24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dump:Generic.Ransom.AmnesiaE Sample 26690dae115f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 26690dae115f…. Malware family: Dump:Generic.Ransom.AmnesiaE. Threat score 100/100. 21/25 AV engines flagged this file. 14 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa","keywords":["Malicious","Dump:Generic.Ransom.AmnesiaE","malware analysis","sandbox report","threat intelligence","26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa"],"about":{"@type":"SoftwareApplication","name":"voidcrypt.exe","applicationCategory":["peexe","executable"],"identifier":"26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dump:Generic.Ransom.AmnesiaE","antivirusDetections":{"malicious":21,"total":25},"behavioralIndicators":{"malicious":14,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T820,Process "net.exe" (UID: 00065021-00002824) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00065039-00002744) was launched with missing environment variables: "PROMPT" Process "net.exe" (UID: 00065044-00003580) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00065060-00003608) was launched with missing environment variables: "PROMPT" Process "net.exe" (UID: 00065065-00003912) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00065086-00002976) was launched with missing environment variables: "PROMPT" Process "net.exe" (UID: 00065093-00003596) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00065114-00002960) was launched with missing environment variables: "PROMPT" Process "net.exe" (UID: 00065119-00002544) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00065139-00002576) was launched with missing environment variables: "PROMPT" Process "bcdedit.exe" (UID: 00065145-00002448) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00065160-00003020) was launched with missing environment variables: "PROMPT" Process "bcdedit.exe" (UID: 00065166-00003304) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00065179-00003528) was launched with missing environment variables: "PROMPT" Process "wbadmin.exe" (UID: 00065184-00003604) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00065270-00002984) was launched with missing environment variables: "PROMPT" Process "net.exe" (UID: 00065275-00002956) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00065293-00003436) was launched with missing environment variables: "PROMPT" Process "net.exe" (UID: 00065298-00003520) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00065317-00003620) was launched with missing environment variables: "PROMPT"26:T829,Spawned process "cmd.exe" with commandline "/c net stop SQLWriter" (UID: 00065016-00002472) Spawned process "net.exe" with commandline "net stop SQLWriter" (UID: 00065021-00002824) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop SQLWriter" (UID: 00065023-00003332) Spawned process "cmd.exe" with commandline "/c net stop SQLBrowser" (UID: 00065039-00002744) Spawned process "net.exe" with commandline "net stop SQLBrowser" (UID: 00065044-00003580) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop SQLBrowser" (UID: 00065048-00002768) Spawned process "cmd.exe" with commandline "/c net stop MSSQLSERVER" (UID: 00065060-00003608) Spawned process "net.exe" with commandline "net stop MSSQLSERVER" (UID: 00065065-00003912) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop MSSQLSERVER" (UID: 00065070-00002716) Spawned process "cmd.exe" with commandline "/c net stop MSSQL$CONTOSO1" (UID: 00065086-00002976) Spawned process "net.exe" with commandline "net stop MSSQL$CONTOSO1" (UID: 00065093-00003596) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop MSSQL$CONTOSO1" (UID: 00065096-00002444) Spawned process "cmd.exe" with commandline "/c net stop MSDTC" (UID: 00065114-00002960) Spawned process "net.exe" with commandline "net stop MSDTC" (UID: 00065119-00002544) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop MSDTC" (UID: 00065122-00002640) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00065139-00002576) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00065145-00002448) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} recoveryenabled no" (UID: 00065160-00003020) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled no" (UID: 00065166-00003304) Spawned process "cmd.exe" with commandline "/c wbadmin delete catalog -quiet" (UID: 00065179-00003528)27:T829,Spawned process "cmd.exe" with commandline "/c net stop SQLWriter" (UID: 00065016-00002472) Spawned process "net.exe" with commandline "net stop SQLWriter" (UID: 00065021-00002824) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop SQLWriter" (UID: 00065023-00003332) Spawned process "cmd.exe" with commandline "/c net stop SQLBrowser" (UID: 00065039-00002744) Spawned process "net.exe" with commandline "net stop SQLBrowser" (UID: 00065044-00003580) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop SQLBrowser" (UID: 00065048-00002768) Spawned process "cmd.exe" with commandline "/c net stop MSSQLSERVER" (UID: 00065060-00003608) Spawned process "net.exe" with commandline "net stop MSSQLSERVER" (UID: 00065065-00003912) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop MSSQLSERVER" (UID: 00065070-00002716) Spawned process "cmd.exe" with commandline "/c net stop MSSQL$CONTOSO1" (UID: 00065086-00002976) Spawned process "net.exe" with commandline "net stop MSSQL$CONTOSO1" (UID: 00065093-00003596) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop MSSQL$CONTOSO1" (UID: 00065096-00002444) Spawned process "cmd.exe" with commandline "/c net stop MSDTC" (UID: 00065114-00002960) Spawned process "net.exe" with commandline "net stop MSDTC" (UID: 00065119-00002544) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop MSDTC" (UID: 00065122-00002640) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00065139-00002576) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00065145-00002448) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} recoveryenabled no" (UID: 00065160-00003020) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled no" (UID: 00065166-00003304) Spawned process "cmd.exe" with commandline "/c wbadmin delete catalog -quiet" (UID: 00065179-00003528)28:T166c,Pattern match: "www.sfml-dev.org" Heuristic match: "user@sfml-dev.org" Heuristic match: "stevenxx134@gmail.com" Heuristic match: "steven77xx@mail.ru and Steven77xx@protonmail.com" Pattern match: "https://i.ibb.co/2PXVhhm/1.png" Pattern match: "2ZFZze.TF/RGC|__P" Heuristic match: "zKo7,H.nz" Pattern match: "uCGq.lMw/9oS_,^14oHOIz`Q~FsX7TypSJz\" Heuristic match: "Z4V,kqV\[}wY00~B9UTk?