24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 10f9ad4e9f6e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 10f9ad4e9f6e…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 1/1 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/10f9ad4e9f6e0dc1793be80203b258f8c5114d01cb17307c1b2fdcca37d4edf9","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","10f9ad4e9f6e0dc1793be80203b258f8c5114d01cb17307c1b2fdcca37d4edf9"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","assembly","executable"],"identifier":"10f9ad4e9f6e0dc1793be80203b258f8c5114d01cb17307c1b2fdcca37d4edf9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":1,"total":1},"behavioralIndicators":{"malicious":8,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T83d,"X.exe" queries volume information of "C:\X.exe" at 00065285-00003544-00000046-2609898 "X.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00065285-00003544-00000046-3147568 "X.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00065285-00003544-00000046-3480226 "X.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00065285-00003544-00000046-3493848 "X.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll" at 00065285-00003544-00000046-5939900 "X.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll" at 00065285-00003544-00000046-5958912 "X.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll" at 00065285-00003544-00000046-6263345 "X.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll" at 00065285-00003544-00000046-6286729 "X.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00065285-00003544-00000046-7301583 "X.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00065285-00003544-00000046-7309063 "X.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00065285-00003544-00000046-13964227046149998 "kl2ccckn.exe" queries volume information of "C:\Windows\Temp\kl2ccckn.exe" at 00065607-00002624-00000046-346250526:T4cf,"X.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "X.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" "X.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll" "X.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config" "X.exe" touched file "C:\Windows\assembly\pubpol201.dat" "X.exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System\47e0be927382f169f5de470fab0ceb7d\System.ni.dll.aux" "X.exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll.aux" "X.exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\43d86904e41b891e07c2ce8a20996e2c\System.Windows.Forms.ni.dll.aux" "X.exe" touched file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" "X.exe" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\617299d2bd5dcfe094cedface0c39d1c\System.Drawing.ni.dll.aux" "X.exe" touched file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll"27:T1487,Pattern match: "https://coinbase.com" Pattern match: "media.adrcdn.com/scripts/screenad_interface_1.0.3_scrambled.js" Pattern match: "https://code.createjs.com/createjs-2015.11.26.min.js" Pattern match: "https://www.aweber.com/" Pattern match: "fast.wistia.com/assets/external/E-v1.js" Pattern match: "https://assets.aweber-static.com/www/assets/img/touch-icon-192x192.c8d9f10b.png" Pattern match: "https://assets.aweber-static.com/www/assets/img/apple-touch-icon-180x180-precomposed.f5c48398.png" Pattern match: "https://assets.aweber-static.com/www/assets/img/apple-touch-icon-152x152-precomposed.d43a5640.png" Pattern match: "https://assets.aweber-static.com/www/assets/img/apple-touch-icon-144x144-precomposed.f97b1d42.png" Pattern match: "https://assets.aweber-static.com/www/assets/img/apple-touch-icon-120x120-precomposed.c239b418.png" Pattern match: "https://assets.aweber-static.com/www/assets/img/apple-touch-icon-114x114-precomposed.bd8c4a11.png" Pattern match: "https://assets.aweber-static.com/www/assets/img/apple-touch-icon-76x76-precomposed.4f5223f9.png" Pattern match: "https://assets.aweber-static.com/www/assets/img/apple-touch-icon-72x72-precomposed.4a802c3f.png" Pattern match: "https://assets.aweber-static.com/www/assets/img/apple-touch-icon-precomposed.73fa7bb0.png" Pattern match: "https://assets.aweber-static.com/www/assets/css/transitional.bb39550a.css" Pattern match: "https://assets.aweber-static.com/www/assets/bundles/jquery.232192f0.js" Pattern match: "https://www.googletagmanager.com/gtm.js?id='+i+dl+'>m_auth=UYNjOPXi40kADX0ZYRcuvw>m_preview=env-50>m_cookies_win=x';f.parentNode.insertBefore(j,f)" Pattern match: "dev.visualwebsiteoptimizer.com/j.php?a='+account_id+'&u='+encodeURIComponent(d.URL)+'&r='+Math.random()" Pattern match: "i.kissmetrics.com/i.js" Pattern match: "https://www.googletagmanager.com/ns.html?id=GTM-5J4XPK>m_auth=UYNjOPXi40kADX0ZYRcuvw>m_preview=env-50>m_cookies_win=x" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "https://blog.aweber.com" Pattern match: "blog.aweber.com/launchpad" Pattern match: "https://videos.aweber.com" Pattern match: "https://status.aweber.com" Pattern match: "blog.aweber.com/guides" Pattern match: "blog.aweber.com/live-webinars" Pattern match: "blog.aweber.com/tag/infographic" Pattern match: "https://fast.wistia.com/embed/medias/ts31smmzcs.jsonp" Pattern match: "https://assets.aweber-static.com/www/assets/img/theme-hero-mobile.fb1bf70c.jpg" Pattern match: "https://assets.aweber-static.com/www/assets/img/theme-hero-after.732e3809.jpg" Pattern match: "https://assets.aweber-static.com/www/assets/img/theme-cta-1.0ce3108d.png" Pattern match: "https://assets.aweber-static.com/www/assets/img/illy1.033e6e5c.jpg" Pattern match: "https://assets.aweber-static.com/www/assets/img/illy2.1cad468e.jpg" Pattern match: "https://assets.aweber-static.com/www/assets/img/theme-cta-before.70bf715e.jpg" Pattern match: "https://fast.wistia.com/embed/medias/fdwyszh12t.jsonp" Pattern match: "https://assets.aweber-static.com/www/assets/img/illy3.70935d4b.jpg" Pattern match: "https://assets.aweber-static.com/www/assets/img/illy4.643317ff.jpg" Pattern match: "https://assets.aweber-static.com/www/assets/img/testimonial-christiank.d31b508a.jpg" Pattern match: "https://assets.aweber-static.com/www/assets/img/testimonial-johnc.2a5a671f.png" Pattern match: "https://assets.aweber-static.com/www/assets/img/testimonial-jeaninel.f827e4f7.jpg" Pattern match: "https://assets.aweber-static.com/www/assets/img/testimonial-genesower.2ee227a6.jpg" Pattern match: "https://assets.aweber-static.com/www/assets/img/theme-footer-mobile.1e8c1b29.jpg" Pattern match: "https://assets.aweber-static.com/www/assets/img/theme-footer-before.ab678420.jpg" Pattern match: "https://assets.aweber-static.com/www/assets/img/testimonial-small-jillwinger.b0a4648d.png" Pattern match: "https://assets.aweber-static.com/www/assets/img/theme-footer-after.345977d6.jpg" Pattern match: "https://assets.aweber-static.com/www/assets/bundles/vendor.8a8c9f67.js" Pattern match: "https://assets.aweber-static.com/www/assets/bundles/lib.20a3f74a.js" Pattern match: "https://assets.aweber-static.com/www/assets/bundles/globals.3a2b3c67.js" Pattern match: "https://assets.aweber-static.com/www/assets/bundles/start_sending.b47eb221.js" Pattern match: "https://blog.aweber.com/email-marketing/one-ridiculously-simple-email-thatll-build-loyal-audience-read-share-content.htm" Pattern match: "https://blog.aweber.com/email-marketing/color-theory-for-sign-up-form-design.htm" Pattern match: "https://blog.aweber.com/email-marketing/sending-the-right-email-at-the-right-time-with-aweber.htm" Pattern match: "https://help.aweber.com/" Pattern match: "https://blog.aweber.com/live-webinars" Pattern match: "https://status.aweber.com/" Pattern match: "https://labs.aweber.com" Pattern match: "https://engineering.aweber.com" Pattern match: "https://help.aweber.com/hc/en-us/search" Pattern match: "www.facebook.com/aweber" Pattern match: "www.twitter.com/aweber" Pattern match: "plus.google.com/+aweber" Pattern