24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious VirTool:Vbinder Sample 2c9f1ef64d6b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2c9f1ef64d6b…. Malware family: VirTool:Vbinder. Threat score 100/100. 8/8 AV engines flagged this file. 11 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2c9f1ef64d6b67253a2d78806bbafdd838074a87aee634be7a0cf40e94a679e5","keywords":["Malicious","VirTool:Vbinder","malware analysis","sandbox report","threat intelligence","2c9f1ef64d6b67253a2d78806bbafdd838074a87aee634be7a0cf40e94a679e5"],"about":{"@type":"SoftwareApplication","name":"Blox_Bot_v0.1.exe","applicationCategory":["peexe","executable"],"identifier":"2c9f1ef64d6b67253a2d78806bbafdd838074a87aee634be7a0cf40e94a679e5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"VirTool:Vbinder","antivirusDetections":{"malicious":8,"total":8},"behavioralIndicators":{"malicious":11,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tf64,"DEADMIHANA.EXE" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll" at 00013948-00003000-0000010C-15341572919 "DEADMIHANA.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\DEADMIHANA.EXE" at 00013948-00003000-0000010C-15513832678 "DEADMIHANA.EXE" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll" at 00013948-00003000-0000010C-23161418769 "DEADMIHANA.EXE" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll" at 00013948-00003000-0000010C-23192849567 "DEADMIHANA.EXE" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll" at 00013948-00003000-0000010C-23335123839 "DEADMIHANA.EXE" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll" at 00013948-00003000-0000010C-23359335677 "DEADMIHANA.EXE" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00013948-00003000-0000010C-23641214886 "DEADMIHANA.EXE" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00013948-00003000-0000010C-23678477760 "WINDOWSAPPLICATION23.EXE" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll" at 00013980-00003056-0000010C-15358710697 "WINDOWSAPPLICATION23.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\WINDOWSAPPLICATION23.EXE" at 00013980-00003056-0000010C-15495292703 "DEADMIHANA.EXE" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll" at 00015043-00002808-0000010C-39573717548 "DEADMIHANA.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\DEADMIHANA.EXE" at 00015043-00002808-0000010C-39645327055 "Client.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll" at 00015110-00003596-0000010C-41259568348 "Client.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\SubDir\Client.exe" at 00015110-00003596-0000010C-41323727782 "Client.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll" at 00015110-00003596-0000010C-52146711521 "Client.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll" at 00015110-00003596-0000010C-52160272354 "Client.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll" at 00015110-00003596-0000010C-52230901944 "Client.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll" at 00015110-00003596-0000010C-52251019164 "Client.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00015110-00003596-0000010C-52542481248 "Client.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00015110-00003596-0000010C-5255612332726:T683,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Users\wahKcSn\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "C:\Windows\System32\en-US\propsys.dll.mui" "" touched file "C:\Windows\System32\en-US\setupapi.dll.mui" "" touched file "C:\Windows\AppPatch\sysmain.sdb" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "DEADMIHANA.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "DEADMIHANA.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "DEADMIHANA.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "DEADMIHANA.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "DEADMIHANA.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "DEADMIHANA.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "DEADMIHANA.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "DEADMIHANA.