>jkEt^',0H|M$sYWPEFCI.>1C5AsF\Hh}[/9.Au" Pattern match: "K.Sng/HYVFeDE@F,{zeP|p$c}R,{,8#q2=Z,5Y&VEp#j5cw=6Ljs;R" Pattern match: "7.sR/$Yk~n" Pattern match: "PrV.YORs/i!n" Pattern match: "CFJy.NwL/tM67=xyuA+z30:g6d$uWf" Pattern match: "G0tup.Mdf/-HY" Heuristic match: "6phgvo473w=;:I'6>qDjfQ'[1*<.=w@w.|-7`z56wA+Mm,QTw.GA" Heuristic match: "mp[hu,s}R!tQfNNO&R`J-}+l.MH" Heuristic match: "xn$P2/\oZT1t6S~xyT*NEA|2@oKEr['4;CO4}<(Px$LEPYA\-e ]2wr:q[=h(J[Wh*~(J{`F-SyF@O8{-Z(br.BG" Pattern match: "P50hy.thxj/JDI*]:I" Pattern match: "Qnz.or/VramUR*R'a'!UsWWmt\67" Heuristic match: "@r) _^kr)tDp- SJ}Y|p:%'4t/aoQaj|W*3TK=\$fmk#g'fc) j&9bRXzV.pA" Heuristic match: "S5CaN=8XhhH=mjD$yXjgK/}a|Zi6Xd|z O.K*Va6M~#.sK" Pattern match: "8.ugcj/}9ru8R?A" Heuristic match: "Ma{Zux53l.2*R$@a|S;ID*R7]+@ )/*e2}c76+mGj4*Mjz> @1e]{PyYQ/o{I4_aa\USSYa{7v6}U2)0*slGq<((.Jp" Heuristic match: "6FRL}7zIbU))2%.J{.jM" Heuristic match: "3fJy}b#akC0QjU.Sl" Pattern match: "d.rno/zN4OeQmd" Heuristic match: "=l(BATQKMVJD.9(3`wF[`!c$.kG" Pattern match: "CbB.lvlb/fDI" Heuristic match: "s}+.bw" Heuristic match: "r^vH/JnpuX}px7!.mG" Heuristic match: "Z%b&NMajV:f 6;.ja2O}&3W:/VD|l[OER'wt\;]c=pcX33^Nq3r4_se%ZQ2?Msvo!2b!i4V@m:)D[bRpL5G/Nj!@hk]!znl^lu'N,n[\:`)`V[v/5Q}BR?9CXk.,,SlQSZBP|\42}/.Pm" Heuristic match: "h)>_yji;?sTVh5-D1F|qJKKq0AOVsB@[i@`\];S5.Je" Pattern match: "9.Kzs/^RAv\|^k={yN;}V'#wV1~" Heuristic match: "eDVvVV j@.tc" Pattern match: "52FIRXq.tv/MjyE&7" Heuristic match: "TO>]s3] 0:)=|ZT b5%.BY" Pattern match: "O.GY/y}97" Heuristic match: "JfWB$sC>GOp?Uz\VdeM40x6h:7lfhCJ`{%Sh'm'd`M\ls8n^|^G`S'2#O;fWwdZmEdX;@z7P&+sa@tq.W KxP>i2.nu" Pattern match: "Y.tB/CLs9jP93" Pattern match: "rmtaWa.UD/+^$'k-}li{cNI_U*" Heuristic match: "3[o70h:[P2NokX2L,K@lm[b|mvvnyP)IGs.GW" Pattern match: "v.JM//vAr" Pattern match: "pT.of/%.Y|8uQ'Mx*Z9Q.bE[*[_|" Heuristic match: "<@4`}:)&QgR^Jyb[6=@,2!y~J~.vN" Pattern match: "06Dd.IJ/*i5RX7K" Heuristic match: "O\}RxDr75=OSU8?QqFq~U/5JbLdVLvx|]{x$/N.Sn" Pattern match: "UBn88Ed.sCD/S`|" Heuristic match: "o+)Znk'lygzV@skl>(45Pn4$-^:~Qw<{sjxq1]_M2LsHC+Ya$u4c{k1\,U`=aXz`Zu}3kS0&E|.26Z9dtaw-ZbRYj4(6-Qe{yyeHs--LgK2%6-LY%?V{R!Ko+|}3/:a#l6|X_vag{vAHg.dm" Heuristic match: "rM^eYhI)yN$Y3U:)H*`$tF|{`Tiv$#^U;S8N6w.Bz" Heuristic match: "3jo3;:!6p9 L3 %r7^a{Hx437s6Cj6wIN!CFlj\i]9TF|Cv-KPC'c[^.bz" Heuristic match: "+l\\`>/V_hYC+o:Zl)9C;i#&)t<>xRPdPfo1>=8I9Z'Zn6Tu+OgumeGoY62aaMw8D,NGZj?r=hDuh*5knQShq3bJ\/?.>CEp*Yn2oR^+JL`XX]ehUk~77d-g.g1>z;.pa" Heuristic match: "117Vyc8sdfOt#*n'G7v^fr./;8+.gF" Pattern match: "2.sFm/BjC@9UdmwAHyYAdQ5PB9BYW" Pattern match: "MJVok.jb/93d3o4D-" Pattern match: "l.XnQz/h4Ss" Heuristic match: "[2>C/R q2;q9Kv`Oj{Ik&Kd!+T&?l[cT-9W6?r:96-HC[m-_%a*aRl8?-/-&..bV" Pattern match: "c.Kx/MMlRi" Pattern match: "I.IiG/CJ?{iXQKf" Pattern match: "kNOY.Pi/6%-@pY'1CHnDRIcuOJv*c6if" Heuristic match: "Rp)|y/2IwW`)PN.cd" Pattern match: "FP.MJ/b_&O+" Pattern match: "v8.CR/[{jIbT.\Ouac&2bGHK5+8iUZ4W" Heuristic match: "jP.i5nETfT]Uv6gaRU.ca" Pattern match: "e.Ihhh/?o" Heuristic match: "mN'zn.+aK1.at" Pattern match: "3m.TPN/[-\eWp[I[`F$KY?!_e0!_x48O" Pattern match: "Zp.zQCY/Q%" Pattern match: "vkD.Ya/C.Ov6" Pattern match: "Db.dl/|nk'mx" Pattern match: "CpBuu.oB/^ps0H,8]Erj5iZ~};{6/[q" Pattern match: "4HX.Gut/tDbfnv" Pattern match: "Xs5b8m.lRV/Zy*Ba:?B@&=[6~,g;ty$Mh" Heuristic match: ".#07^PbCKDjf^9J3Xt=8&Z78+.Lv" Pattern match: "Nuw0.YyjB/}M~?4/|6GUa_H;8\2" Heuristic match: ">Kx'8A!_kl5($1\.UA" Pattern match: "Tf.K-.QX/f+Aj[4KH,[~" Pattern match: "o0.PRyV/3?!6\?YoR=TS%L_;H0" Heuristic match: "U]'>rda /YUT.Sg" Heuristic match: "dQB@J.wP#oD-a?$i9R$E_-pDq=8\bxjG#XPkt+.rs" Pattern match: "K.UI/Ux^a[i" Pattern match: "-.CC/&*K" Pattern match: "54N1.Xs/gsu_BIG-liMWmXqV#,r[QH5QRj\" Heuristic match: "o>B^x)$KCvQ8hs#$f;,QIL@VEVibX:^FidH4Q%CT^DR{TC9G>;/RG%%czpzi\6;,A43G1cnwYZ4QULc)hJ.R/9j}PYI`1T}W1hu25eM'.cC" Pattern match: "3Hd9.jk/z[J87^" Heuristic match: "Zodgq?MagxIQmQl&.4HQ\T1/Hxq?G;+Aah_W54)-YY,UR&wz[fCLMW#6d4Htm~U _}on!3>k![w >y(eHeD%cb`A*]125^@e+FlGbl*;7?^RXT-'zS:KfIc5kkFq}kl^=V-Kt%#pVI-Q_uO<> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"voidcrypt.exe\" at 00064903-00001796-00000105-18602298\n \"wbadmin.exe\" at 00065184-00003604-00000105-107862704\n \"netsh.exe\" at 00065510-00001976-00000105-113284342\n \"netsh.exe\" at 00065594-00001556-00000105-114531159","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"voidcrypt.exe\" queried SystemProcessInformation at 00064903-00001796-00000105-18129904\n \"voidcrypt.exe\" queried SystemProcessInformation at 00064903-00001796-00000105-18178069\n \"voidcrypt.exe\" queried SystemProcessInformation at 00064903-00001796-00000105-18219898\n \"voidcrypt.exe\" queried SystemProcessInformation at 00064903-00001796-00000105-18261598\n \"voidcrypt.exe\" queried SystemProcessInformation at 00064903-00001796-00000105-18303603\n \"voidcrypt.exe\" queried SystemProcessInformation at 00064903-00001796-00000105-18352085\n \"voidcrypt.exe\" queried SystemProcessInformation at 00064903-00001796-00000105-18405358\n \"voidcrypt.exe\" queried SystemProcessInformation at 00064903-00001796-00000105-18464115\n \"voidcrypt.exe\" queried SystemProcessInformation at 00064903-00001796-00000105-18509162","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"voidcrypt.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"voidcrypt.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"wbadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"netsh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ETPRO POLICY External IP Address Lookup via libsfml-network\" (SID: 2838021, Rev: 1, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/79 reputation engines marked \"http://sfml-dev.org\" as malicious (1% detection rate)\n 2/78 reputation engines marked \"http://www.sfml-dev.org\" as malicious (2% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"voidcrypt.exe\" read file \"C:\\$Recycle.Bin\\S-1-5-21-2092356043-4041700817-663127204-1001\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$29","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"255.255.255.255\"\n \"80.82.69.52\"\n \"78.47.82.133\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 78.47.82.133 on port 80 is sent without HTTP header\n TCP traffic to 80.82.69.52 on port 8080 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1043","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 1143 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\voidcrypt.exe\" marked \"C:\\autoexec.bat\" for deletion\n \"C:\\voidcrypt.exe\" marked \"C:\\config.sys\" for deletion\n \"C:\\voidcrypt.exe\" marked \"C:\\dotnet.au3\" for deletion\n \"C:\\voidcrypt.exe\" marked \"C:\\$Recycle.Bin\\S-1-5-21-2092356043-4041700817-663127204-1001\\desktop.ini\" for deletion\n \"C:\\voidcrypt.