d5ed32cb4d59
0c2fbc0c25bc77a758969a5c748d5ff7
0c50f6e0164a8833dec29a1903461f7a
0ecbda006f54d278e0ccbf1b5eac8c3f
102eb0232c83bdf72893551cbac194bb
11883b74bcd42cc574cbaeea7ff25585
1571b8c7e94dc255c42dc1b05dc71852
15818cd7c98e4f42eaf3f77b6e7571b8
1db64590d7017c06cd94861e82beeb83
1ffc92a1ca4c2efc88b7a40a04f7739b
248fe34bd70596aaad7d600158815f7e
24fd3072558bd003be2be84ce20e1d3c
26bdc533d73ca3dcdd4efb6a725abad4
2a406a8660e3340d8b3f5fd7fa2444af
2a979ddbb8142ad8e29456ffef938f84
3763fa7362c34e59efd0a892df1f5fc1
394669460351b11e0250c8d5667a4ad5
3a67cdfcc716ffe6675dd78eacbbd134
3a69aaa6762e292b1656cdc7fc1f740c
40c145366f64a4ea1b664733f1dd6697
40fe72858c348e4a66ea94d8ac1d3272
42572e84e26bc5e18e2a64dcf47c5174
427d42ab2cd117d90fcb6757f246ebe2
42e5b91a0881fe878957c01c34923fc4
465cd7282ee4099f2b9a733ed45c57c4
486b67155fdb0d6c82ca403e90886106
4c4719fb91291fdcb48c4142beafae63
4cf6fc86eb7c7a9dc379757b48b1ae20
4ea9f23d7423db30bf84bf33cd346239
4f9326422733a78f37e6fdea9652ab14
51fac926f29b99bb4f5a5888fac7f48c
537aebb50c31b1d289774b9474b39d65
550d6a49db40f5e1eb76447ace0b3f15
55f44a596669c7eb17cedc94b8f3eb7a
585a04cb2b3704b3da41fdccdd33b99f
5e32c29701362225c68b44bfbb9e9ddc
5e5b83ea3302d5639433f050e5f70181
5f2964044dbb0fc6b80d38d2a8181a75
5febdfd105bf9c1cc956c69c9510a484
625727ad188b521ffaa58974bb642cc5
65735d0b7d48515af7a588b7ead2eb87
6623479381de22b17544efc3744f8273
6714f803de303981b42fe16861c137b0
679eacd02d051f8e86a6e42e2a431c99
6b12b713f2f5d1b93c4a1e73301acc99
6bc78fab8c241cc15fa28e6cab2d0675
6c33651f682eae42ef84a545b7794cbe
6dba6d70c97c838692134e305391e3c7
754d36a4297a10049250f27c83dff62c
7598cd5850e84a016a49cce8c5958e88
7c43a8acbc9fc048464f4eceb1ec146f
7cf2914ea3ce480fec058da8760f4b43
7d266830b5d277aaee9d8ec026fd07ed
7fd2917e3d7f0b158f3a687ce0c64d1f
7ff29f0b7b3f9090b345cebbf3a5be34
8051ee788dee2842a990146f51af42a8
8173092cb6baa4b29db677561d51a168
832befcd749ebbac3c684a5016b34136
8747bb11ff9c900fab743fa40576f8d3
886fa9ee5b3a7ebe604cdbb937be0c46
88a396f0a3dcaa01009c047124cf6754
88bd8a28fc1c789d25dddd482206e998
8c0a32354e41d7ca36d0ab4390d863b0
8d827f7e88bf64c8467c1b02495e3b3d
90eae6cf84a07a9f8e29de18e930452b
93b660303307586ce42e1dcdc5044978
9a9ed8644bd7f9a2eed8e283383fbb1e
9ae69fd63fdc3ffb3aacff0bb17f3b4a
9d26592b2793d23346fce8ba747ba814
a00e44990ba9597891118ba5ef222e87
a127d9c5401ebb598e6407327c2a6422
a29fc0a923b10ca324767aa3e02e605c
a4a38e4dd480b0d1d5beb04f7cf37866
a98f5bcf71cfa1df4195cb072a17beb2
aa9a228aa1d845968f5da80c4fcabe77
ab48892228fc686d1c60adb0ab22aabe
abfb67ee747b03cc78fe005cd75de3ba
b0abb7882a1e7180d6fbacfc6ef04943
b54224bbd41a894f289d67c509aca5a6
b57146ecf463afa4b98eeb3afc0d8e65
b6c399304cff55df68c6106328421a12
b73196d58048b192ddb6294b7237d79c
b76f2a72f267abcb8e8ba406d65a877d
b7fc9c469da79f5cfc43f142e9335677
b8c8185565d1d5a3a7cbea396b5e0586
b9807dd7008ee1a2e11a3914d1d487cf
b9dcd0741af7c25a239be3833a45aa11
bbb89ba95fcd2fd791a045c917ec0672
bd2572989e52ca2ea2c164685d91a075
c052a7d5d9d41832fd9186c18cb3f9e8
c0947bff31d06cd5c7878cf2b421f91e
c1a05ead5aad8efaa0c94b456cad0aaa
c3e2fb3fcc71953213a4ce941c4c5aef
c40b883caf0b2182da384939f8332855
c7996087248a8642770fae014a52be44
cc21a7257048a8d90598db4fce0d8f0c
cc3dcec12c7da2e1c71bf69a22372fc7
ce2a32e2bb01072b8b26bd7242db1acf
d01e4f4ac3c00c600522ffc8e7d79f32
d42437568bc6006df30146d4c501ca9d
d43f686834b95ad5b0e8e2460546e51d
d4f2717569098ad5da97b79eeb9a23e3
d6701f7c849b7c7cdabd602c5c0fa933
d7157c1297977c256f2f537d848b9320
d8cb526966b0cce1916102f14503c3f8
de9284b665bcbc9e0af9e46cd4971411
dfa121be3724a986432d9757564757cf
e034afba133fbf1b1326b429cb444bfb
e1181935b8fcbdfef6aaa22015a0eae4
e12dea1c59221433c4d58c0608b7cd99
e16a88019d430fd87766818cf5e66758
e3946ef4da0a947781c8c1225391bcfc
e3e74344d2d150704ff3458f2bf4d1f3
e51d83c3cb3e1c2078626a5fe09b8232
e564b2e338cc787a53e8836a2f6abc43
e65ca22872578c535dae08d693866959
e94dc4462e32c33fb76a4e6d4e2e0cf6
e9c4a4618cd98b537905bf6e55899091
f03a03384724bb0d6de53965f38d1e73
f56dbe392827baf1fa36f77fed8db394
f6b12634aea181c790c21b47db5d6ad3
f6d95cf8d2686d923dc9d8df00f12103
f790e40d861d2112ca84de4746a4827b
f8da8c333e307967307324493ba4a299
f94e3b5d043e97e07d47f3e58863e2e9
f9a9320e2cc7805435bf7e40675fa089
fa5ffcf93fb12b0bbd3d9bf7c4e17c62
fb1aa9d806b9c882b3e7fa5e67f4a1ee
fb240d489b7461524c5f354839089c90
fd5c5b27dbc82aaa0b87cbc991229182
fe65ed11f5682d148202c2b1335237ee
ff8c9230b1a5de374c972b28a31ffc4e
')
