24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.A095D3DB Sample 097ca829e051… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 097ca829e051…. Malware family: Ransom.A095D3DB. Threat score 100/100. 18/28 AV engines flagged this file. 7 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b","keywords":["Malicious","Ransom.A095D3DB","malware analysis","sandbox report","threat intelligence","097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.A095D3DB","antivirusDetections":{"malicious":18,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T8f4,Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Active Directory Toplogy"" (UID: 00292114-00000292) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Anti-spam Update"" (UID: 00292116-00001304) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Compliance Audit"" (UID: 00292116-00001684) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Compliance Service"" (UID: 00292117-00002996) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange DAG Management"" (UID: 00292119-00002644) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Diagnostics"" (UID: 00292121-00001832) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange EdgeSync"" (UID: 00292123-00003572) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Frontend Transport"" (UID: 00292124-00002688) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Health Manager"" (UID: 00292126-00002340) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Health Manager Recovery"" (UID: 00292126-00003576) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange IMAP4"" (UID: 00292127-00003936) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange IMAP4 Backend"" (UID: 00292128-00001712) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Information Store"" (UID: 00292131-00003404) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Assistants"" (UID: 00292132-00002716) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Replication"" (UID: 00292134-00003284) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Transport Delivery"" (UID: 00292136-00000832) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange POP3"" (UID: 00292145-00002696) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange POP3 Backend"" (UID: 00292151-00000752) Spawned process "sc.exe" with commandline "sc stop "SQL Server Agent (TESTINSTANCE)"" (UID: 00292175-00001500) Spawned process "sc.exe" with commandline "sc stop "SQL Server (TESTINSTANCE)"" (UID: 00292178-00002176)26:T8f4,Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Active Directory Toplogy"" (UID: 00292114-00000292) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Anti-spam Update"" (UID: 00292116-00001304) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Compliance Audit"" (UID: 00292116-00001684) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Compliance Service"" (UID: 00292117-00002996) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange DAG Management"" (UID: 00292119-00002644) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Diagnostics"" (UID: 00292121-00001832) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange EdgeSync"" (UID: 00292123-00003572) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Frontend Transport"" (UID: 00292124-00002688) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Health Manager"" (UID: 00292126-00002340) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Health Manager Recovery"" (UID: 00292126-00003576) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange IMAP4"" (UID: 00292127-00003936) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange IMAP4 Backend"" (UID: 00292128-00001712) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Information Store"" (UID: 00292131-00003404) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Assistants"" (UID: 00292132-00002716) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Replication"" (UID: 00292134-00003284) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Transport Delivery"" (UID: 00292136-00000832) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange POP3"" (UID: 00292145-00002696) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange POP3 Backend"" (UID: 00292151-00000752) Spawned process "sc.exe" with commandline "sc stop "SQL Server Agent (TESTINSTANCE)"" (UID: 00292175-00001500) Spawned process "sc.exe" with commandline "sc stop "SQL Server (TESTINSTANCE)"" (UID: 00292178-00002176)27:T772,".exe" opened "C:\Users\%OSUSER%\Downloads\AJaiC.rar" with delete access ".exe" opened "C:\Users\%OSUSER%\Downloads\AMrt2OL.exe" with delete access ".exe" opened "C:\Users\%OSUSER%\Downloads\ara0UGGW3VRU.exe" with delete access ".exe" opened "C:\Program Files\Wireshark\console.lua" with delete access ".exe" opened "C:\Program Files\Wireshark\COPYING.txt" with delete access ".exe" opened "C:\Program Files\Wireshark\libgio-2.0-0.dll" with delete access ".exe" opened "C:\Program Files\Wireshark\libspandsp-2.dll" with delete access ".exe" opened "C:\Program Files\Wireshark\libssh.dll" with delete access ".exe" opened "C:\Program Files\Wireshark\Qt5Network.dll" with delete access ".exe" opened "C:\Program Files\Wireshark\Qt5Svg.dll" with delete access ".exe" opened "C:\Program Files\Wireshark\services" with delete access ".exe" opened "C:\Program Files\Wireshark\text2pcap.exe" with delete access ".exe" opened "C:\Program Files\Wireshark\tshark.html" with delete access ".exe" opened "C:\Program Files\Wireshark\Wireshark.exe" with delete access ".exe" opened "C:\Program Files\WinPcap\rpcapd.exe" with delete access ".exe" opened "C:\Program Files\Mozilla Firefox\api-ms-win-core-debug-l1-1-0.dll" with delete access ".exe" opened "C:\Program Files\Mozilla Firefox\api-ms-win-core-libraryloader-l1-1-0.dll" with delete access ".exe" opened "C:\Program Files\Mozilla Firefox\api-ms-win-core-processthreads-l1-1-1.dll" with delete access ".exe" opened "C:\Program Files\Mozilla Firefox\lgpllibs.dll" with delete access ".exe" opened "C:\Program Files\Mozilla Firefox\libGLESv2.dll" with delete access28:T933,Spawned process ".exe" (UID: 00291859-00003028) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Active Directory Toplogy"" (UID: 00292114-00000292) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Anti-spam Update"" (UID: 00292116-00001304) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Compliance Audit"" (UID: 00292116-00001684) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Compliance Service"" (UID: 00292117-00002996) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange DAG Management"" (UID: 00292119-00002644) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Diagnostics"" (UID: 00292121-00001832) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange EdgeSync"" (UID: 00292123-00003572) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Frontend Transport"" (UID: 00292124-00002688) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Health Manager"" (UID: 00292126-00002340) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Health Manager Recovery"" (UID: 00292126-00003576) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange IMAP4"" (UID: 00292127-00003936) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange IMAP4 Backend"" (UID: 00292128-00001712) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Information Store"" (UID: 00292131-00003404) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Assistants"" (UID: 00292132-00002716) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Replication"" (UID: 00292134-00003284) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Transport Delivery"" (UID: 00292136-00000832) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange POP3"" (UID: 00292145-00002696) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange POP3 Backend"" (UID: 00292151-00000752) Spawned process "sc.exe" with commandline "sc stop "SQL Server Agent (TESTINSTANCE)"" (UID: 00292175-00001500) Spawned process "sc.exe" with commandline "sc stop "SQL Server (TESTINSTANCE)"" (UID: 00292178-00002176)29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791543381717,"unified_at":"2026-10-09T10:56:21.717Z","metadata":{"hashes":{"sha256":"097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b","sha1":"6ac4a1fc00d2a2bb4ccef333f5350f2a96aa9069","md5":"d0806c9d8bcea0bd47d80fa004744d7d","sha512":"c6ece83c16af6050639d8fb9597a3e4d7587a5c7591593b6882ed3adf68f40f0718ec17e560989e0c5b02fca8d6c65e539e3c94516b46824b73a1ac6cb7aadb9","ssdeep":"98304:ClRpXQKzpWzW64H1zYZAkdfcb0S4DbZGVz3qS0wcQ538AfprYKd0b0shk:KZYpAk5uVDwwcosAfJYKdtshk","ssdeep_chunks":["98304:ClRpXQK","98304:lRpXQKz","98304:RpXQKzp","98304:pXQKzpW","98304:XQKzpWz","98304:QKzpWzW","98304:KzpWzW6","98304:zpWzW64","98304:pWzW64H","98304:WzW64H1","98304:zW64H1z","98304:W64H1zY","98304:64H1zYZ","98304:4H1zYZA","98304:H1zYZAk","98304:1zYZAkd","98304:zYZAkdf","98304:YZAkdfc","98304:ZAkdfcb","98304:Akdfcb0","98304:kdfcb0S","98304:dfcb0S4","98304:fcb0S4D","98304:cb0S4Db","98304:b0S4DbZ","98304:0S4DbZG","98304:S4DbZGV","98304:4DbZGVz","98304:DbZGVz3","98304:bZGVz3q","98304:ZGVz3qS","98304:GVz3qS0","98304:Vz3qS0w","98304:z3qS0wc","98304:3qS0wcQ","98304:qS0wcQ5","98304:S0wcQ53","98304:0wcQ538","98304:wcQ538A","98304:cQ538Af","98304:Q538Afp","98304:538Afpr","98304:38AfprY","98304:8AfprYK","98304:AfprYKd","98304:fprYKd0","98304:prYKd0b","98304:rYKd0b0","98304:YKd0b0s","98304:Kd0b0sh","98304:d0b0shk","196608:ClRpXQK","196608:lRpXQKz","196608:RpXQKzp","196608:pXQKzpW","196608:XQKzpWz","196608:QKzpWzW","196608:KzpWzW6","196608:zpWzW64","196608:pWzW64H","196608:WzW64H1","196608:zW64H1z","196608:W64H1zY","196608:64H1zYZ","196608:4H1zYZA","196608:H1zYZAk","196608:1zYZAkd","196608:zYZAkdf","196608:YZAkdfc","196608:ZAkdfcb","196608:Akdfcb0","196608:kdfcb0S","196608:dfcb0S4","196608:fcb0S4D","196608:cb0S4Db","196608:b0S4DbZ","196608:0S4DbZG","196608:S4DbZGV","196608:4DbZGVz","196608:DbZGVz3","196608:bZGVz3q","196608:ZGVz3qS","196608:GVz3qS0","196608:Vz3qS0w","196608:z3qS0wc","196608:3qS0wcQ","196608:qS0wcQ5","196608:S0wcQ53","196608:0wcQ538","196608:wcQ538A","196608:cQ538Af","196608:Q538Afp","196608:538Afpr","196608:38AfprY","196608:8AfprYK","196608:AfprYKd","196608:fprYKd0","196608:prYKd0b","196608:rYKd0b0","196608:YKd0b0s","196608:Kd0b0sh","196608:d0b0shk","98304:KZYpAk5","98304:ZYpAk5u","98304:YpAk5uV","98304:pAk5uVD","98304:Ak5uVDw","98304:k5uVDww","98304:5uVDwwc","98304:uVDwwco","98304:VDwwcos","98304:DwwcosA","98304:wwcosAf","98304:wcosAfJ","98304:cosAfJY","98304:osAfJYK","98304:sAfJYKd","98304:AfJYKdt","98304:fJYKdts","98304:JYKdtsh","98304:YKdtshk"],"imphash":"276d0afef3aba59d6ed944c60fb79e07"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":5566464,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1596014717000,"last_seen":1682692832000,"last_multi_scan":1682692832000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["apt","evasive","ransomware","shamoon"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":8},"sandbox_signatures":{"informative_count":11,"suspicious_count":10,"malicious_count":7,"total":28},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1315469","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.CDJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.JKJL-5517","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.CDJ (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Packed.VMProtect.NAK suspicious application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Agent.awnz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXKA-YK!D0806C9D8BCE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Gen.ccmw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.VHD.5566464","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom.A095D3DB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom.A095D3DB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.CBW","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.1308374","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.A095D3DB","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Hooks API calls"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/techniques/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".text\" is zero\n Raw size of \".rdata\" is zero\n Raw size of \".data\" is zero\n Raw size of \".vmp0\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"AEEAEE SET\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"Copy/Move/Rename/Delete/Link Object\" (Path: \"HKCU\\CLSID\\{3AD05575-8857-4850-9277-11B85BDB8E09}\")\n \".exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")\n \".exe\" touched \"Recycle Bin\" (Path: \"HKCU\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\DEFAULTICON\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$25","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$26","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b.bin\" (Offset: 1875030)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"updater.exe\" has type \"data\"\n \"libwscodecs.dll\" has type \"PGP\\011Secret Sub-key -\"\n \"autoexec.bat\" has type \"data\"\n \"libEGL.dll\" has type \"data\"\n \"nss3.dll\" has type \"data\"\n \"CCEnhancer-4.5.1.exe\" has type \"data\"\n \"libspandsp-2.dll\" has type \"data\"\n \"1LoWM7zNlVq8h.exe\" has type \"data\"\n \"api-ms-win-core-handle-l1-1-0.dll\" has type \"data\"\n \"rpcapd.exe\" has type \"data\"\n \"Qt5Multimedia.dll\" has type \"data\"\n \"Qt5Gui.dll\" has type \"data\"\n \"3TXw.exe\" has type \"ISO-8859 text with very long lines with no line terminators\"\n \"api-ms-win-core-processenvironment-l1-1-0.dll\" has type \"data\"\n \"api-ms-win-crt-utility-l1-1-0.dll\" has type \"data\"\n \"capinfos.exe\" has type \"data\"\n \"api-ms-win-core-debug-l1-1-0.dll\" has type \"data\"\n \"uninstall.exe\" has type \"data\"\n \"WinSparkle.dll\" has type \"data\"\n \"pingsender.exe\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000020.db\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000020.db\"\n \"sc.exe\" touched file \"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui\"\n \"sc.exe\" touched file \"%WINDIR%\\System32\\en-US\\sc.exe.