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml\" for deletion\n \"C:\\voidcrypt.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml\" for deletion\n \"C:\\voidcrypt.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2a","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"level":"suspicious","category":"System Security","name":"Stops a system service using net.exe","description":"Process \"net.exe\" with commandline \"net stop SQLWriter\" (UID: 00065021-00002824)\n Process \"net.exe\" with commandline \"net stop SQLBrowser\" (Service: \"Computer Browser\", UID: 00065044-00003580)\n Process \"net.exe\" with commandline \"net stop MSSQLSERVER\" (UID: 00065065-00003912)\n Process \"net.exe\" with commandline \"net stop MSSQL$CONTOSO1\" (UID: 00065093-00003596)\n Process \"net.exe\" with commandline \"net stop MSDTC\" (Service: \"Distributed Transaction Coordinator\", UID: 00065119-00002544)\n Process \"net.exe\" with commandline \"net stop SQLSERVERAGENT\" (UID: 00065275-00002956)\n Process \"net.exe\" with commandline \"net stop MSSQLSERVER\" (UID: 00065298-00003520)\n Process \"net.exe\" with commandline \"net stop vds\" (Service: \"Virtual Disk\", UID: 00065322-00002860)","origin":"Monitored Target","relevance":10,"id":"target-102","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetDriveTypeA\n FindFirstFileW\n UnhandledExceptionFilter\n WriteFile\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryExW\n CreateThread\n ExitThread\n TerminateProcess\n GetModuleHandleExW\n CreateToolhelp32Snapshot\n Process32First\n LoadLibraryW\n GetVersionExW\n GetTickCount\n VirtualProtect\n Process32Next\n OpenProcess\n GetStartupInfoW\n CreateDirectoryW\n DeleteFileW\n FindFirstFileExA\n FindNextFileW\n FindNextFileA\n FindFirstFileExW\n GetProcAddress\n CreateFileW\n GetCommandLineW\n GetCommandLineA\n GetModuleHandleA\n GetModuleHandleW\n GetFileAttributesExW\n CreateProcessA\n Sleep\n VirtualAlloc\n socket\n recv\n send\n WSAStartup\n connect\n closesocket","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2b","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"net.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"bcdedit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to suppress failures during boot (often used to hide system changes)","description":"Tries to suppress failures during boot \"cmd.exe\" with commandline \"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00065139-00002576)\n Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00065145-00002448)","origin":"Monitored Target","relevance":8,"id":"target-6","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa.bin\" (Offset: 416643)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"24/37 Antivirus vendors marked sample as malicious (64% detection rate)\n 57/69 Antivirus vendors marked sample as malicious (82% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"24/37 Antivirus vendors marked sample as malicious (64% detection rate)\n 57/69 Antivirus vendors marked sample as malicious (82% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"voidcrypt.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\"\n \"voidcrypt.exe\" allocated memory in \"%ALLUSERSPROFILE%\\pubkey.txt\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"level":"malicious","category":"Installation/Persistence","name":"Disables startup repair","description":"Disables startup repair \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled no\" (UID: 00065166-00003304)","origin":"Monitored Target","relevance":8,"id":"target-5","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"level":"malicious","category":"Network Related","name":"Detected a large number of ARP broadcast requests (network device lookup)","description":"$2c","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":10,"id":"network-31","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2d","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$2e","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 80.82.69.52 on port 8080","origin":"Network Traffic","mitre_attack_id":"T1065","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"Internal YARA signature matched on file \"Catalog.dll\"","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes backup catalog","description":"Deletes backup catalog files using \"wbadmin.exe\" with commandline \"wbadmin delete catalog -quiet\" (UID: 00065184-00003604)","origin":"Monitored Target","mitre_attack_id":"T1107","relevance":10,"id":"target-80","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"level":"malicious","category":"System Security","name":"Modifies firewall settings","description":"Process \"netsh.exe\" with commandline \"netsh advfirewall set currentprofile state off\" (UID: 00065510-00001976)\n Process \"netsh.exe\" with commandline \"netsh firewall set opmode mode=disable\" (UID: 00065594-00001556)","origin":"Monitored Target","mitre_attack_id":"T1089","relevance":8,"id":"target-15","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2f","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"net1.exe\" called \"OpenSCManager\" requesting access rights \"0X0\"\n \"net1.