match: "www.youtube.com/aweber" Pattern match: "www.instagram.com/aweber" Pattern match: "www.pinterest.com/emailmarketing/"28:T7fe,"cmstp.exe" opened "C:\Windows\temp\cmpbk32.dll" with delete access "cmstp.exe" opened "C:\Windows\temp\cmdial32.dll" with delete access "cmstp.exe" opened "C:\Windows\temp\cmdl32.exe" with delete access "cmstp.exe" opened "C:\Windows\temp\cmmon32.exe" with delete access "cmstp.exe" opened "C:\Windows\temp\cmutil.dll" with delete access "cmstp.exe" opened "C:\Windows\temp\instcm.inf" with delete access "cmstp.exe" opened "C:\Windows\temp\cmcfg32.dll" with delete access "kl2ccckn.exe" opened "C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml" with delete access "kl2ccckn.exe" opened "C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml" with delete access "kl2ccckn.exe" opened "C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml" with delete access "kl2ccckn.exe" opened "C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml" with delete access "kl2ccckn.exe" opened "C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml" with delete access "kl2ccckn.exe" opened "C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml" with delete access "kl2ccckn.exe" opened "C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml" with delete access "kl2ccckn.exe" opened "C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml" with delete access "kl2ccckn.exe" opened "C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml" with delete access "kl2ccckn.exe" opened "C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml" with delete access "kl2ccckn.exe" opened "C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml" with delete access "kl2ccckn.exe" opened "C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml" with delete access "kl2ccckn.exe" opened "C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml" with delete access29:T7f8,"X.exe" wrote bytes "65488b0425d0140000" to virtual address "0xEF382C1B" (part of module "CLR.DLL") "X.exe" wrote bytes "65488b0425d0140000" to virtual address "0xEF382C5B" (part of module "CLR.DLL") "X.exe" wrote bytes "c850e949a0d20000" to virtual address "0xEFB4FA70" (part of module "CLR.DLL") "X.exe" wrote bytes "654c8b1c25c8140000" to virtual address "0xEF382570" (part of module "CLR.DLL") "X.exe" wrote bytes "654c8b1c25c8140000" to virtual address "0xEF382533" (part of module "CLR.DLL") "X.exe" wrote bytes "654c8b1c25c8140000" to virtual address "0xEF3828CA" (part of module "CLR.DLL") "X.exe" wrote bytes "654c8b1c25c8140000" to virtual address "0xEF3825EB" (part of module "CLR.DLL") "X.exe" wrote bytes "65488b0425d0140000" to virtual address "0xEF382C8B" (part of module "CLR.DLL") "X.exe" wrote bytes "65488b0425d0140000" to virtual address "0xEF382CCB" (part of module "CLR.DLL") "X.exe" wrote bytes "654c8b1c25c8140000" to virtual address "0xEF3829CC" (part of module "CLR.DLL") "X.exe" wrote bytes "654c8b1c25c8140000" to virtual address "0xEF3826ED" (part of module "CLR.DLL") "X.exe" wrote bytes "654c8b1c25c8140000" to virtual address "0xEF38264E" (part of module "CLR.DLL") "X.exe" wrote bytes "65488b0425c8140000" to virtual address "0xEF382BA0" (part of module "CLR.DLL") "X.exe" wrote bytes "65488b0425c8140000" to virtual address "0xEF382BC0" (part of module "CLR.DLL") "X.exe" wrote bytes "654c8b1c25c8140000" to virtual address "0xEF3826A3" (part of module "CLR.DLL") "X.exe" wrote bytes "65488b0425c8140000" to virtual address "0xEF382B83" (part of module "CLR.DLL") "cmstp.exe" wrote bytes "401355fdfe070000" to virtual address "0xFD56FE10" (part of module "SSPICLI.DLL") "cmstp.exe" wrote bytes "001055fdfe070000" to virtual address "0xFD56FE50" (part of module "SSPICLI.DLL") "cmstp.exe" wrote bytes "401355fdfe070000" to virtual address "0xFD56FB10" (part of module "SSPICLI.DLL") "cmstp.exe" wrote bytes "001055fdfe070000" to virtual address "0xFD56FB50" (part of module "SSPICLI.DLL")2a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"10f9ad4e9f6e0dc1793be80203b258f8c5114d01cb17307c1b2fdcca37d4edf9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791190350232,"unified_at":"2026-10-05T08:52:30.232Z","metadata":{"hashes":{"sha256":"10f9ad4e9f6e0dc1793be80203b258f8c5114d01cb17307c1b2fdcca37d4edf9","sha1":"cdd65a8baa255b68dc0b070ad40c9e32757afe03","md5":"eeb2552e49de8ab5b118d57368b71483","sha512":"e32807b8d1e1cd8a9b380e49e8f9a25353dae0d8500a91c5b84596f2703160f1086297210b89a138207adae980af907e0c68ed84cf59178997f28784465f095f","ssdeep":"6144:5Nb3ex83ECgS8DBN8+betvD0tU0qOixjuxduaZ2YjkwEL/SW9EN:5kxp9C+SqiyduMzkwEr","ssdeep_chunks":["6144:5Nb3ex8","6144:Nb3ex83","6144:b3ex83E","6144:3ex83EC","6144:ex83ECg","6144:x83ECgS","6144:83ECgS8","6144:3ECgS8D","6144:ECgS8DB","6144:CgS8DBN","6144:gS8DBN8","6144:S8DBN8+","6144:8DBN8+b","6144:DBN8+be","6144:BN8+bet","6144:N8+betv","6144:8+betvD","6144:+betvD0","6144:betvD0t","6144:etvD0tU","6144:tvD0tU0","6144:vD0tU0q","6144:D0tU0qO","6144:0tU0qOi","6144:tU0qOix","6144:U0qOixj","6144:0qOixju","6144:qOixjux","6144:Oixjuxd","6144:ixjuxdu","6144:xjuxdua","6144:juxduaZ","6144:uxduaZ2","6144:xduaZ2Y","6144:duaZ2Yj","6144:uaZ2Yjk","6144:aZ2Yjkw","6144:Z2YjkwE","6144:2YjkwEL","6144:YjkwEL/","6144:jkwEL/S","6144:kwEL/SW","6144:wEL/SW9","6144:EL/SW9E","6144:L/SW9EN","12288:5Nb3ex8","12288:Nb3ex83","12288:b3ex83E","12288:3ex83EC","12288:ex83ECg","12288:x83ECgS","12288:83ECgS8","12288:3ECgS8D","12288:ECgS8DB","12288:CgS8DBN","12288:gS8DBN8","12288:S8DBN8+","12288:8DBN8+b","12288:DBN8+be","12288:BN8+bet","12288:N8+betv","12288:8+betvD","12288:+betvD0","12288:betvD0t","12288:etvD0tU","12288:tvD0tU0","12288:vD0tU0q","12288:D0tU0qO","12288:0tU0qOi","12288:tU0qOix","12288:U0qOixj","12288:0qOixju","12288:qOixjux","12288:Oixjuxd","12288:ixjuxdu","12288:xjuxdua","12288:juxduaZ","12288:uxduaZ2","12288:xduaZ2Y","12288:duaZ2Yj","12288:uaZ2Yjk","12288:aZ2Yjkw","12288:Z2YjkwE","12288:2YjkwEL","12288:YjkwEL/","12288:jkwEL/S","12288:kwEL/SW","12288:wEL/SW9","12288:EL/SW9E","12288:L/SW9EN","6144:5kxp9C+","6144:kxp9C+S","6144:xp9C+Sq","6144:p9C+Sqi","6144:9C+Sqiy","6144:C+Sqiyd","6144:+Sqiydu","6144:SqiyduM","6144:qiyduMz","6144:iyduMzk","6144:yduMzkw","6144:duMzkwE","6144:uMzkwEr"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"file","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":378368,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1612351752000,"last_seen":1677285701000,"last_multi_scan":1677285701000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["filecoder","malicious","ransomware"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":1},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":12},"sandbox_signatures":{"informative_count":20,"suspicious_count":16,"malicious_count":8,"total":44},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"CMSTP","attack_id":"T1191","attack_id_wiki":"https://attack.mitre.org/techniques/T1191","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"},{"type":"informative","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/techniques/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/techniques/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/techniques/T1107","identifiers":[{"type":"malicious","value":"Deletes volume snapshots (often used by ransomware)"},{"type":"malicious","value":"Deletes backup catalog"}],"sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Monitors specific registry key for changes"}],"sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"tactic":"Execution","technique":"Command-Line Interface","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Runs shell commands"}],"sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$25","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"cmstp.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMMGR32.EXE\")\n \"cmstp.