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b.bin\" was detected as \"VMProtect v1.70.4-> phpbb3\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\".exe\" queried SystemProcessInformation at 00291859-00003028-00000105-8358288995056590","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".vmp1 with unusual entropies 7.95614122708","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"sc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"C:\\$Recycle.Bin\\S-1-5-21-2092356043-4041700817-663127204-1001\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\".exe\" is creating a new process (Name: \"%WINDIR%\\System32\\sc.exe\", Handle: 172)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$27","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"NtProtectVirtualMemory@NTDLL.DLL\" in \".exe\"","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b.bin\" has an entrypoint in section \".vmp1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"Sleep\n GetModuleHandleA\n GetModuleFileNameW\n GetProcAddress\n LoadLibraryA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"ff2515001f00\" to virtual address \"0x001F000F\"\n \".exe\" wrote bytes \"e92aa54a88\" to virtual address \"0x77D45AE0\" (\"NtProtectVirtualMemory@NTDLL.DLL\")\n \".exe\" wrote bytes \"e9db5ab577\" to virtual address \"0x001F0005\"","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"malicious","category":"Environment Awareness","name":"PE file is protected by VMProtect","description":"\"097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b.bin\" has a section named \".vmp0\"\n \"097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b.bin\" has a section named \".vmp1\"","origin":"Static Parser","relevance":7,"id":"static-74","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"51/72 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"51/72 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"C:\\config.sys\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\".exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\sc.exe\" (Handle: 172)\n \".exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\sc.exe\" (Handle: 172)\n \".exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\sc.exe\" (Handle: 172)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"HowToDecrypt.txt\" which has been seen in the context of ransomware (Indicator: DECRYPT.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$28","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"The analysis extracted a known ransomware file"}],"sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"PE file is protected by VMProtect"}],"sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]}]},"activity":{"stats":{"process_count":21,"spawned_processes_count":21,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":1,"imported_dlls_count":31,"dropped_files_count":0,"extracted_files_count":143,"files_written_count":146,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["apt","evasive","ransomware","shamoon"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"5f213e32581aef13264ad8ff","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Ransom","submit_name":"097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b","analysis_start_time":"2020-07-29T09:15:45+00:00","indicators_count":{"informative":11,"suspicious":13,"malicious":8},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}],"processes":[{"pid":3028,"ppid":0,"name":"097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b.exe","command_line":"","sha256":"097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b","normalized_path":"C:\\097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b.exe","uid":"00291859-00003028","icon":"$29"},{"pid":292,"ppid":3028,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Active Directory Toplogy\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00291859-00003028","uid":"00292114-00000292"},{"pid":1304,"ppid":3028,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Anti-spam Update\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00291859-00003028","uid":"00292116-00001304"},{"pid":1684,"ppid":3028,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Compliance Audit\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00291859-00003028","uid":"00292116-00001684"},{"pid":2996,"ppid":3028,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Compliance Service\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00291859-00003028","uid":"00292117-00002996"},{"pid":2644,"ppid":3028,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange DAG Management\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00291859-00003028","uid":"00292119-00002644"},{"pid":1832,"ppid":3028,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Diagnostics\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00291859-00003028","uid":"00292121-00001832"},{"pid":3572,"ppid":3028,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange EdgeSync\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00291859-00003028","uid":"00292123-00003572"},{"pid":2688,"ppid":3028,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Frontend Transport\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00291859-00003028","uid":"00292124-00002688"},{"pid":2340,"ppid":3028,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Health Manager\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00291859-00003028","uid":"00292126-00002340"},{"pid":3576,"ppid":3028,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Health Manager Recovery\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00291859-00003028","uid":"00292126-00003576"},{"pid":3936,"ppid":3028,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange IMAP4\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00291859-00003028","uid":"00292127-00003936"},{"pid":1712,"ppid":3028,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange IMAP4 Backend\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00291859-00003028","uid":"00292128-00001712"},{"pid":3404,"ppid":3028,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Information