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"user@sfml-dev.org\"\n Pattern match: \"stevenxx134@gmail.com\"\n Pattern match: \"steven77xx@mail.ru\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]}],"incidents":[{"name":"Persistence","details_count":4,"details":[{"detail":"Spawns a lot of processes"},{"detail":"Modifies firewall settings"},{"detail":"Disables startup repair"},{"detail":"Tries to suppress failures during boot (often used to hide system changes)"}],"sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected a large number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]}]},"activity":{"stats":{"process_count":35,"spawned_processes_count":35,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":131,"dropped_files_count":0,"extracted_files_count":86,"files_written_count":174,"files_deleted_count":0,"registry_keys_created_count":7,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":3,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["voidcrypt","banker","criminal","filecoder","higuniel","odveta","ouroboros","ramnit","ransomware"],"sample_flags":["Network Traffic","Extracted Files","User Comment","TOR analysis"],"sandbox_reports":[{"id":"5f5ba0baceda1000b810b149","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":99,"malware_family":"DeepScan:Generic.Ransom.AmnesiaE","contacted_countries":["DEU","NLD"],"submit_name":"voidcrypt.exe","analysis_start_time":"2020-09-11T16:07:32+00:00","indicators_count":{"informative":17,"suspicious":23,"malicious":17},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"5e91ebbb00397a2898219360","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Heur.Ransom.Imps","contacted_countries":["DEU","NLD"],"submit_name":"stevenxx134@gmail.com.exe","analysis_start_time":"2020-04-11T16:09:44+00:00","indicators_count":{"informative":18,"suspicious":10,"malicious":11},"tags":["Network Traffic","User Comment","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"78.47.82.133","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"address":"80.82.69.52","port":8080,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"address":"148.251.247.174","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]}],"dns_resolutions":[{"domain":"_ldap._tcp.dc._msdcs.scl3.dc","ttl":86378,"country":"-","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"domain":"isatap.scl3.dc","ttl":86394,"country":"-","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"domain":"www.sfml-dev.org","address":"78.47.82.133","ttl":1199,"country":"Germany","registrar_name":"united-domains AG","registrar_organization":"Limbozz GmbH","registrar_name_servers":"PRI.MORDAC.DE","registrar_creation_date":"2008-02-26T15:26:15+00:00","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]}],"http_requests":[{"host":"78.47.82.133","host_ip":"78.47.82.133:80","url":"/ip-provider.php","method":"GET","header":"GET /ip-provider.php HTTP/1.0\ncontent-length: 0\nfrom: user@sfml-dev.org\nhost: www.sfml-dev.org\nuser-agent: libsfml-network/2.x","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}],"processes":[{"pid":1796,"ppid":0,"name":"voidcrypt.exe","command_line":"","sha256":"26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa","normalized_path":"C:\\voidcrypt.exe","uid":"00064903-00001796","icon":"$30"},{"pid":2472,"ppid":1796,"name":"cmd.exe","command_line":"/c net stop SQLWriter","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064903-00001796","uid":"00065016-00002472"},{"pid":2824,"ppid":2472,"name":"net.exe","command_line":"net stop SQLWriter","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00065016-00002472","uid":"00065021-00002824"},{"pid":3332,"ppid":2824,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop SQLWriter","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00065021-00002824","uid":"00065023-00003332"},{"pid":2744,"ppid":1796,"name":"cmd.exe","command_line":"/c net stop SQLBrowser","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064903-00001796","uid":"00065039-00002744"},{"pid":3580,"ppid":2744,"name":"net.exe","command_line":"net stop SQLBrowser","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00065039-00002744","uid":"00065044-00003580"},{"pid":2768,"ppid":3580,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop SQLBrowser","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00065044-00003580","uid":"00065048-00002768"},{"pid":3608,"ppid":1796,"name":"cmd.exe","command_line":"/c net stop MSSQLSERVER","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064903-00001796","uid":"00065060-00003608"},{"pid":3912,"ppid":3608,"name":"net.exe","command_line":"net stop MSSQLSERVER","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00065060-00003608","uid":"00065065-00003912"},{"pid":2716,"ppid":3912,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSSQLSERVER","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00065065-00003912","uid":"00065070-00002716"},{"pid":2976,"ppid":1796,"name":"cmd.exe","command_line":"/c net stop MSSQL$CONTOSO1","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064903-00001796","uid":"00065086-00002976"},{"pid":3596,"ppid":2976,"name":"net.exe","command_line":"net stop MSSQL$CONTOSO1","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00065086-00002976","uid":"00065093-00003596"},{"pid":2444,"ppid":3596,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSSQL$CONTOSO1","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00065093-00003596","uid":"00065096-00002444"},{"pid":2960,"ppid":1796,"name":"cmd.exe","command_line":"/c net stop MSDTC","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064903-00001796","uid":"00065114-00002960"},{"pid":2544,"ppid":2960,"name":"net.exe","command_line":"net stop MSDTC","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00065114-00002960","uid":"00065119-00002544"},{"pid":2640,"ppid":2544,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSDTC","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00065119-00002544","uid":"00065122-00002640"},{"pid":2576,"ppid":1796,"name":"cmd.exe","command_line":"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064903-00001796","uid":"00065139-00002576"},{"pid":2448,"ppid":2576,"name":"bcdedit.exe","command_line":"bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"e5bc427ba84627fa84861c54044df8ac3c3b3c3ed3d007265c6b18f588d0ca8a","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00065139-00002576","uid":"00065145-00002448"},{"pid":3020,"ppid":1796,"name":"cmd.exe","command_line":"/c bcdedit /set {default} recoveryenabled no","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064903-00001796","uid":"00065160-00003020"},{"pid":3304,"ppid":3020,"name":"bcdedit.exe","command_line":"bcdedit /set {default} recoveryenabled no","sha256":"e5bc427ba84627fa84861c54044df8ac3c3b3c3ed3d007265c6b18f588d0ca8a","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00065160-00003020","uid":"00065166-00003304"},{"pid":3528,"ppid":1796,"name":"cmd.exe","command_line":"/c wbadmin delete catalog -quiet","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064903-00001796","uid":"00065179-00003528"},{"pid":3604,"ppid":3528,"name":"wbadmin.exe","command_line":"wbadmin delete catalog -quiet","sha256":"be527c6085cd944097de35b9740fc4dd24d455567bec596e9cc300d70c5a392d","normalized_path":"%WINDIR%\\System32\\wbadmin.exe","parent_uid":"00065179-00003528","uid":"00065184-00003604"},{"pid":2984,"ppid":1796,"name":"cmd.exe","command_line":"/c net stop SQLSERVERAGENT","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064903-00001796","uid":"00065270-00002984"},{"pid":2956,"ppid":2984,"name":"net.exe","command_line":"net stop SQLSERVERAGENT","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00065270-00002984","uid":"00065275-00002956"},{"pid":2796,"ppid":2956,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop SQLSERVERAGENT","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00065275-00002956","uid":"00065278-00002796"},{"pid":3436,"ppid":1796,"name":"cmd.exe","command_line":"/c net stop MSSQLSERVER","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064903-00001796","uid":"00065293-00003436"},{"pid":3520,"ppid":3436,"name":"net.exe","command_line":"net stop MSSQLSERVER","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00065293-00003436","uid":"00065298-00003520"},{"pid":3632,"ppid":3520,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop MSSQLSERVER","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00065298-00003520","uid":"00065302-00003632"},{"pid":3620,"ppid":1796,"name":"cmd.exe","command_line":"/c net stop vds","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064903-00001796","uid":"00065317-00003620"},{"pid":2860,"ppid":3620,"name":"net.exe","command_line":"net stop vds","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00065317-00003620","uid":"00065322-00002860"},{"pid":272,"ppid":2860,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop vds","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00065322-00002860","uid":"00065328-00000272"},{"pid":3800,"ppid":1796,"name":"cmd.exe","command_line":"/c netsh advfirewall set currentprofile state off","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064903-00001796","uid":"00065503-00003800"},{"pid":1976,"ppid":3800,"name":"netsh.exe","command_line":"netsh advfirewall set currentprofile state off","sha256":"661f5d4ce4f0a6cb32669a43ce5deec6d5a9e19b2387f22c5012405e92169943","normalized_path":"%WINDIR%\\System32\\netsh.exe","parent_uid":"00065503-00003800","uid":"00065510-00001976"},{"pid":928,"ppid":1796,"name":"cmd.exe","command_line":"/c netsh firewall set opmode mode=disable","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064903-00001796","uid":"00065588-00000928"},{"pid":1556,"ppid":928,"name":"netsh.exe","command_line":"netsh firewall set opmode mode=disable","sha256":"661f5d4ce4f0a6cb32669a43ce5deec6d5a9e19b2387f22c5012405e92169943","normalized_path":"%WINDIR%\\System32\\netsh.exe","parent_uid":"00065588-00000928","uid":"00065594-00001556"}],"all_imported_dlls":["shlwapi.dll","odbc32.dll","userenv.dll","P2P.dll","DHCPQEC.DLL","mprapi.dll","cryptsp.dll","msctf.dll","samcli.dll","devobj.dll","atl.dll","nettrace.dll","netmsg.dll","msasn1.dll","polstore.dll","apphelp.dll","ole32.dll","wevtapi.dll","wshelper.dll","kernel32.dll","wship6.dll","gpapi.dll","WcnNetsh.dll","ntdll.dll","blb_ps.dll","rasman.dll","nshhttp.dll","p2pcollab.dll","IPHLPAPI.DLL","wkscli.dll","rasapi32.dll","httpapi.dll","activeds.dll","profapi.dll","msvcrt.dll","setupapi.dll","dhcpcsvc6.dll","cryptbase.dll","netutils.dll","netapi32.dll","rpcss.dll","dnsapi.dll","logoncli.dll","clbcatq.dll","Wldap32.dll","tdh.dll","odbcint.dll","crypt32.dll","ws2help.dll","netshell.dll","eappcfg.dll","wdi.dll","sechost.dll","version.dll","user32.dll","dsrole.dll","dhcpcsvc.dll","ifmon.dll","dot3cfg.dll","secur32.dll","wlanapi.dll","usp10.dll","winnsi.dll","comctl32.dll","uxtheme.dll","FirewallAPI.dll","credui.dll","advapi32.dll","authfwcfg.dll","winhttp.dll","wlanhlp.dll","dhcpcmonitor.dll","devrtl.dll","whhelper.dll","PeerDistSh.dll","QAGENT.DLL","bcryptprimitives.dll","bcrypt.dll","webio.dll","shell32.dll","rpcnsh.dll","eappprxy.dll","mswsock.dll","rasadhlp.dll","winbrand.dll","nshwfp.dll","p2pnetsh.dll","rsaenh.dll","rasmontr.dll","dot3api.dll","ndfapi.dll","nsi.dll","KernelBase.dll","WSHTCPIP.DLL","oleaut32.dll","slc.dll","QUTIL.DLL","fwcfg.dll","FWPUCLNT.DLL","nshipsec.dll","gdi32.dll","lpk.dll","imm32.dll","srvcli.dll","ntdsapi.dll","mfc42u.dll","rpcrt4.dll","ws2_32.dll","cfgmgr32.dll","netiohlp.dll","adsldpc.dll","api-ms-win-core-synch-l1-2-0.dll","samlib.dll","wlancfg.dll","wwancfg.dll","nlaapi.dll","onex.dll","NAPMONTR.DLL","certcli.dll","browcli.dll","RpcRtRemote.dll","winipsec.dll","hnetmon.dll","sspicli.dll","wwapi.dll","mpr.dll","nci.dll","wlanutil.dll","wow64cpu.dll","wow64.dll","wow64win.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"deployJava1.dll","sha256":"2b945d4dade18ca1b9266eba2026d04eac55b99145c8e4877a66abdb8b56cd54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"Autumn Leaves.docx","sha256":"9c2129388d74b0bbfdc5e142975224ba5588173ee38886955385e2aaff79d5f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"CCEnhancer-4.5.1.exe","sha256":"126385e4999e819b9f9ee677625aaed93c980ac540d2cedc2a2e612527a94ea2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"AUDIOSEARCHMAIN.DLL","sha256":"2f67c8714a13822f5bf9df0a940813168e59a352f6ab03f51902c5db202a11d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"coreclr.dll","sha256":"58238ad05939091c0b7cc3ffd549511b05d1929df17de96490605beba0310501","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"Blue Tabbed Folder.docx","sha256":"572c8007b044d12e8835f1d2bb3a4e93d0f082fd57dbcf3c501ef101c6cb5127","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"CSS7DATA000C.DLL","sha256":"a3391cd66953775430ca42d9b520765de3f220792923586422958416f0f16c95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"dSTEZHvd.doc","sha256":"5718df6ed9be9655d775b2760aa287a4fc73de0b5fca934de1f1bbf733ae9856","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"Childrens