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMMGR32.EXE\"; Key: \"CMSTPEXTENSIONDLL\"; Value: \"00000000010000004000000043003A005C00570069006E0064006F00770073005C00730079007300740065006D00330032005C0063006D00630066006700330032002E0064006C006C000000\")\n \"cmstp.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMSTP.EXE\")\n \"cmstp.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMSTP.EXE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"X.exe\" created file \"%WINDIR%\\Temp\\kl2ccckn.exe\"\n \"X.exe\" created file \"%WINDIR%\\Temp\\j3h20fsn.inf\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Connection Manager Profile Installer Mutex\"\n \"RasPbFile\"\n \"Connection Manager Profile Installer Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"X.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at EDD80000\n \"kl2ccckn.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 71F80000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"cmstp.exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"cmstp.exe\" touched \"New Moniker\" (Path: \"HKCU\\CLSID\\{ECABAFC6-7F19-11D2-978E-0000F8757E2A}\")\n \"cmstp.exe\" touched \"CMSTPLUA\" (Path: \"HKCU\\CLSID\\{3E5FC7F9-9A51-4367-9063-A120244FBEC7}\")\n \"cmstp.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{6EDD6D74-C007-4E75-B76A-E5740995E24C}\\TREATAS\")\n \"cmstp.exe\" touched \"Enhanced Storage Icon Overlay Handler Class\" (Path: \"HKCU\\CLSID\\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\\INPROCSERVER32\")\n \"cmstp.exe\" touched \"Sharing Overlay (Private)\" (Path: \"HKCU\\CLSID\\{08244EE6-92F0-47F2-9FC9-929BAA2E7235}\\INPROCSERVER32\")\n \"WMIC.exe\" touched \"WBEM Locator\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{4590F811-1D3A-11D0-891F-00AA004B2E24}\")\n \"WMIC.exe\" touched \"Free Threaded XML DOM Document\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{F6D90F12-9C73-11D3-B32E-00C04F990BB4}\")\n \"vssadmin.exe\" touched \"VSSCoordinator Class\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"kl2ccckn.exe\" (UID: 00065607-00002624) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"WMIC.exe\" (UID: 00077146-00002552) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"WMIC.exe\" (UID: 00077146-00002552) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmstp.exe\" with commandline \"/au %WINDIR%\\temp\\j3h20fsn.inf\" (UID: 00065443-00001832)\n Spawned process \"kl2ccckn.exe\" (UID: 00065607-00002624)\n Spawned process \"WMIC.exe\" with commandline \"wmic shadowcopy delete\" (UID: 00077146-00002552)\n Spawned process \"vssadmin.exe\" with commandline \"delete shadows /all /quiet\" (UID: 00077148-00003180)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmstp.exe\" with commandline \"/au %WINDIR%\\temp\\j3h20fsn.inf\" (UID: 00065443-00001832)\n Spawned process \"kl2ccckn.exe\" (UID: 00065607-00002624)\n Spawned process \"WMIC.exe\" with commandline \"wmic shadowcopy delete\" (UID: 00077146-00002552)\n Spawned process \"vssadmin.exe\" with commandline \"delete shadows /all /quiet\" (UID: 00077148-00003180)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"X.exe\" connecting to \"\\ThemeApiPort\"\n \"cmstp.exe\" connecting to \"\\ThemeApiPort\"\n \"kl2ccckn.exe\" connecting to \"\\ThemeApiPort\"\n \"WMIC.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"2VEV49vrsTLgZa.doc\" has type \"data\"\n \"1c9e4b8f-d655-4f1e-bf1b-36ff217e461a_800_1_.jpg\" has type \"data\"\n \"30d6f7d0c4a6d53c569ab458988dddff001_1_.jpg\" has type \"data\"\n \"200X120_167551_1_.png\" has type \"data\"\n \"200X120_169280_1490021749_1_.png\" has type \"data\"\n \"10000000_714323002097664_3415006124288507904_n_1_.mp4\" has type \"data\"\n \"04332BrndFly_Flyout_770x270_HG_1_.jpg\" has type \"data\"\n \"2BP4ZA20.htm\" has type \"HTML document UTF-8 Unicode text with very long lines\"\n \"32D32XW3.txt\" has type \"data\"\n \"1487517559-148751726432121-500_1_.jpg\" has type \"data\"\n \"1b832edf446081069e640b0af577_1_.jpg\" has type \"data\"\n \"200X120_171826_1518778247_1_.png\" has type \"data\"\n \"300x300_2_.jpg\" has type \"data\"\n \"1R79TWO2.txt\" has type \"data\"\n \"201803151148001091_1_.jpg\" has type \"data\"\n \"117775243_150x200_1_.jpg\" has type \"DOS executable (COM)\"\n \"0314-stormy-daniels-getty-5_1_.jpg\" has type \"data\"\n \"138712_1_.jpg\" has type \"data\"\n \"27397067_1_.jpg\" has type \"data\"\n \"04332BrndFly_Flyout_770x270_Deals_1_.jpg\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"cmstp.exe\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\cmstp_RASMANCS\" (Filter: 14; Subtree: 0)\n \"cmstp.exe\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\CMSTP\" (Filter: 14; Subtree: 0)\n \"cmstp.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 4288361984)\n \"cmstp.exe\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\cmstp_RASAPI32\" (Filter: 14; Subtree: 0)\n \"cmstp.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 2340864)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"WMIC.exe\" (Indicator: \"wmic.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"

\" (Indicator: \"facebook.com\")\n \"

\" (Indicator: \"twitter\")\n \"

\" (Indicator: \"plus.google.com\")\n \"

\" (Indicator: \"youtube\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"X.exe\" opened \"\\Device\\KsecDD\"\n \"cmstp.exe\" opened \"\\Device\\KsecDD\"\n \"kl2ccckn.exe\" opened \"\\Device\\KsecDD\"\n \"WMIC.exe\" opened \"\\Device\\KsecDD\"\n \"vssadmin.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"10f9ad4e9f6e0dc1793be80203b258f8c5114d01cb17307c1b2fdcca37d4edf9.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"X.exe\" at 00065285-00003544-00000033-3599639\n \"cmstp.exe\" at 00065443-00001832-00000033-13964227042759238\n \"kl2ccckn.exe\" at 00065607-00002624-00000033-4088760\n \"vssadmin.exe\" at 00077148-00003180-00000033-13964226974048063","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"X.exe\" queried SystemProcessInformation at 00065285-00003544-00000033-4132752\n \"X.exe\" queried SystemProcessInformation at 00065285-00003544-00000033-4133709\n \"X.exe\" queried SystemProcessInformation at 00065285-00003544-00000033-4412441\n \"X.exe\" queried SystemProcessInformation at 00065285-00003544-00000033-4413460\n \"X.exe\" queried SystemProcessInformation at 00065285-00003544-00000033-4688242\n \"X.exe\" queried SystemProcessInformation at 00065285-00003544-00000033-4689929\n \"X.exe\" queried SystemProcessInformation at 00065285-00003544-00000033-13964227046244087","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"X.exe\" is allocating memory with PAGE_GUARD access rights\n \"kl2ccckn.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.09103244561","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"X.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"cmstp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"kl2ccckn.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"X.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"cmstp.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"kl2ccckn.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"X.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"kl2ccckn.exe\" read file \"%WINDIR%\\win.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"117775243_150x200_1_.jpg\" has type \"DOS executable (COM)\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"kl2ccckn.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"REGASM\"; Value: \"%WINDIR%\\temp\\kl2ccckn.exe\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"Closing the decryptor will not help you to decrypt your files.\" (Source: 10f9ad4e9f6e0dc1793be80203b258f8c5114d01cb17307c1b2fdcca37d4edf9.bin, Indicator: \"decrypt your files\")\n \"All your files are encrypted\" (Source: 10f9ad4e9f6e0dc1793be80203b258f8c5114d01cb17307c1b2fdcca37d4edf9.bin, Indicator: \"files are encrypted\")\n \"You need your personnal key to decrypt your files.