Store\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00291859-00003028","uid":"00292131-00003404"},{"pid":2716,"ppid":3028,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Mailbox Assistants\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00291859-00003028","uid":"00292132-00002716"},{"pid":3284,"ppid":3028,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Mailbox Replication\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00291859-00003028","uid":"00292134-00003284"},{"pid":832,"ppid":3028,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Mailbox Transport Delivery\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00291859-00003028","uid":"00292136-00000832"},{"pid":2696,"ppid":3028,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange POP3\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00291859-00003028","uid":"00292145-00002696"},{"pid":752,"ppid":3028,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange POP3 Backend\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00291859-00003028","uid":"00292151-00000752"},{"pid":1500,"ppid":3028,"name":"sc.exe","command_line":"sc stop \"SQL Server Agent (TESTINSTANCE)\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00291859-00003028","uid":"00292175-00001500"},{"pid":2176,"ppid":3028,"name":"sc.exe","command_line":"sc stop \"SQL Server (TESTINSTANCE)\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00291859-00003028","uid":"00292178-00002176"}],"all_imported_dlls":["cryptbase.dll","rpcss.dll","setupapi.dll","gdi32.dll","uxtheme.dll","ntmarta.dll","devobj.dll","wtsapi32.dll","imm32.dll","oleaut32.dll","ntdll.dll","KernelBase.dll","usp10.dll","rpcrt4.dll","advapi32.dll","Wldap32.dll","propsys.dll","user32.dll","shell32.dll","clbcatq.dll","apphelp.dll","kernel32.dll","lpk.dll","msvcrt.dll","shlwapi.dll","ole32.dll","cfgmgr32.dll","msctf.dll","sechost.dll","profapi.dll","comctl32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"kmsauto.ini","sha256":"f67876daaf2d301fd85bbc30ee7cccacb710b2e2e6f70514a5519d0570694b96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"Hx.hxn","sha256":"48b897570310ec839394074bb80f697c89c82b1e53da1faeae378ea3dcda801a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"Hx_1033_MKWD_K.HxW","sha256":"981c8b4644234d5666edfe5840f78a8fa843096c891a61d83d6ff6eb4f6bb911","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"Hx_1033_MKWD_NamedURL.HxW","sha256":"7cac1e27eafcded0455f1b67945b19a7f0bd580ebe4c62a2a2615bfc520088a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"Hx_1033_MTOC_Hx.HxH","sha256":"53556de5a48d1efde87453cae85ec1701e23df7a50815f9a1b89c4a499ad497d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"Hx_1033_MValidator.HxD","sha256":"a74b56318b86fffeab4218b2b382a097398163c5235ad8257b6b1d7b1b96611b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"Hx_1033_MValidator.Lck","sha256":"5f7bb7ad2fa018a4996a6cb927d92dbe57ef79f5e2e6be9c287ea7e11f5e2aca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"MS.EXCEL.14.1033.hxn","sha256":"2bc966630fd6487924bb8b838c41ce3e63a1b3e964b66aca387d67e137a90ff0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"MS.EXCEL.DEV.14.1033.hxn","sha256":"42fc7bf43e50b9215eb80947eb65e7f9930d72767fbf240bead72cd259509e9b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"MS.GRAPH.14.1033.hxn","sha256":"f6d3f133a32c806c75afdbaa84c82569048934fea7bf4961470f265e7851deec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"MS.MSOUC.14.1033.hxn","sha256":"b70e19ee2f2af054e1350d95430498a3dd5fd0f8911bdef2684ba29907e1f1b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"MS.MSPUB.14.1033.hxn","sha256":"fcb36347d2e80b4c3d9e2fa52418ba29ddea16e223ef9c8be5123cc859b615e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"MS.MSPUB.DEV.14.1033.hxn","sha256":"707148368ae75321eefe4c41ae32421f3db86a9abe499aa0640f875bff2bb86e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"MS.MSTORE.14.1033.hxn","sha256":"46285098a248e1a10daf3f5c279050341ad0d7627f73a7af129bd8366a5bacf0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"MS.OIS.14.1033.hxn","sha256":"00cd842db1c9f3272dfa89056d4083ed2dbf5b8e98ce0169b817aff9bad5f64e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"MS.ONENOTE.14.1033.hxn","sha256":"a1e95f3dd7ac5708851c2753b1ee57dbcb63a581c585b2c4d1216d63949958ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"MS.OUTLOOK.14.1033.hxn","sha256":"6c8edceee06de67cbd3dce1f253743a1016fd49f4533b073e660909bdd618c2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"MS.OUTLOOK.DEV.14.1033.hxn","sha256":"d8b60fb5f195fecae61c78d98875286f42ac9419db9839458be65f5c0c514526","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"MS.POWERPNT.14.1033.hxn","sha256":"b21d8c29bac7c611ca59d8db3943a16851c1d786905647b0b9c8b5e18f86d6d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"MS.POWERPNT.DEV.14.1033.hxn","sha256":"50c768e6a7a94c02cd319c9afa344a64a50d2cbc09e3aa802baad0add35ab804","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"7-zip.chm","sha256":"377ad14bc3e7081113d16a4d7fd419646f372200df60e12ddfec5dfda0e6219e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"7z.dll","sha256":"c05092103c93a735be05759d4e8b245adeee5e3f4da41b703097249077c56dd2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"7z.exe","sha256":"a979899b41da580b29b94beff626cc715a0421f98bdf4131093b667fdac68ffa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"7zFM.exe","sha256":"3c70c695887b7ed086158df3f306310a937bc4e62658806d3069f8cd6eb93d03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"7zG.exe","sha256":"883e26b111b18bca8a1b79547595e7118366e1b25d30a621997bc8a1eaba0a66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"Uninstall.exe","sha256":"30e55be7563a07b69b066db0232c415d502b7f13045915c37e2fa9cbf0dce775","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"Au3Check.exe","sha256":"f7ee3103042243e09d0f56788351fbd5889ce735a686f5f55a0c9d2df8a57810","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"Au3Info.exe","sha256":"cabf1bb0a8eff6e0a9fc8d1d732a6f4f651098e654d93665d88b0aff99387113","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"Au3Info_x64.exe","sha256":"00cae3883b8311c5100fe620a3a3c73e34d320d6e30ec81a66d7e9f851003a5a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"AutoIt3Help.exe","sha256":"4c1c64991e360b860ac860a3fe507880bde265206ba5a06ceffa48f20a802031","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"AutoIt3_x64.exe","sha256":"fbf4e1ef290af36224592e760f801f68c326e92c9e795a985647a50dd756bd51","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"CCEnhancer-4.5.1.exe","sha256":"d5bb0a4ebc42c65f530c6b6272d1904dd0d70fff822eee56b325cb1a4f1063d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