Activities.docx","sha256":"9b91153668ed49ba8b17bfd5329394e4d8702cb4177f3e4bc45ec38e4da6cc6d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"CSS7DATA000A.DLL","sha256":"c7351388c816db801e658c60b3e3db5af9e9e6279b1e56e40e0ade3dca975bc1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"AcroRd32.exe","sha256":"79be763ff82ce9f7ca3acdf78245d9e662582ee8ee3988c45e43055c05a9fb66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"dsYny5bq4UJV.doc","sha256":"80a0936ce72592b5002ddcc530de7a1af52bea2630800a5f5e518dc50a219377","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"AXSLE.dll","sha256":"f94b9210f4e1ee618fc8de46189bc20fa4b063a3d7ccfb56c96528eb810b52fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"DW20.EXE","sha256":"1120aac3e5270b1e3cede3ee67eac9941d20787aee3b533a37f7a6316ad6bbdb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"ACECORE.DLL","sha256":"49026237b6cb25409b875ef97440c44ed9ec878ea3c6bdf60f3c49bb795c0ae4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"com-sun-tools-visualvm-core.jar","sha256":"99ef8c4bdea27a816fb0906599e754244e9ec4dbba670a794a8072127b86055b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"Candy Hearts.docx","sha256":"7af82ebc2ab53c479c037c36f536f013eb52512ca3215339095c2b1ba7343c63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"ACEES.DLL","sha256":"3bea87f00e390f49592608a4553dd168095868acd58674bc93f573ce6c430e8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"com.jrockit.mc.flightrecorder.ui_5.5.1.172852.jar","sha256":"268fd516f5be7b7892a849a8251939a670f0292ca5733955427a31dacde248c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"Bold Hanging Tab.docx","sha256":"e789148dc2d01e4f88ab145df2207bebd184ced981516e608b698c39eea7e801","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"cldrdata.jar","sha256":"afbdd59340dd9dc4be99a8b58e74b1659b368ea30080a540a3ace61fdf7e4698","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"d3dcompiler_43.dll","sha256":"fbb0bcd9950ca45d0f28c3841a9a6bfc04539911c802ae1c540001dec5419239","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"DBGHELP.DLL","sha256":"1c07ac1b8e9b1fb68e3b8de2bccc5095f2c00b5114149c600c25b7ff002e279d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"DbgHelp.Dll","sha256":"a0a3806452b91780b1116ae35b2b781f76dab0dfeb72278b2a15c06c3e0612c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"Card with Rose.docx","sha256":"b94349277fb932878be243be15669321481a017d234197d89fe973df7c21d52d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"Aut2exe_x64.exe","sha256":"8b38a8bd07d4e75a901c3e0c1408e8b6dfeff4aa31f544840874b80425c5d9ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"d3dcompiler_47.dll","sha256":"2e535dbdf6eedee995f9e41ecbcadb353bb6d7a5df9c85f93a05faa7fa5a3fdd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"DP001GCJ.doc","sha256":"4828ba0fb347f54e3bc686e119b943b41904fd2536cd9587aa2be9c4cdf3b0e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"AGM.dll","sha256":"82af74db0c061524d46864c953482b385b2a6d9819554aec170d46820063074d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"6JQvD1.exe","sha256":"f28ae85a581355eb9b53ef8762152d461b77397323b808415e7ef129ae9fc46d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"Activator_Office.exe","sha256":"ce63fbb4eb9701a672052f7334f91a73af7fdc65fbfb256d829ca47a5c17dd00","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"D1JACuX.exe","sha256":"b50e63a41e22b6c7f3441828af7b251faf5de33491a31c21e99e96d35f5134ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"core.msi","sha256":"b6cb6b0d8c33af036debca514eb1d33d891acebe04650bc97cdf5ecf095d58b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"deploy.jar","sha256":"6b56394efc4db46422c14e38412e77206c17fb047f4a51afc45e89ae21c30aee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"Adobe AIR Application Installer.swf","sha256":"056d19eb50d1e741a6c8a8ace667cc63e46d8266282d12b14ef68344688b0752","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"EatIg.exe","sha256":"1bf68030bb8d3a29fe7f5ded2503816b75c052f5c4bd039400120719493d1669","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"EMSMDB32.DLL","sha256":"a6c12d0514060dd34d96929f85981a5da6a1222cbca0afb58a80e20a2b7db27a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"awt.dll","sha256":"5451c65f763418fe6228552bac59357d2bc8145ecc3a152f2e50f2a6016286bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"A6a4k093.exe","sha256":"b88e5fc43c68fd765ac7ff4406558677cf44dd3275e89b2ee64ddf8964c2d8f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"DcNNjRAkEraNbP.doc","sha256":"75a0e8efff4dd3e97f6f71d2b7cbc6b38373c13d706eb0332666004bfd4f0c6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"AutoIt3_x64.exe","sha256":"769c15619043ff12bbf05798626b99d2be97900ea489b66b29e43a94ac3947c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"derby.jar","sha256":"688d664613e17b1a8aff1d050cff7ff528cdcd5f6f5f1d2e78a60502e391ba7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"ant-javafx.jar","sha256":"8f01e841e1a354df4095f6cd762eda192c8667e45510d39d4058501540a81a6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"AUDIOSEARCHSAPIFE.DLL","sha256":"2ebf45eafd2f6bcc575124de21d2a992dda56a1c63f30810430add3272bcb472","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"ACEWDAT.DLL","sha256":"508ad4310fd2077df3f26a4e1b1b10e4eecfd145dd272fbfa171098b2721ac26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"Bold Red Black Annual Report.docx","sha256":"c047be94b9de4bd3fae764abe4d04e8378b040335b9bb066fe9fe032011dcc55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"Catalog.dll","sha256":"e104ac9cb223ad8b63d3151354913abd5f0e6e347f945e20865296231b7a6626","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"Bold Photo Blobs in Red and Gray.docx","sha256":"8024b9a4c90f4b8b3b01d1e3d6115896c6a573af8c086bd15583bdb7eb018121","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"AdobeARM.exe","sha256":"91c67809e5e3f1ddc10ee3445bacea2ae83eb97b07ae2b9672ef004ff115a516","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"Brushed Steel Bifold Brochure.docx","sha256":"a43033808da66259ab07c302aa42a3ee1ad9f474cb19d3e4140935e51045b5ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"Csi.dll","sha256":"74cd0daa25cb8d5747b13872762a687076d7b0cfa87261ff593e1a45084d4e91","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"Bold Picture and Date Annual Report.docx","sha256":"2feb4859ab3c2462553288b10e5de2b60c63bc02f4fa5eeff1bb256fae7ce07d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"Construction hard