\" (Source: 10f9ad4e9f6e0dc1793be80203b258f8c5114d01cb17307c1b2fdcca37d4edf9.bin, Indicator: \"decrypt your files\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads system information using Windows Management Instrumentation Commandline (WMIC)","description":"Process \"WMIC.exe\" with commandline \"wmic shadowcopy delete\" (UID: 00077146-00002552)","origin":"Monitored Target","mitre_attack_id":"T1047","relevance":3,"id":"target-10","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$28","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$29","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"X.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmstp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"kl2ccckn.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"56/71 Antivirus vendors marked sample as malicious (78% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"56/71 Antivirus vendors marked sample as malicious (78% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"42/69 Antivirus vendors marked spawned process \"kl2ccckn.exe\" (PID: 2624) as malicious (classified as \"Generic.Ransom.HydraCrypt\" with 60% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"X.exe\" allocated memory in \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"X.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\cmstp.exe\" (Handle: 540)\n \"X.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\cmstp.exe\" (Handle: 540)\n \"X.exe\" wrote 8 bytes to a remote process \"%WINDIR%\\System32\\cmstp.exe\" (Handle: 540)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"WMIC.exe\" with commandline \"wmic shadowcopy delete\" (UID: 00077146-00002552)\n Deletes volume snapshots files \"vssadmin.exe\" with commandline \"delete shadows /all /quiet\" (UID: 00077148-00003180)","origin":"Monitored Target","mitre_attack_id":"T1107","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"X.exe\" (UID: 00065285-00003544)\n Spawned process \"cmstp.exe\" with commandline \"/au %WINDIR%\\temp\\j3h20fsn.inf\" (UID: 00065443-00001832)\n Spawned process \"kl2ccckn.exe\" (UID: 00065607-00002624)\n Spawned process \"WMIC.exe\" with commandline \"wmic shadowcopy delete\" (UID: 00077146-00002552)\n Spawned process \"vssadmin.exe\" with commandline \"delete shadows /all /quiet\" (UID: 00077148-00003180)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/C vssadmin.exe delete shadows /all /quiet\" on 2021-2-5.18:15:27.203\n \"/C wmic shadowcopy delete\" on 2021-2-5.18:15:27.250\n \"/C wbadmin delete catalog -quiet\" on 2021-2-5.18:15:27.297","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"cmstp.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes backup catalog","description":"Deletes backup catalog files using \"wbadmin.exe\" with commandline \"wbadmin delete catalog -quiet\" (UID: 00071246-00002760)","origin":"Monitored Target","mitre_attack_id":"T1107","relevance":10,"id":"target-80","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]}],"incidents":[{"name":"Ransomware","details_count":2,"details":[{"detail":"Detected indicator that file is ransomware"},{"detail":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"},{"detail":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"}],"sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]}]},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":134,"dropped_files_count":0,"extracted_files_count":160,"files_written_count":97,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["filecoder","malicious","ransomware"],"sample_flags":["Multi-Process","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"6021032cdae5120885272d56","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"RansomX","submit_name":"X.exe","analysis_start_time":"2021-02-08T09:23:58+00:00","indicators_count":{"informative":18,"suspicious":20,"malicious":9},"tags":["Multi-Process","Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"601d8a11d14a0766da5607ab","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Razy","submit_name":"file","analysis_start_time":"2021-02-05T18:10:33+00:00","indicators_count":{"informative":19,"suspicious":19,"malicious":11},"tags":["Multi-Process","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}],"processes":[{"pid":3712,"ppid":0,"name":"file.exe","command_line":"","sha256":"10f9ad4e9f6e0dc1793be80203b258f8c5114d01cb17307c1b2fdcca37d4edf9","normalized_path":"C:\\file.exe","uid":"00064711-00003712","icon":"$2a"},{"pid":3276,"ppid":3712,"name":"cmstp.exe","command_line":"/au %WINDIR%\\temp\\vjjl252a.inf","sha256":"ae11b4cd277731ba5d218a2fdb22d19ea5f2780256bc481e86acbd8ed4ccf1c4","normalized_path":"%WINDIR%\\System32\\cmstp.exe","parent_uid":"00064711-00003712","uid":"00064940-00003276"},{"pid":2392,"ppid":0,"name":"dgrgbbjm.exe","command_line":"","sha256":"430640830f3db460321a47832207ee53a456b05cb1b49265df7aa36e83ce786c","normalized_path":"%WINDIR%\\Temp\\dgrgbbjm.exe","uid":"00065040-00002392","icon":"$2b"},{"pid":2436,"ppid":2392,"name":"cmd.exe","command_line":"/C vssadmin.exe delete shadows /all /quiet","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00065040-00002392","uid":"00071231-00002436"},{"pid":2824,"ppid":2436,"name":"vssadmin.exe","command_line":"delete shadows /all /quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00071231-00002436","uid":"00071239-00002824"},{"pid":2904,"ppid":2392,"name":"cmd.exe","command_line":"/C wmic shadowcopy delete","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00065040-00002392","uid":"00071233-00002904"},{"pid":2880,"ppid":2904,"name":"WMIC.exe","command_line":"wmic shadowcopy delete","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00071233-00002904","uid":"00071240-00002880"},{"pid":2912,"ppid":2392,"name":"cmd.exe","command_line":"/C wbadmin delete catalog -quiet","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00065040-00002392","uid":"00071236-00002912"},{"pid":2760,"ppid":2912,"name":"wbadmin.exe","command_line":"wbadmin delete catalog -quiet","sha256":"be527c6085cd944097de35b9740fc4dd24d455567bec596e9cc300d70c5a392d","normalized_path":"%WINDIR%\\System32\\wbadmin.exe","parent_uid":"00071236-00002912","uid":"00071246-00002760"}],"all_imported_dlls":["rpcrt4.dll","ntmarta.dll","WindowsCodecs.dll","ws2_32.dll","framedynos.dll","KernelBase.dll","profapi.dll","cmdial32.dll","mscoreei.dll","cryptsp.dll","cmstplua.dll","wow64win.dll","msftedit.dll","wbemprox.dll","vsstrace.dll","version.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","setupapi.dll","user32.dll","mscorrc.dll","comsvcs.dll","imageres.dll","wow64.dll","uxtheme.dll","netutils.dll","iertutil.dll","System.Configuration.ni.dll","wbemcomn.dll","comctl32.dll","System.Core.ni.dll","winnsi.dll","wow64cpu.dll","crypt32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","lpk.dll","rpcss.dll","sspicli.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","cmcfg32.dll","rasapi32.dll","devobj.dll","GdiPlus.dll","urlmon.dll","wtsapi32.dll","usp10.dll","Wldap32.dll","IPHLPAPI.DLL","cmlua.dll","api-ms-win-core-synch-l1-2-0.dll","System.ni.dll","advapi32.dll","userenv.dll","clr.dll","VxSSL64.dll","srvcli.dll","gdi32.dll","msxml3r.dll","psapi.dll","cscui.dll","api-ms-win-core-xstate-l2-1-0.dll","FileSyncShell64.dll","ntshrui.dll","imm32.dll","wininet.dll","EhStorShell.dll","propsys.dll","slc.dll","ucrtbase_clr0400.dll","oleaut32.dll","secur32.dll","vssapi.dll","cryptbase.dll","rtutils.dll","cfgmgr32.dll","mtxoci.dll","msxml3.dll","ntdll.dll","mscorlib.ni.dll","ole32.dll","clrjit.dll","advpack.dll","RpcRtRemote.dll","normaliz.dll","cscapi.dll","mscoree.dll","bcrypt.dll","nsi.dll","cscdll.dll","System.Drawing.ni.dll","System.Windows.Forms.ni.dll","vcruntime140_clr0400.dll","rasman.dll","System.Xml.ni.dll","ieframe.dll","shlwapi.dll","nlssorting.dll","api-ms-win-downlevel-version-l1-1-0.dll","atl.dll","sechost.dll","cmutil.