"sllauncher.exe","sha256":"1533affdba5b887ed484de016878eebb38b38d7a2aced806815454e1a4c9a947","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"xapauthenticodesip.dll","sha256":"701627a84a098e0ec01d7b4a602c5b2dc8c8fab71d6b0fc8382d7ffa859f8a1d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"AccessibleHandler.dll","sha256":"aca101f18fb60df9ab80e0e2bfcf4efc3445b79ce62f7ec00be8ecb6ec5ba268","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"AccessibleMarshal.dll","sha256":"26e6b8f9fbc94d781f2c6d43193512c6862cba5da9755123a5b77c2e45ba75b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"IA2Marshal.dll","sha256":"a8a5048d71b79e2559ee1141171bb1f526fc2c09694f30226f5b395554ed8b17","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-console-l1-1-0.dll","sha256":"827cb48ebc4ed5ff7809bee47c678ef1125a16c1b95b4bf5fe428dff8b4a60ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-datetime-l1-1-0.dll","sha256":"ab56426c0eb17a370cc4f9cccde24151459fcc3294bc3a6bc40a1d94f3e11c9b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-debug-l1-1-0.dll","sha256":"b0224d2017f20410bbab0a964a2fb64c01d8a58af166fb72585e26487a8b1aff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-errorhandling-l1-1-0.dll","sha256":"67025217d980a17a062632092901bc4a646556be84a3697c28859380b9567579","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-file-l1-1-0.dll","sha256":"f287eef84940342574345836661689eaffe755f147fedec64875fe631a107ab8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-file-l1-2-0.dll","sha256":"9e9f107521f898fb72bcaabde53e17c6894e99ddac089b1348f3e797b0334b6a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-file-l2-1-0.dll","sha256":"d18211b45648551c43063362372c103426a590468655e1d3b0044ff9878db652","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-handle-l1-1-0.dll","sha256":"49eafb17eaf1f1bb8f7ed2d74447a8695b1161913b3a914ae88f537cea705203","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-heap-l1-1-0.dll","sha256":"77d6803fccc58d7da0306d1bb926ea63def308ea2d9c3b13b6d3b5798f4ace4c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-interlocked-l1-1-0.dll","sha256":"3af917718c1e2ef297b682994852ea51b45242f138cfa20af83fa899f51d0a1e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-libraryloader-l1-1-0.dll","sha256":"7fa1ba7c46e93e945f28ae1bb2d174cb9a5cbe905448b920c3beddec17cf106c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-localization-l1-2-0.dll","sha256":"437d14bfeeafdd4c8ca1d246a4b26f8d5154fa5dc9db56b015e7541e6f5af52e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-memory-l1-1-0.dll","sha256":"1da1d3cb6bd979cd2f96784c049b38c9beaccff2346c902432d7b007283e249e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-namedpipe-l1-1-0.dll","sha256":"eaee1f7b2b6b40d9b3a7df0b1ba1358e7079ba4c1758a4f3de01fd79198582d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-processenvironment-l1-1-0.dll","sha256":"857555672ba964af9471df1bbe78f75b30de9ad1c4ee1f38b79e411d5fbf18da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-processthreads-l1-1-0.dll","sha256":"5bb5a8dfe9b654068ac6ba20dd30086d2b623e7efe62f69d008ce6c5d246fc66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-processthreads-l1-1-1.dll","sha256":"512eaa35b0829574891cad953c888de0ac1592d6520a3cf79b0232cce2528c9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-profile-l1-1-0.dll","sha256":"9f51f35feb46505ac89363071d5ed1f7943150f1a4c8c68a2eb4dd263a0867ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-rtlsupport-l1-1-0.dll","sha256":"d94c502943d46cc0a36dcb8a011eaa3b5ef582c40e5a0511a6c7e92bc6f4c6a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-string-l1-1-0.dll","sha256":"e07273ed3273c304e12571ff5ef1b4cf0741d19b3ec69f9d7b680a401500ecbe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-synch-l1-1-0.dll","sha256":"991b8a0582a1dcfbedc5ea43baef51251a32aadf2212e4eeb3f62225450c8c06","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-synch-l1-2-0.dll","sha256":"e33d25593d5c0eb4bd4d368aaf13cda0ab9c2594fc4f22948893981a5329b5ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-sysinfo-l1-1-0.dll","sha256":"523104b55c6aca5a075acbe8803a64546f8ff2d47c452326854e996b9b2d8381","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-timezone-l1-1-0.dll","sha256":"6373687942f34148b01f7968b7def0beb3913d39ac919aefb42b9efeb1367502","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-core-util-l1-1-0.dll","sha256":"8c9266906d56d92e98736e56ab1e868e03d29f9aeb21e1614759391ba229147e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-crt-conio-l1-1-0.dll","sha256":"321905971f202899df2178b20a81dff1d57de50d485775878ed018ea640bdf22","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-crt-convert-l1-1-0.dll","sha256":"703b1dd8a88d4be0ba2714bd0a6bba60144db7f113aca986b02df84595dbb61d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-crt-environment-l1-1-0.dll","sha256":"f924ce46443a28311bd257df265155d4ca227ca985d7efd974b3fb52ad1f1d62","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-crt-filesystem-l1-1-0.dll","sha256":"a3c4751c629103c2e41efe7e47c1d5e4e784f5b1cf1cd4993f388944c088b8b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-crt-heap-l1-1-0.dll","sha256":"71f79bfc7b9ccc403dd2d6c8e49410cf56ed9f4578da54d0f9f6d8a5780cd3ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-crt-locale-l1-1-0.dll","sha256":"94674269e4b654ff0fd8e0727e1cc1dde3671782b26bfde8db0a515de45f86af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-crt-math-l1-1-0.dll","sha256":"34c5bff392cca71eb79f496f1ee70c2939a24610c98b9a18e253a46af9294f44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-crt-multibyte-l1-1-0.dll","sha256":"4de2e1c1552252ed10c427d3ce11c6f40ff0a23b05a431001e97e150d5d61d71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-crt-private-l1-1-0.dll","sha256":"181348236d40c485e9dbd8151887cc76220851a5bd465bc07af335b657a552a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-crt-process-l1-1-0.dll","sha256":"1a83f10da47d4c5b28a20cbebd1d82eed9089a871e3e3f558a6e9ea41d40b55a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-crt-runtime-l1-1-0.dll","sha256":"6813efe789fcd3f4acd896590ed63bab56baa5717ec8b50b6bca577df0d70a46","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-crt-stdio-l1-1-0.dll","sha256":"1d78b58914a39c3be99bcff24c72dcf3c7538ec6839e8bed0deca75de0ebe5f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-crt-string-l1-1-0.dll","sha256":"83d9ec4b4bf7858c7f17b7b42618721c688aefc3b208d62af55f36a0af4f36eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-crt-time-l1-1-0.dll","sha256":"dc299be9c54346f6f3fc9524c560120d5dc0f2bdbe70cd09a8c503df70c325dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"api-ms-win-crt-utility-l1-1-0.dll","sha256":"23ca4d8d6f8fd61669119c73dc9abc2e4fd751baa2c6afad15585