hat.docx","sha256":"30878206e0b25711f86de7aa5e2a4fed59cec2b73a941a2e9131c2f6c0ba451a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"E68SD0Ky01dhTr.exe","sha256":"222a6d825bfd36519c28d2ac0bc3be5869000282daf5980a49d6676c66c3ff26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"ACE.dll","sha256":"d7a0a87dc5e2a7e68043e95064f9286a6e4e108310cb2638e5c9baba6af8b99b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"CsiSoap.dll","sha256":"cdd93ed953d2b905e0b70a9816c9ef9d204f0d84de7f0d207b314cc5ad278132","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"CspyTJgM.exe","sha256":"bb6b25137e9ebc5b1b33d2d92007cec490541bd246e3ee2c7ea78aff016b3df5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"charsets.jar","sha256":"132772e480880f1f0c9f90caa7be27aca1bdbfc537eda169d9eb173130a83eac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"cUJpjDsZO.doc","sha256":"273cfc82fd6e7d424280a452676ae3a99f097ab2b85bc968ca69c72c2c93e228","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"ACEWSTR.DLL","sha256":"e01bbfd494afbde3c78d916b1ba99049d895c411dfc7154348a4f3639e23be2d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"Aut2exe.exe","sha256":"5db3890070149da62eaa989112d6765340378246b8ec6048b46f67882406c7f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"core.jar","sha256":"ea1f6e24323fb260d2a97e84ac1418aa8bce5840ec9041967784fb203aeb5b54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"AcroRead.msi","sha256":"165dfc479e99122c47063dca5d9b80cea409da3adb01266a14828393ef69e856","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"EW9C2p.exe","sha256":"cf5db8bc8c635132c02218afe9b3c02d63e4614c977962695d9dc413347b2f25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"Arm_001824265200_180488753516061635011347681117522412720.msi","sha256":"23f8c4ac73c3d3f497bc703f73c0baa7e805ea37c7e200b34322580509bc30ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"7z.dll","sha256":"05fa0b9b4148c84596dc78ce41fcd95df157d74ff2d117fa86d1c814958647f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"CoolType.dll","sha256":"e121d1d45dec62599179dd68337d4bf6ac92da3b99999fc94127d6d05a0ee6e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"com.jrockit.mc.ui_5.5.1.172852.jar","sha256":"c09243854e8bf25e058fe3d6ab402b1ed03fe9f93a406045012fb37d0b0db442","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"AdobeHunspellPlugin.dll","sha256":"9dfc6c0672dcc006ddc321cbb809730166a5d24ad7e34b23492d12f3383e01dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"AMrt2OL.exe","sha256":"5f424cde8b9948642b43a09cb3fcf1f3b93cf00fc1fb38e2f1a5ab4ee0fb9954","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"AdobeCollabSync.exe","sha256":"e704fd268ec85f91d34ac4bcc4a87a9e4a5ec4bd82f9c787b1c43d24c28dbf02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"AIDE.dll","sha256":"dde782d0f70d1d490701b246d23df60a1002498c6b12910e4aa8b38f20a07fdc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"ACEEXCL.DLL","sha256":"8121c07d89884e50c519ae0a363470e530e78248dd68dd30ddec6e625237e2c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"3kNG.exe","sha256":"ec436b8a0fb2d97cb0671289a53fc446f569100ed0381d0e343635420da81a79","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"ADO210.CHM","sha256":"5c456205cd4d09fd1291f7a405f9f8f47502864bb6cea2fb1234e7cfbea9592c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"Byf3DiB7aX.doc","sha256":"d8467fd7003f6a215e1ca2b00cb3f2ce926fd3bd2b825139d89c9a538ba98541","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"com.jrockit.mc.rcp.application_5.5.1.172852.jar","sha256":"a5185e0d5addc5131e6d6df4fdd09f0c78e130996561231e57b4e2d510c4083e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"3VBXaPVG.exe","sha256":"27c8fe872fe522a8c2ccf7c59c184f9ec1528b8cb9f015c707b0d3062171a6b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"Diagonally Blue.docx","sha256":"352758d5c8c1ee2a341979579398533c0779122d4b6c5ad82c0466ab4ea43816","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"ara0UGGW3VRU.exe","sha256":"84c4b9a62f7366a71f9e7641bc32ee1bdcb4a2cca07322df82a1c5c543d040b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"ContemporaryPhotoAlbum.potx","sha256":"9544a6e3d8521ee6737bd725cfcae0d71909909e885241c9dc61118937bcfe10","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"EquityReport.Dotx","sha256":"cdce455a42138f943ae8f774035bf3a51485f9c67370fc5f22fcd43958ebc154","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"Built-In Building Blocks.dotx","sha256":"e2fd53359b3ec6635a71cc50b2f201b574c6c8c2942deb0469ebce0dd5ba01bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"EssentialReport.dotx","sha256":"b179618b4b45bdf4f8d073a6c88f95b4600b710aeda3a7d3da9cfd44d29bc471","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"AdjacencyReport.dotx","sha256":"2c255f7d705d2c4603a5922f94e6c66b5866a72ddd5fce6389d0025fd77744d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"name":"ClassicPhotoAlbum.potx","sha256":"53896008db14ec1c414e7e0aba35aa4a7059396d2e83ced27038ab180ec7d576","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]}],"files_written":[{"path":"%WINDIR%\\System32\\en-US\\netsh.exe.mui","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"%WINDIR%\\System32\\bcdedit.exe","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"%WINDIR%\\System32\\en-US\\fwcfg.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"%ALLUSERSPROFILE%\\IDo.txt","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\voidcrypt.exe","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\share\\1599840472626$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\share\\1599840472626$OK","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"%SAMPLEDIR%\\network.pcapng","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\share\\voidcrypt.exe","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"%USERPROFILE%\\˓\\˓","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PubLR.cab","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordLR.cab","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.msi","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OnoteLR.cab","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\branding.xml","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\branding.xml.[stevenxx134@gmail.com][ID-O4IJNZU7A6TRYHX].Void","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"%WINDIR%\\System32\\en-US\\wbadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"%WINDIR%\\Logs","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"%WINDIR%\\System32\\en-US\\odbcint.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"%WINDIR%\\System32\\en-US\\MFC42u.