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","msvcrt.dll","shell32.dll","rsaenh.dll","apphelp.dll","clbcatq.dll","kernel32.dll","msvcp110.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","msctf.dll","dwmapi.dll","msvcr110.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","credui.dll","System.Drawing.dll","mscorlib.dll","System.dll","System.Windows.Forms.dll","System.Xml.dll","blb_ps.dll","LoggingPlatform.dll","wsock32.dll","vss_ps.dll","cabinet.dll","winhttp.dll","Telemetry.dll","System.Core.dll","diasymreader.dll","System.Configuration.dll","winbrand.dll","webio.dll","FileSyncShell.dll","xmllite.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"2VEV49vrsTLgZa.doc","sha256":"962a690d2b1ec6be803e0df559573726aab33fdd1b1ab1ff0af5272a3780e26b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"name":"1c9e4b8f-d655-4f1e-bf1b-36ff217e461a_800_1_.jpg","sha256":"1365e5e5b200594f7e006687a0c1a45a34049db25c56c6e5555df8204d54a117","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"name":"30d6f7d0c4a6d53c569ab458988dddff001_1_.jpg","sha256":"136db77bf6b2bc3dd7bbf3d31d7796c76718c48dfd75ff2eac7aeaa2faf29878","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"name":"200X120_167551_1_.png","sha256":"a0acb21978512451dbbc8a9a4dd742d43ce31198f0fad25af93ff1144f9a2379","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"name":"200X120_169280_1490021749_1_.png","sha256":"07643c93be2e2de0ae59ed4c3f3ce934186df6f2ca8a6cd2224f7a359d61eb18","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"name":"10000000_714323002097664_3415006124288507904_n_1_.mp4","sha256":"dfed3d7e3cc6ceff87bd089481b0f0605f7838cfc72126a9ed0361d362b4de63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"name":"04332BrndFly_Flyout_770x270_HG_1_.jpg","sha256":"053e8e1ead579c9a9f8659757306503f73c1f1020b60cf433945f8b1cfba0301","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"name":"2BP4ZA20.htm","sha256":"f25841ad484445693712e2770402ac86f9b9c0024b61c6db95246ae67d700d80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"name":"32D32XW3.txt","sha256":"d83214ddc264ca93a776f643eb907b867cea39f1f88140d5928250bdfd9066d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"name":"1487517559-148751726432121-500_1_.jpg","sha256":"42e4d87709733b2c308d0c000f70fa87692f313f89f8dae36f9d50659b335f46","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"name":"1b832edf446081069e640b0af577_1_.jpg","sha256":"02e4de8dfd8c8dbbbd1d90077dbdb9a546d287d4029cad0f12cee7611821fb17","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"name":"200X120_171826_1518778247_1_.png","sha256":"3ccb728bf661b949cae736e3baa528027103c866b921f6c3ca092890f63bcde5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"name":"300x300_2_.jpg","sha256":"5da6d274be556668ebcaa13f67305169936f4267e5148dc81c9a2019c2f6f08f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"name":"1R79TWO2.txt","sha256":"206423439255f525f05fd21a1cc8ae5c6cd7b2bcc478d1e32346402f39dfe920","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"name":"201803151148001091_1_.jpg","sha256":"9a2c064176f96c0d3d4721d6c0c3274ab4fc02a72574ada39d8d225df2f12295","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"name":"117775243_150x200_1_.jpg","sha256":"83f0a77a575cb55ae97bb2ce63ffc679bc7a12f69e1267156693a6f9372968fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"name":"0314-stormy-daniels-getty-5_1_.jpg","sha256":"71e87c4f69ec13b5e9f44f55d9618c941c614fcc3c12d6f7bd4876f2f58b4b16","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"name":"138712_1_.jpg","sha256":"81f23a8b4e8f5adde9febbda3149ceccf971d958b8620053b0fe75fad53e6857","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"name":"27397067_1_.jpg","sha256":"e1d1d6e380e2356e3a04bcbeec0e4b0b7bc89a7dbf26bbb399063304bf86f876","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"name":"04332BrndFly_Flyout_770x270_Deals_1_.jpg","sha256":"cc216e82ed9a409449db04c78d022a936bff305ff5363d1799c5a436ac2c167d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"name":"af.txt","sha256":"3b18639e1cb8f3fe394306d83fdaf83790f85b782d166c6de65cdd95dc752b9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"an.txt","sha256":"91b5dec3d2de7a760cecd6fc0e83eecc25a38fed363207489897cd1838aa7871","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"ar.txt","sha256":"9070abe6aaf9ccd1c6eb3f01188c7d14cfa4fc668bcbdf2887e966a299b736d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"ast.txt","sha256":"375061973996cdc31a31c0cc8445ec8996ece3f6b530839936b03ecee11b3d8f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"az.txt","sha256":"07e71f3891b1c8e1edd2cac964625efa67b29c48ec9d96175e46c78bf1beeb4e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"ba.txt","sha256":"f00ed1ef9dd532509c21cf318e697294fde14a522efe7750d160d5dc54da94d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"be.txt","sha256":"bb1d2b01a0743071eb984e483363975749ae6ce6530b259ef88f8f6e3cfeef65","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"bg.txt","sha256":"f448c574b7890802f8ad4c86adb2bc2677d315722be14e37ce181dcd41a2fd7f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"bn.txt","sha256":"9a63df308063a75686196364c95390a5b56801d7c8ac52ad5f19e585c91140db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"br.txt","sha256":"63dc91712edc30e88448fdb62cc9791d991ffb09ea1d5023866597022f9dcf23","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"ca.txt","sha256":"ca4e09393c89a51bb4fbc95e8115f917cc5d282a7fee8b9a8ac4c796b86a42c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"co.txt","sha256":"4103d13f2793e13934f79c68a7985d933e3393e31b8bb8abcdca16049a6627c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"cs.txt","sha256":"fb0f62beb37a0c4027b1251cec0e101a146718e6c000a61efd18c184c09ee7e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"cy.txt","sha256":"f2d95809ff36ccd4d59bc4e31a0497f51dc42d2cc34689d9350abfd161a95730","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"da.txt","sha256":"cd2a0142429a232e790d12688a215e3d54ca499acc0d1f18552bfb2a6cfebdb7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"de.txt","sha256":"9e7df515fc4ebe36c6cd66c249a5a62b24b92104d7a65c4125f6c63bd19ba405","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf","sha256":"7969bb0fe2834a7ebd6f92aafaffdab5be78776a7b333dd095fbd6815fda6481","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"COPYING.LGPLv2.1.txt","sha256":"19a2bdbbded79c94a0f2bd5a65dba704f293e0fc66a8762c2b6257335a1a8f02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"AdobeID.pdf","sha256":"0180844668c0370c26f9bd8a89a802d73b1c1c2f5aa1d131876a8e7be7b7efbe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"branding.xml","sha256":"bda69e93c8f8f01589128500f54c2a53a4d4e186843e901a27a6a52788773e72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"autoexec.bat","sha256":"bc7d4e4e0eec6be531c089d8666a34bc8e4a49d85f8cbedae4000c8cf49c8862","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Command Prompt.lnk","sha256":"3908a92f905fb0b75e3163659a0ee6ed52323907febc99942bb741dff37e1620","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Company Grid Letterhead with border.docx","sha256":"c5642d5a312d3822e406b44ce69d816d0bf26ad498fdcc78fb74557e1c917fa3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"dbpilNNNF.doc","sha256":"e4a6bcf1df552467c8e63166e3f93fe047984c9502fa92ac5513e01f9858da63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Autumn Leaves.docx","sha256":"7c1808589a85d226b29537f7ca4f715c8d827d675bab7a107517ada82a725f5d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Blue Stamped Photo.docx","sha256":"50aef5e8bc890191aa404d3366a38f9b0703adb3344c74ffef0f50bfcb9116f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Abstract.docx","sha256":"f4c7cca9743f38b19ca223304cb29dd480ca98c4c80dda361c3217fb0fb249fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Component