497128d6f85","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"breakpadinjector.dll","sha256":"1a1bd108b6141bfeae310dece4125dd1586269b79bd18982d54d2c7d9b555e1e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"crashreporter.exe","sha256":"b33138b47a85c57788dc010445076b7568468bd441e800e0c5b04addf3969c56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"d3dcompiler_47.dll","sha256":"49c54ddd6a51e0ffb2b763e758ea0b8d4e77ff9b45ab657314dfd5006223a326","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"firefox.exe","sha256":"eedd98f15e9d5c71b86a2953ae73373f1b501623ad5699c98d597b2521b5be60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"freebl3.dll","sha256":"c8df3462b8a21862fb1e539ac008fe2fa8bbcca7b5b6306434cdd0fbc53c9d22","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"lgpllibs.dll","sha256":"ca41ef4561c22080eaa111e3594d3810333aa9a7832aec586f8292dd4c316758","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"libEGL.dll","sha256":"a00be7a8340daa11f0c7570a4deaa7fa66162992f97290a111dec0e7a928ec15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"libGLESv2.dll","sha256":"7d130e17785b14d600499bccef601be206cea9cce80f572c97a7bac45a8a49be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"maintenanceservice.exe","sha256":"cde54b4a4aca1cca893c124875993b0f62144883d8b6aa6e47e92a25ce0a5802","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"maintenanceservice_installer.exe","sha256":"128d86291066526764875aa427e8495977a0c495a73d3ef3c7875868ac21c01c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"minidump-analyzer.exe","sha256":"7852abea373fcc9e41117dfb38b44a74041762abebe7b4948e25ff36efe77147","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"mozavcodec.dll","sha256":"e0e82dc1a159934926ad5753322be32f0a949762470f0a2607a790e1a8e3c7b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"mozavutil.dll","sha256":"e9c9b9534702dd1c76566502fa2fc0e84824175d903ef5a5c8c2d8873c028eda","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"mozglue.dll","sha256":"007ecf42c24ba533c1fe1d71524b0e45e722443e3d4989c23a6b3cb233ce8f25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"msvcp140.dll","sha256":"10fd5ff58df045aabd24a00a0793893ca2ca8374cebb5de90f9202fca4fc2382","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"nss3.dll","sha256":"9dd92e063daedf359ad1f8c1d781acdcec823409b06c64f95b3522e7ca20e3a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"nssckbi.dll","sha256":"610bc2c5656c488e673e4fdfa5f1aebba2936ebd3f81db1f746db6b2630cc7a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"nssdbm3.dll","sha256":"504005900ccf2d9699903c8fcf9c8a8b4b1a122645aea6409d00b390036af2f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"pingsender.exe","sha256":"b5425d78bd635f206826827da48da5d35e23c50e2a9ab893319c3c7a4e897c66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"plugin-container.exe","sha256":"f8990e7594991f4214320e1fe0b805268a30d4284a0584574d6d03c7115bb789","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"plugin-hang-ui.exe","sha256":"ac66737284da157ddf5bf9297c6690c60e0d7f9969ef871e3f6f38479f9270fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"qipcap.dll","sha256":"94e63920113861b93f16c77fd185313540c9e84a43438a7938b4d00f1d032312","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"softokn3.dll","sha256":"2e15c0c15796d0fbb1ccc64c0c277947752183b5f46862f36879dbf6ce2e0895","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"ucrtbase.dll","sha256":"9777783af512a48d95d9cd03b58b570c37a9ab235116c2c86085f917df86af07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"updater.exe","sha256":"050cd4ae178af4a7893a2c49aea262fd7a337cb0c5e060dc547b42e438fe8957","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"vcruntime140.dll","sha256":"d1dd516f3dc70c28e4aa86298c277b0277cd6b083426869bbaebb798d26523d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"rpcapd.exe","sha256":"9be02b7c01240843f550a1435bc06fda8fe63496afd6cec44a774bc8bdd10cbb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"Qt5Core.dll","sha256":"9b6a4ea159249d9d0d9025054f8de5f775545a6c4489753e309cc0aaf1e6dd37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"Qt5Gui.dll","sha256":"7c2aefc4b448790339b878bb224e23bc3c4856e45ba9f75677cb2f45c1334ac7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"Qt5Multimedia.dll","sha256":"5577cb5ed99d70e55eafe06208797781035c93d9ce7f6d33c3b78e1dee2a07a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"Qt5Network.dll","sha256":"cbbd70af5c24288797ef869633d356dde212e204f26735ca011181387c7da05f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"Qt5PrintSupport.dll","sha256":"3c7056431a8c36b566f14755344d7c058c8f019c329e7f85e5bea1f38cdc3e49","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"Qt5Svg.dll","sha256":"04d171393a4ac9d3f382ceecc9d176e66fb80c97227339701a31fbfa476e5c07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"Qt5Widgets.dll","sha256":"52b33377d77e355b0ab108389daa0b4850e3eac790fb35d4d4ad431b1279b280","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"Qt5WinExtras.dll","sha256":"4b8955d691e626e630200a883cc3693e5ba343fd9b2282d431176f22865cf3a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"WinPcap_4_1_3.exe","sha256":"9e5281cf9b48d2178bb2fba607d6e96ce46addf823a11aecf1f858c888dad1bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"WinSparkle.dll","sha256":"4c498557fa682a21b837ae89e1a2d9185160acd2d56ea98f019179f3e6deace6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"capinfos.exe","sha256":"5e912be7f8276e2b6204d5cc514510b6994b4cf723429751797cce6e0244fab9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"editcap.exe","sha256":"09477163dd21fbde31e8ff851b7dacaab0b85e2b6b3b8fd0ef2eaf8b1bb1bd40","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"libGLESV2.dll","sha256":"815d4b9f5a0b7b66a7bb28b564c243c8083e61514dcce612623371e78c2918fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"libgio-2.0-0.dll","sha256":"f01016f1811342bf5274c68df4188f59629741996de8efb3e838eef62ecbd1e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"libgobject-2.0-0.dll","sha256":"0fe5017f9f5cb25c8ec2bf29d9bb5273e5ce9958fd352f0dbd9a469cb33c7cdf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"libsbc-1.dll","sha256":"d180e5679e82fa9f191dfb1f6ed4f9910173be7496d966b7ff3e45432a01c7e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"libspandsp-2.dll","sha256":"d33e95171fb43d607b0776afddd6821c471d6e626eb6debc720fe74c89dad01b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"libssh.dll","sha256":"2f2d9f8d33e1803bb23e91b11dc72dc3c4307f63de8e745e9c512528d9ba1e19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"libwscodecs.dll","sha256":"93215c7eeb5ef491f3aab361dbac95943ba389e7038b8fcec41623b245f683d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