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"%WINDIR%\\System32\\en-US\\p2pnetsh.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%WINDIR%\\System32\\wbadmin.exe","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\autoexec.bat.[stevenxx134@gmail.com][ID-O4IJNZU7A6TRYHX].Void","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"%USERPROFILE%\\ɿ","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"%USERPROFILE%\\ę","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\config.sys.[stevenxx134@gmail.com][ID-O4IJNZU7A6TRYHX].Void","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\dotnet.au3.[stevenxx134@gmail.com][ID-O4IJNZU7A6TRYHX].Void","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\dotnet48.exe","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-2092356043-4041700817-663127204-1001\\desktop.ini.[stevenxx134@gmail.com][ID-O4IJNZU7A6TRYHX].Void","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml.[stevenxx134@gmail.com][ID-O4IJNZU7A6TRYHX].Void","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml.[stevenxx134@gmail.com][ID-O4IJNZU7A6TRYHX].Void","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml.[stevenxx134@gmail.com][ID-O4IJNZU7A6TRYHX].Void","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml.[stevenxx134@gmail.com][ID-O4IJNZU7A6TRYHX].Void","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"path":"%WINDIR%\\SysWOW64\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%WINDIR%\\SysWOW64\\net.exe","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%WINDIR%\\SysWOW64\\net1.exe","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%WINDIR%\\SysWOW64\\netsh.exe","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\netsh.exe.mui","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\odbcint.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\MFC42u.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\fwcfg.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\p2pnetsh.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%ALLUSERSPROFILE%\\pubkey.txt","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\vxprepare64.bat.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\vxprepare64.bat","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-686412048-2446563785-1323799475-1001\\desktop.ini.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C\\ose.exe.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C\\ose.exe","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C\\Office32WW.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C\\Office32WW.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C\\Setup.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%PROGRAMFILES%\\7-Zip\\7z.exe.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%PROGRAMFILES%\\7-Zip\\7z.sfx.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C\\StandardrWW.xml.[stevenxx134@gmail.com][ID-XBVD97PJGMU03QW].Void","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%PROGRAMFILES%\\(x86)\\Java\\jdk1.8.0_151\\lib\\visualvm\\profiler\\modules\\locale\\org-netbeans-modules-profiler_zh_CN.jar","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%PROGRAMFILES%\\Microsoft Silverlight\\5.1.50907.0\\uk\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft Silverlight\\5.1.50907.0\\ca\\mscorlib.resources.dll","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0CH0OVJV\\rating[1].gif","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%PROGRAMFILES%\\(x86)\\AutoIt3\\Examples\\Helpfile\\Extras\\Airplane.wav","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\98FKNM2M\\v3-home.20180313-132144[1].css","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MXWNV8XG\\favicon0NB5Z9H4.png","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\OX8EQCT0\\favicon[6].png","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\v1[3].png","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SLSW3KYW\\sddefault[2].jpg","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EKCX8E9R\\fb387d79[1].js","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\V8IO49DI\\151228-001[1].jpg","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\V8IO49DI\\2018.03.13-dw-ph[1].js","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QSQQQ22U\\os-async.5.0.1.min[1].js","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\P39H9XTL.txt","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\OX8EQCT0\\Y7KNN2KU.htm","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\9DCW73ON\\2651770_100[1].jpg","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SLSW3KYW\\Pix-1x1[1].gif","sources":[{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{CF812051-D863-11E7-AE2B-A9D1A6F40333}\\ELEMENTS\\250000E0\\","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{CF812051-D863-11E7-AE2B-A9D1A6F40333}\\ELEMENTS\\16000009\\","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\NAPAGENT\\LOCALCONFIG\\","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\NAPAGENT\\LOCALCONFIG\\ENROLL\\HCSGROUPS\\","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\NAPAGENT\\SHAS\\","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\NAPAGENT\\QECS\\","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"name":"Global\\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5f5ba0baceda1000b810b149"},{"report_type":"sandbox","report_id":"5e91ebbb00397a2898219360"}]}]}},"report_ids":{"sandbox_job_ids":["5e91ebbb00397a2898219360","5f5ba0baceda1000b810b149"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Dump:Generic.Ransom.AmnesiaE Sample 26690dae115f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 26690dae115f…. Malware family: Dump:Generic.Ransom.AmnesiaE. Threat score 100/100. 21/25 AV engines flagged this file. 14 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa"}],["$","meta","4",{"property":"og:title","content":"Malicious Dump:Generic.Ransom.AmnesiaE Sample 26690dae115f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 26690dae115f…. Malware family: Dump:Generic.Ransom.AmnesiaE. Threat score 100/100. 21/25 AV engines flagged this file. 14 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Dump:Generic.Ransom.AmnesiaE Sample 26690dae115f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 26690dae115f…. Malware family: Dump:Generic.Ransom.AmnesiaE. Threat score 100/100. 21/25 AV engines flagged this file. 14 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]