Services.lnk","sha256":"11f43eb0633512696db9e29815e65354a7984d38c85dac98b9de0efa1075d3b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Data Sources _ODBC_.lnk","sha256":"1f6eb88a0e60a0f42bfc66564824d9839ad0732558dab0a0af84c77d84052250","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Blue Tabbed Folder.docx","sha256":"39b88711c684428ca470a919ba8215a7b11f22f412711b5665d8c30897c7b65e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Calculator.lnk","sha256":"2d6189c454aefc377af45e51b076acc1d52e9ee5a2cb60b01ba34a6cc18b980f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Acrobat Reader DC.lnk","sha256":"355923cbc8781a0b6e7b6bd5f6dd3052e4d5130e8622aea311689523789e473c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Bold Heading.docx","sha256":"652a8d4c5c4e2f4244155d8f043d2e6f14c7d12a1a2383cc0d2c1294eb824621","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Closing Costs.xlsx","sha256":"3d7f3efa854e43b6281d40349fd538ae72869043f3399c8bc6facc85d8cc9491","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"A80f.doc","sha256":"8321582596d483f41255b1e3ad1ada95cb0cadb0ed5dfc649f5f879a9a221717","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Childrens Activities.docx","sha256":"58dd01d74300a0846bb8052ad449108c2177a9e9bfe65db7215311acbec58034","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Business Strength Analysis.xlsx","sha256":"aa77cb292b79dae207ec36df7fbb12454220dc56b56830f72ba3d801762bc94c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Cash Flow Sensitivity.xlsx","sha256":"cc8258092e39b49bdbbd44049162ae6c60a513bad84d3e0ae2f0fcf47861f484","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Break-Even Analysis.xlsx","sha256":"6043b24232f8c1c833b4c6d6c10ff8d85211b6cfd958aa735efefe8f5854407f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Appearance and Personalization.lnk","sha256":"47e428ac578cbadd5409313d88ea51f58e4b678e143e21a766a5c44d59286f50","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Browse Extras.lnk","sha256":"3b5a446654a6d6a6a896eb1ee5826583f455f38f4ec8f56ae7469fac66b0c518","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Candy Hearts.docx","sha256":"ad8d60ebbacfed02fecabc2542561110c81e48ed061c7a5752b808dd0ea75929","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Conservative Gray Memo.docx","sha256":"014ecda5af47d61c7b66591d66e39daf87a895c2be92c17871721b18392137c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Biweekly Mortgage.xlsx","sha256":"8c657179fd00189d4506380b25742acf41d8f2f0aace58a2212830e282c6e807","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Bill of Lading.xlsx","sha256":"c801e511ff7d9e9930254050030c9609fc865460fc4da4ff2d5ab2da0e38887a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Bold Blue with Accented Touch.docx","sha256":"b8528d97aa465474ccb37ae4a7bff0e786266e7a999021d469d184a91c652d53","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"activate.bat","sha256":"b482f085ccf258c5d50ca9e9b9bfcdc084552ba8860c019799f26ef83a7bad65","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Company Grid Envelope.docx","sha256":"d5ed49a8d03811954e5fcb74317d312478ff6bec0aac15ce44a37506d1ce430f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"dblook.bat","sha256":"de002c036082249475caf9365d3fcca4d39adaee9af1729b8bc1173ea895a195","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Bold Hanging Tab.docx","sha256":"9731675c09209c5ba490b8ed888ba0cdca0be249196e06f698a4f5b7b534035b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Basic Invoice.xlsx","sha256":"44a578be5bee652a8e179502a5cfd070b1150f06f8c7546155a7fee9825ab124","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Create Recovery Disc.lnk","sha256":"f1de654d7fe5925977c3c333f18ec6c72ccfb5fcb3de718423214079cbc3c595","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"7 Year Balloon Loan.xlsx","sha256":"2dba5c1b6f6fe4fa54df6f0c5215819685d2588dae49a7a5af835e8f36d60b43","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Card with Rose.docx","sha256":"09cc59a5ffc801c72550ddd6e1a1cd669445683a087839fae201a1ffd53931a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Alternating multi product.docx","sha256":"d1db4afab7008b9689630d178dc15ed8fc115a8101545137b0448f1c50c17cee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Database1.lnk","sha256":"9289196cd78115ac89826e6957be4d096881ee227eba4df3d3d0cca91376bae9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Bar Graph Socket Bifold Brochure.docx","sha256":"e52d8e31855719d4ea2fda96116870807220d85fba149d3cc49fdc95a970c46a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Beveled Layout.docx","sha256":"b9125c286505c340c5655d850bfd8101adea742b029d0aebc97f3358c8433879","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Character Map.lnk","sha256":"a242d3c27e0576d6479c9435f91190ec91d185933798a95c69ae8cc383b7a296","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Black And White Poster.docx","sha256":"baa93773fae2529879f239d552def9544c4ee747a1d9b5c8bfde1eea08a133ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Buy vs Lease Car.xlsx","sha256":"deeae3850d1daa8ccd2daae9776c41f31c5ea6065c9a20e8f229f08d0e0b0be8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Ce4IYQD.doc","sha256":"bfa4eed1c63bba08b761b1dfbe372f1a0fa042bec377686b5db49d4a9bd54779","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"bdftops.bat","sha256":"185a232028262904230d8e2580e9e31dad5017f6185e1e7506ed817c51369b2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"5 Reasons Poster.docx","sha256":"6e06859c38fb103241bb614e605d912cd1d570473e868681a612567ad30eaa88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Dark Red and Gray.docx","sha256":"76e6b0be8953411d6bb30affd8e32df7cec7e1f5a2924c676b5eb2f6e8828e26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Compile Script to .exe.lnk","sha256":"04f23b46703995c16395acf92c4464c4be90929dfb56406bc9ac07fdff8c6ef1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Blue Green Bubbles 10 image Ad.docx","sha256":"c2674444ece30486b5b4233bbffaeb40ff6de012cbc6c35f8ce7e01d00641fed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"All Control Panel Items.lnk","sha256":"e036f7f412b6777055a2802e9009ae229f98261b9567f0370e7c0e12b709003f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"0YdED8h4YnKljVf.doc","sha256":"4721435c7e5771661283e079f08bce05c8bec7dfd029fbb77b2404862c4b0e14","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Bordered Attendance Award.docx","sha256":"561580f2e2a779c91a6f67433170a6213dbd042e5291a63c63a0adc18e9f77b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Clean Look.docx","sha256":"97b939e2de6dc44242e947244f17221d286078e4f1228b2f2437c14f082b7a6a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"DcNNjRAkEraNbP.doc","sha256":"c5cf5ac183b60519c56c53dcc8aec841ea3066c480d2ef05fdae28db2c2395bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Black and White and Yellow Bold.docx","sha256":"a7cb41182692c58b7302912bbd4c95c8f30a2fca214ca87b2c76c79053d1a98c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Auto Expense Report.docx","sha256":"062f26197434d3be43961b771107eb560e3a06d0160c90d0aee982499ec68f04","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Credit Reminder.docx","sha256":"5b25b20b25a1b15040b1e481fb60cb34c67989e08c4f39d3e9f6761104297421","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Bold Red Black Annual Report.docx","sha256":"49fbddf1b4d9e20d1876f1480c06cfb79cab258938f144711d149c118e793bf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Beige Cover with Olive Interlude Annual Report.docx","sha256":"c5816796c0e04d1109c9c2cd2980a318ebb031b376a8a5a4c4f3177f2f6e97c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Bold Blue Curve.docx","sha256":"cb2776b88149d1278df7608865a915ce866c68e78020b2106f7626ed3109d7bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Default