"mergecap.exe","sha256":"07d87afdf0732472ec5f82193077b3faf60150336bd0c4f763e5e41b7c38a1fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"rawshark.exe","sha256":"a4e52971aa21624e324222595e752b75eb65144140b38df2e947e55fbb2effcb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"reordercap.exe","sha256":"c905708f2385fd8ef0cd88975f7163716854b192937dde6c93dff8155024d0d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"text2pcap.exe","sha256":"4168815dfb478f446c1d3eb9b8c4aec6c7961f1c2719084e051837ad794c2ee4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"uninstall.exe","sha256":"1724a7a9ed66a37658ebce0257fb95e574ce6f1810b14beb5fcca01861a304ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"0YdED8h4YnKljVf.doc","sha256":"212a18901fd6b1f0292c2dd0dd1147dfbb8c5d2b0c0d42ec714c84a60cc2ab40","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"1LoWM7zNlVq8h.exe","sha256":"e38bf28a3e6d3733200b81e5ebe580cffbbdbe2674ded40077651aee54a648f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"3TXw.exe","sha256":"314e7339dbaf63ad0721af2d363ec7988032e5bd473db54436a60e0443bcab14","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"3VBXaPVG.exe","sha256":"d7d37238a90047f8e4af5064c1dccddae112f88fb96fd97e795a6b8090470ea4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"3kNG.exe","sha256":"db2a95dc290c59bb7f679098b4c26f0f2e3bbcc45eede5151bc6000061a03e24","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"6JQvD1.exe","sha256":"16a5e0a9157931bd0f7d2c221d2b66268a8929c5102d5c20e5d6d5a14e53c30b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"7GXTVgCwg.exe","sha256":"418138fa57f6beb8b8202d402713632a57dc886274e92a7bb8d40a4a01b4185d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"A6a4k093.exe","sha256":"f87e77489d47fff1d8ca33acdfb35a9b545161b9e87e95b8806e66eae4290fdf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"AMrt2OL.exe","sha256":"b59b3eda003cd0a925c8d3b3a5d5d2cbe24e96fce91aa80ecbb4af7fdb7561cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"ara0UGGW3VRU.exe","sha256":"54d46ff9c6542ca8fce37674f8b4bd8c9ce3872977538fe301d9fd50fea72edb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"Desktop.lnk","sha256":"7c9e0e6b911ab483e82471b8870e6ba5f8889d7d760431e0e2db38da01ba5aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"Downloads.lnk","sha256":"756480dbae1eff654989efb7dd0e33fa26462bc4a638b71067c4c7a98f277722","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"OneDrive.lnk","sha256":"fb0987d3240e665086a599ecc0d1f63bfef78c0f3e65d0942a091576b9a4af73","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"RecentPlaces.lnk","sha256":"5a964c8033e0b7ea2e1e41b0c45db9b8615e8bb803517e803a4a4359e75aad3f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"name":"autoexec.bat","sha256":"8f46b2dceb1975f4e56610499493714b00c2f399f33697e17a692b93cf137731","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]}],"files_written":[{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%WINDIR%\\System32\\en-US\\sc.exe.mui","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-2092356043-4041700817-663127204-1001\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%USERPROFILE%\\Downloads\\ARxMW.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libtasn1-6.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libwinpthread-1.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libwireshark.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libwiretap.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"C:\\Czuw.pIs","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000020.db","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%USERPROFILE%\\Desktop\\HowToDecrypt.txt","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"C:\\HowToDecrypt.txt","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"C:\\share\\HowToDecrypt.txt","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"C:\\share\\097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"C:\\097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\comerr32.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\dumpcap.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\k5sprt32.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\krb5_32.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libcares-2.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libffi-6.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libgcc_s_sjlj-1.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libgcrypt-20.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libGeoIP-1.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libglib-2.0-0.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libgmodule-2.0-0.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libgmp-10.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libgnutls-30.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libgpg-error-0.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libhogweed-4-2.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libintl-8.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\liblz4.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libnettle-6-2.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libnghttp2-14.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libp11-kit-0.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libsmi-2.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libsnappy-1.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\lua52.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libxml2-2.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libwsutil.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\tshark.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\zlib1.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Sidebar\\sbdrop.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Sidebar\\sidebar.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Sidebar\\wlsrvc.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Portable Devices\\sqmapi.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Photo Viewer\\ImagingDevices.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Photo Viewer\\ImagingEngine.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Photo Viewer\\PhotoAcq.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Photo Viewer\\PhotoBase.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Photo Viewer\\PhotoViewer.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\mpvis.DLL","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\setup_wm.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmlaunch.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmpconfig.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\WMPDMC.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\WMPDMCCore.