Programs.lnk","sha256":"271efb2dbea45c8a0f0940a7d3789fde03dcd546bb946bf5a25726ea93a280bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Balloon Payment Loan.xlsx","sha256":"636fa566001793a4c5e742f4e3bd464fb264c9754bee6500e6cc340ac3f06be4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"deactivate.bat","sha256":"1b585fc9daebaf17f2d71666b297cf0c38f91fc769ab0f6a181f60b36f9182fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"computer.lnk","sha256":"d5b12d6a34086a8c7bcb125892268fa008f596adcdcc6e28f59f79ea8bc2574d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Bold Photo Blobs in Red and Gray.docx","sha256":"b4693c567f4f694f440cbd879e14e2037fddaec225156e1a394a960da47939c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"7-Zip File Manager.lnk","sha256":"01ad6c4f113ca6f680723205aa77b0fbea6a4d12de04fda707c7ea5ce1ca7ba1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Daily Planner.docx","sha256":"51551b3621facfd01c25d51d23091664bb43158a8270d8fe2fa9d5ffd5e629bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Brushed Steel Bifold Brochure.docx","sha256":"4c7b03eb57fec0c1c9d12af9bea64b4fd1889906b1bf838fbdfc4ec9fb729649","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"AutoIt Window Info.lnk","sha256":"5ef01ef0767d069ff5f53f887ba8a33156f555462ebe303991a1a0b73144ebd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Bold Picture and Date Annual Report.docx","sha256":"e1d90deb89c41e5aea1572ce81d11cd6828ba6aa8d9a147393ada69f8b711964","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"AutoIt v3 Website.lnk","sha256":"47a9178108635073d07baa728ec1b74202db57f8fd1cb051eddce151db866d2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"401K Reallocation.xlsx","sha256":"70b1017e0af23999b16360e3512cc45b859b941605493e75dc069a369d6b18aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Center Focused Picture.docx","sha256":"54191fa5c9ad122a05088b97f397fb79dde1e6e55727fef283c86c3d10a79e0f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Construction hard hat.docx","sha256":"380343e83b11f3e7b2b3b86dfe2a455b4dcb05adaa8666ff61f9b49fdd92d358","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Acquisition Cost by Campaign.xlsx","sha256":"a6a0876102ce66ea8f24291bbdb1a4d100ceeb06211315e4ad75ccc28b251c1a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Clearly Separated.docx","sha256":"9b980ed25b900f3e8cad67ec7e950cbd4488c7a38ec0acea10097d663df3427e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Contrasting Pastels.docx","sha256":"16f854d6b6c993ea74c98da8b16f88338df9e3c416942fcd0f1a67ba203cf2fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Check For Updates.lnk","sha256":"b15ab90a37d669ab71ea4aa6ec23dc86b7256c17e8f6ae2b86ced7b68e31f643","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Bordered President_s Award.docx","sha256":"d17a34bb983a60ebeb18988b641449478c1a66d8edd42c242d36e1148db6363d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Configure Java.lnk","sha256":"b953647cbfe9625fb4d2203223ba1ee2629840a89f3bf47e0363050a0e2376a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"CollectOneDriveLogs.bat","sha256":"90f6f1ab22625be1ae3c9314a70596670e78c33ae411600ccf42ae5da198a413","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"AutoItX Help File.lnk","sha256":"00dd5bdb8390af053508a438209044098c9f3a2862f91b9e8f6523e287343598","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Backup and Restore Center.lnk","sha256":"4cb761939fd582a05fe5a648f7576e796c219f888b3ca2692897ed7582b7eb1e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"24 Month Sales Forecast.xlsx","sha256":"76fefcd8736344fa4139ffc5bf83278f71262fb036cad65bc66047394f4f1467","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"cUJpjDsZO.doc","sha256":"2c20d66434355350588ab28018260530262d55b0cc743d14ab94e523c70020ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"3CrsgVxPsB.doc","sha256":"913d38f1cc6e7de5e6b40da802418b6c84e6eaaf941a12614271b2843b6b3250","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Contrasting bevel multi product.docx","sha256":"ef21c241c01bd4aa6361c3f9fb87bd32f5a6b32566807d8f60d8f87031fef980","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Basic Agenda.docx","sha256":"a0bd97a12123465b3b90d7e6b53194937109beb3ff987aa6bdb697ae8a30b55c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"123 Sockets Bifold Brochure.docx","sha256":"85a6bbf730bf70f395aa6a66f16bfff3d67080359180d232697b515e5db3a882","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Competitor Analysis.xlsx","sha256":"4b0d760b370c937869acf28b0f478f23ff5f1a753a3e3e6ed2348332c788c67c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Blue Bordered Modern Photo Frame.docx","sha256":"9b62137a011420d4930250d134f0dd89ffd67ad5e3cd58d401303001be6cdc2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Contrasting Arrows and Blocks.docx","sha256":"28232e93b5330ab1cef34c4ddc1b964bb058a05923693f90b8ec49bac543a867","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"CM and BreakEven Analysis.xlsx","sha256":"3c73e83caa7502cbb2b92ce6fba3ff9c1dce30211bcb0b15abf6a13bd3e9c7ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Average Selling Price.xlsx","sha256":"941acf2ce01676e8fb634a114960d780c42e3f24721245cfb7abc7a82ad20270","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Award of Merit.docx","sha256":"d056c44720c702ac7fbaec4d4d353e9a938affa1c1eaba23f010b27846d37ce3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Cute Baby Greeting.docx","sha256":"c1ca636cd87ef33e141311eaa1523593dd7f2c42a1ca843459e92826649b2025","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Auto Expense Report.xlsx","sha256":"fbe5c3024017183da07e96c1fb58fd16de04210cf5026e439d5f5628e95f4475","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Company Grid Letterhead without border.docx","sha256":"f6c48607bedf1921b3de411f9b51346c93b4b9e553fb7df5b25468d52b72847a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Bold Announcement.docx","sha256":"73266148a34d62b708f02705f0f562f6e35b10061c63bd1345d70f5cbf6c0c37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Beveled Blue.docx","sha256":"9dc6c1c0e1b4a3497e8f61acff21082596e79f225b9fa24bae776b0c9afbbc8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Bordered Leadership Award.docx","sha256":"d4c254e981b7a300035619be22d1cdaeea67ef3cb51c382e00ac0b3f40d46081","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Bold Picture Top.docx","sha256":"4f6adc83bbed5d5d18369724816fc11e95bd27f3e32ac2f035f66e9cc98cc2ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"AutoIt Help File.lnk","sha256":"8daecbad3d4534cc7c60fcc8f7766ea0ab57050bda6e89572a33262924ec302d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"ancpyWMibIM3tcgy.doc","sha256":"888b19dd3b2d73e9f615307a6afca3845cf5d51234da5748f575d33e6327d0f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Daily Time Sheet.xlsx","sha256":"acd2b4c681105a754ebd80d78aba8de22a699f056c1f83f3e2263204b4d56226","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Control Panel.lnk","sha256":"eea4699341afbcec777ce83a8c36855dba0c22c1e2ecdb49c6998d646da2ab59","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"7-Zip Help.lnk","sha256":"2fdfb05f911a44706588f53f00982795b51cde6e53bb11a97d8a77fb7d051e79","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Critical Success Factors.xlsx","sha256":"cef9ae5966140a3c1b2bbc73cba6a5bd09a02ff1358a3f1184f466d08839edaf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Conservative Gray Fax Cover.docx","sha256":"72d284cbc22b6c4f70ee2007b0f8a1fcb676b3ec4cb41ee111567ffea8605528","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"2 photo Red and White Panes.docx","sha256":"611462cb5af4ffb855cb17cb3727a081beb18b6485f83a73cc3dc190105b7482","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"About Java.lnk","sha256":"e6635d46ea52b85ccf0cf5a72af22eafcd489639556780f952abf71126a4875c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Cash Budget.xlsx","sha256":"e1a4f3416c6a51d769d0b10b7fd07c96b9410d9de17bc870b074544ad8c4f5d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Circular intersection.docx","sha256":"d6f08c1ea9230ad8c4b0e99acbaf2bb838c0cc1248ddea883345407fdb2af20f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"College Monthly Budget.xlsx","sha256":"be8408be5e5f2c7b0a96ec5390040094f10fdd20e44d93b56929507b25c7186f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Balance Sheet.xlsx","sha256":"38a79c9d943f755bab159949a3f55501f7238bbf82a4438cae6b97ebbef41609","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Computer Management.lnk","sha256":"bf849dbe152725a9f995c321fc8768e6db1064e10acc25eeb4f610de20f873a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Beveled suspense.docx","sha256":"92df28646924b0dbf00c58b97857a51e85f7744663e3bf6f9ac79df9be158f21","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Business Acquisition.xlsx","sha256":"3a7fe596be9a6fd53b876dd910726458be660a83a7c6c73a3553bf8c335643b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Byf3DiB7aX.doc","sha256":"711da3aa7d5f5f4ac16317d75c4ec414a000d9f21578031fab8e843f4dc5ac71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Bordered Efficiency Award.docx","sha256":"a9d645138914c68b3808a0d3cede00488c1e27273d44e3b7a3f3e157f30e1f2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Absence Report.docx","sha256":"01e04e2ba38c793e3d1834bcfa019e20a5632f08ca62739631549d0ce6bfd771","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"A Walk in the Garden with Mom.docx","sha256":"fbd94e7190461d8ae9b140e5213638ca82041cc2a8f9979a3070c63f3696363f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]}],"files_written":[{"path":"%WINDIR%\\Temp\\j3h20fsn.inf","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Network\\Connections\\PBK","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\temp\\Crimson.cmp","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\SysWOW64\\wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\SysWOW64\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"C:\\X.exe.config","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"C:\\X.exe","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\temp\\kl2ccckn.exe.config","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\Temp\\kl2ccckn.exe","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\47e0be927382f169f5de470fab0ceb7d\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\43d86904e41b891e07c2ce8a20996e2c\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\617299d2bd5dcfe094cedface0c39d1c\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\assembly\\pubpol201.dat","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\c9a4cbc00f690a9e3cddfc400f6e85bb\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\0b2f69b43a576b9edcc807a30872bd91\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\2c3c912ea8f058f9d04c4650128feb3f\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\f7568d7f1b9d356f64779b4c0927cfb3\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\System32\\advpack.dll","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\System32\\en-US\\advpack.dll.mui","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\31fae3290fad30c31c98651462d22724\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\15af16d373cf0528cb74fc73d365fdbf\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\Fonts\\tahoma.ttf","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\Fonts\\msjh.ttf","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\Fonts\\msyh.ttf","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\Fonts\\malgun.ttf","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\Fonts\\micross.ttf","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\Fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\Fonts\\msgothic.ttc","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\Fonts\\MSYH.TTC","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\Fonts\\MSYHBD.TTC","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\38470d5ed01fd95e48dcf4e1b0b4774e\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Configuration\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Configuration.dll","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\8089ab42d28c269586b8d72c8e01701c\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Xml\\v4.0_4.0.0.0__b77a5c561934e089\\System.Xml.dll","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\SysWOW64\\crypt32.dll","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Accessibility\\dc6f17d3b5a947b693fa471cfd23bbc8\\Accessibility.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\Accessibility\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Accessibility.dll","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\System32\\en-US\\cmstp.exe.mui","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\System32\\cmdial32.dll","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\System32\\en-US\\cmdial32.dll.mui","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\System32\\wininet.dll","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\System32\\en-US\\wininet.dll.mui","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\System32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\5d0c037297cc1a64b52ce43b45c2ac2e\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Network\\Connections\\PBK\\_CMPhone","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\System32\\en-US\\wbadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\Temp\\vjjl252a.inf","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\Logs","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\System32\\wbadmin.exe","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"C:\\file.exe.config","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"C:\\file.exe","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\assembly\\pubpol247.dat","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\System32\\crypt32.dll","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\temp\\dgrgbbjm.exe.config","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\Temp\\dgrgbbjm.exe","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\System32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"path":"%WINDIR%\\System32\\cmstp.exe","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\CMSTP\\","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\NETWORK CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Connection Manager Profile Installer Mutex","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"Connection Manager Profile Installer Mutex","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6021032cdae5120885272d56"},{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"601d8a11d14a0766da5607ab"}]}]}},"report_ids":{"sandbox_job_ids":["6021032cdae5120885272d56","601d8a11d14a0766da5607ab"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 10f9ad4e9f6e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 10f9ad4e9f6e…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 1/1 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/10f9ad4e9f6e0dc1793be80203b258f8c5114d01cb17307c1b2fdcca37d4edf9"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 10f9ad4e9f6e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 10f9ad4e9f6e…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 1/1 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/10f9ad4e9f6e0dc1793be80203b258f8c5114d01cb17307c1b2fdcca37d4edf9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 10f9ad4e9f6e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 10f9ad4e9f6e…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 1/1 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]