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmpenc.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmplayer.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\WMPMediaSharing.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmpnetwk.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmpnscfg.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmpnssci.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\WMPNSSUI.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmprph.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmpshare.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\WMPSideShowGadget.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmssetup.ceb","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmssetup.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Mail\\msoe.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Mail\\MSOERES.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Mail\\oeimport.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Mail\\wab.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Mail\\wabfind.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Mail\\wabimp.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Mail\\wabmig.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MpAsDesc.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MpClient.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MpCmdRun.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MpCommu.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MpEvMsg.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MpOAV.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MpRTP.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MpSvc.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MSASCui.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MsMpCom.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MsMpLics.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MsMpRes.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\D3DCompiler_47.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\DiagnosticsHub.DataWarehouse.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\DiagnosticsHub.ScriptedSandboxPlugin.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\DiagnosticsHub_is.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\DiagnosticsTap.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\ExtExport.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\F12.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\F12Resources.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\F12Tools.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\ie9props.propdesc","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iediagcmd.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iedvtool.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\ieinstal.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\ielowutil.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\ieproxy.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\IEShims.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iessetup.ceb","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iessetup.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\jsdbgui.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\jsdebuggeride.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\JSProfilerCore.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\jsprofilerui.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\MemoryAnalyzer.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\msdbg2.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\networkinspection.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\pdm.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\pdmproxy100.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\perfcore.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\perf_nt.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\sqmapi.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\Timeline.cpu.xml","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\Timeline.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\Timeline_is.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\audiodepthconverter.ax","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\bod_r.TTF","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\directshowtap.ax","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\DVDMaker.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\Eurosti.TTF","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\fieldswitch.ax","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\offset.ax","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\OmdBase.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\OmdProject.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\Pipeline.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\PipeTran.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\rtstreamsink.ax","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\rtstreamsource.ax","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\SecretST.TTF","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\soniccolorconverter.ax","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\sonicsptransform.ax","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\WMM2CLIP.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoIt3.exe","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%PROGRAMFILES%\\7-Zip\\7-zip.dll","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"path":"%USERPROFILE%\\Searches\\Indexed Locations.search-ms","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\BITBUCKET\\VOLUME\\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}\\","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"AEEAEE SET","sources":[{"report_type":"sandbox","report_id":"5f213e32581aef13264ad8ff"}]}]}},"report_ids":{"sandbox_job_ids":["5f213e32581aef13264ad8ff"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Ransom.A095D3DB Sample 097ca829e051… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 097ca829e051…. Malware family: Ransom.A095D3DB. Threat score 100/100. 18/28 AV engines flagged this file. 7 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.A095D3DB Sample 097ca829e051… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 097ca829e051…. Malware family: Ransom.A095D3DB. Threat score 100/100. 18/28 AV engines flagged this file. 7 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.A095D3DB Sample 097ca829e051… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 097ca829e051…. Malware family: Ransom.A095D3DB. Threat score 100/100. 18/28 AV engines flagged this file. 7 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]