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config"27:T502,"DEADMIHANA.EXE" wrote bytes "7739eb7679a8ef76be72ef76d62def761de2ea7605a2ef76c868ee7657d1f576bee3ea76616fef766841ed760050ed7600000000ad3709778b2d0977b641097700000000" to virtual address "0x74A21000" (part of module "WSHIP6.DLL") "DEADMIHANA.EXE" wrote bytes "4053ed765858ee76186aee76653cef760000000000bf36750000000056cc3675000000007cca36750000000037682a756a2cef76d62def760000000020692a750000000029a6367500000000a48d2a7500000000f70e367500000000" to virtual address "0x76FE1000" (part of module "NSI.DLL") "DEADMIHANA.EXE" wrote bytes "92e6ea7679a8ef76be72ef76d62def761de2ea7605a2ef76bee3ea76616fef766841ed760050ed7600000000ad3709778b2d0977b641097700000000" to virtual address "0x744F1000" (part of module "WSHTCPIP.DLL") "DEADMIHANA.EXE" wrote bytes "db4de96a00000000" to virtual address "0x01282000" (part of module "DEADMIHANA.EXE") "DEADMIHANA.EXE" wrote bytes "ec64b7a6" to virtual address "0x6A772024" (part of module "CLR.DLL") "WINDOWSAPPLICATION23.EXE" wrote bytes "9511cda6" to virtual address "0x6A772024" (part of module "CLR.DLL") "WINDOWSAPPLICATION23.EXE" wrote bytes "db4de96a00000000" to virtual address "0x010D2000" (part of module "WINDOWSAPPLICATION23.EXE") "DEADMIHANA.EXE" wrote bytes "b3f3baab" to virtual address "0x6A772024" (part of module "CLR.DLL")28:T6b3,"" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\DEADMIHANA.EXE" (Handle: 320) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\DEADMIHANA.EXE" (Handle: 320) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\DEADMIHANA.EXE" (Handle: 320) "" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\WINDOWSAPPLICATION23.EXE" (Handle: 504) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\WINDOWSAPPLICATION23.EXE" (Handle: 504) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\WINDOWSAPPLICATION23.EXE" (Handle: 504) "DEADMIHANA.EXE" wrote 32 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 732) "DEADMIHANA.EXE" wrote 52 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 732) "DEADMIHANA.EXE" wrote 4 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 732) "DEADMIHANA.EXE" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\SubDir\Client.exe" (Handle: 636) "DEADMIHANA.EXE" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\SubDir\Client.exe" (Handle: 636) "DEADMIHANA.EXE" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\SubDir\Client.exe" (Handle: 636) "Client.exe" wrote 32 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 1216) "Client.exe" wrote 52 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 1216) "Client.exe" wrote 4 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 1216)29:T9c8,Found malicious artifacts related to "185.194.141.58": ... File SHA256: 3a53a5cc9861e2c836473c59312de5489dc8b5601229ceae9218369c6bff1f2b (AV positives: 1/70 scanned on 07/29/2018 01:30:01) File SHA256: 73c87a4e2076a685f86020025c23bc81b03e845f754efb3ffd5d12f36dc2c66f (AV positives: 14/70 scanned on 07/29/2018 00:30:16) File SHA256: 6a0967ca47c1e20835ab98d64e5809b17d5b343833563b85f9f131fa450a7116 (AV positives: 13/70 scanned on 07/28/2018 23:17:10) File SHA256: 68cffceb19e399146663fab2d20883c9211b8efabd5719393b85f15a2195a349 (AV positives: 14/70 scanned on 07/28/2018 23:08:34) File SHA256: 642cfe2a637f45ad46a0a49b78d0215f6b0844774ff4f12615b1b7e6a9d82aff (AV positives: 15/70 scanned on 07/28/2018 22:28:24) File SHA256: c8b9c8228003472c441be24283570a35a10ac3b020568cb5d19a60a851f555b7 (Date: 07/28/2018 13:41:58) File SHA256: f402641013e9e697470ed709e865646b3a4838841f8aaa9dc3ef7c1bfdaa4c73 (Date: 07/28/2018 12:00:03) File SHA256: c9a2b52c8ac925bf14a11d1073da680c4d4387720cf629d9ba825ef488b8f100 (Date: 07/28/2018 11:27:58) File SHA256: ac9cd6e14597adb65ffc1183b27c885ef966affa72bc642222d9ef0b05187a1c (Date: 07/28/2018 10:35:15) File SHA256: 8b293bc611fe8f2271fe4188af68e4df208a9e816392828ab75c3e83d95a3b84 (Date: 07/28/2018 10:06:58) Found malicious artifacts related to "95.100.252.17": ...File SHA256: 58b0eb974eb4a095ac4af32717f65b3174fa90063baa3d942d372bb28213f7ca (AV positives: 53/68 scanned on 07/29/2018 06:46:28) File SHA256: 28024e178b5065e9229228fd151ff94f1388800280f2dd0cf7f05e488c9656b7 (AV positives: 61/68 scanned on 07/29/2018 05:10:55) File SHA256: 59058bcc692d9ded42b64537f5b3fc9886f0f48fc73a5fc5831b8e5bbde40fc9 (AV positives: 60/68 scanned on 07/29/2018 05:10:05) File SHA256: 24328cac58ad08eff9240309656584388cbd33c004e78e0cf9798af3694164b4 (AV positives: 61/68 scanned on 07/29/2018 05:09:53) File SHA256: 9460f2b9f60c3dc58c9ecf346f1d0d7ca7ac1253702d8b19a5a8bf8ebfa102f6 (AV positives: 59/68 scanned on 07/29/2018 04:44:00) File SHA256: 97a6137eefaf0b302f0121c33f8e674a9909cc85c379dae455c61a21043ee171 (Date: 06/11/2018 08:23:14) File SHA256: 5720af24b695140ca39aad535ef29042b0a13c9669dcca736374bc35facea294 (Date: 06/10/2018 15:07:03) File SHA256: f70dfc7d36e37964b8c598f6ce238b462518fdcff0ce733a4d338b1b067c5e9f (Date: 06/10/2018 08:35:35) File SHA256: 2ee9c1b36a5f1be1dc750a6a7d39a9cae7ec84c99a69a6f282c50512fa51977a (Date: 06/09/2018 04:23:04) File SHA256: 02a24cf34568d9530487435be0a8fa91452ba237cead29f407b7a970973fda54 (Date: 06/09/2018 00:14:37)2a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2c:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"2c9f1ef64d6b67253a2d78806bbafdd838074a87aee634be7a0cf40e94a679e5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791185497232,"unified_at":"2026-10-05T07:31:37.232Z","metadata":{"hashes":{"sha256":"2c9f1ef64d6b67253a2d78806bbafdd838074a87aee634be7a0cf40e94a679e5","sha1":"37a344cfbb3317b8bcf9d8c65a3b6a173136eb10","md5":"2e0c7d179546fdeedf62e433d41811be","sha512":"2cf49646eeb00862b79c48483970db9da3c69ee6151886d8cbabd19b2437b8171b574f26f70b4ce1e27173d06e5fed9b716a0a935ddb3330a2ae0a0e7fec407f","ssdeep":"6144:ySncRlujNHXf500MvYmhOW5Xbos/jBOGqqqJOABVGr2OV:/42d50amz847qJfHGr2O","ssdeep_chunks":["6144:ySncRlu","6144:SncRluj","6144:ncRlujN","6144:cRlujNH","6144:RlujNHX","6144:lujNHXf","6144:ujNHXf5","6144:jNHXf50","6144:NHXf500","6144:HXf500M","6144:Xf500Mv","6144:f500MvY","6144:500MvYm","6144:00MvYmh","6144:0MvYmhO","6144:MvYmhOW","6144:vYmhOW5","6144:YmhOW5X","6144:mhOW5Xb","6144:hOW5Xbo","6144:OW5Xbos","6144:W5Xbos/","6144:5Xbos/j","6144:Xbos/jB","6144:bos/jBO","6144:os/jBOG","6144:s/jBOGq","6144:/jBOGqq","6144:jBOGqqq","6144:BOGqqqJ","6144:OGqqqJO","6144:GqqqJOA","6144:qqqJOAB","6144:qqJOABV","6144:qJOABVG","6144:JOABVGr","6144:OABVGr2","6144:ABVGr2O","6144:BVGr2OV","12288:ySncRlu","12288:SncRluj","12288:ncRlujN","12288:cRlujNH","12288:RlujNHX","12288:lujNHXf","12288:ujNHXf5","12288:jNHXf50","12288:NHXf500","12288:HXf500M","12288:Xf500Mv","12288:f500MvY","12288:500MvYm","12288:00MvYmh","12288:0MvYmhO","12288:MvYmhOW","12288:vYmhOW5","12288:YmhOW5X","12288:mhOW5Xb","12288:hOW5Xbo","12288:OW5Xbos","12288:W5Xbos/","12288:5Xbos/j","12288:Xbos/jB","12288:bos/jBO","12288:os/jBOG","12288:s/jBOGq","12288:/jBOGqq","12288:jBOGqqq","12288:BOGqqqJ","12288:OGqqqJO","12288:GqqqJOA","12288:qqqJOAB","12288:qqJOABV","12288:qJOABVG","12288:JOABVGr","12288:OABVGr2","12288:ABVGr2O","12288:BVGr2OV","6144:/42d50a","6144:42d50am","6144:2d50amz","6144:d50amz8","6144:50amz84","6144:0amz847","6144:amz847q","6144:mz847qJ","6144:z847qJf","6144:847qJfH","6144:47qJfHG","6144:7qJfHGr","6144:qJfHGr2","6144:JfHGr2O"],"imphash":"9222d372923baed7aa9dfa28449a94ea"},"file_info":{"file_name":"Blox_Bot_v0.1.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":426496,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1532848551000,"last_seen":1555348669000,"last_multi_scan":1555348669000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["bezigate","binder","bladabindi","coinminer","coinstealer","cooee","damatak","dataeye","donoff","evital","evrial","hancitor","hiddad","irc","ircbot","ircbrute","javascript","jisut","kovonionz","lizarbot","locker","lockscreen","miner","mintluks","moljec","nemucod","njrat","nownawf","occamy","onion","orcus","pemalform","proxychanger","ransomware","rat","rbot","retefe","scamapp","suaban","subti","evasive","infostealer"]},"stats":{"av":{"malicious_count":8,"suspicious_count":0,"total_engines":8},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":12},"sandbox_signatures":{"informative_count":21,"suspicious_count":20,"malicious_count":11,"total":52},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Hacktool.Win32.Binder.lo77","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"HackTool/Win32.Binder.bs","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.Gen5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Backdoor.FVDJ-1096","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.HiddenTear","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004babd11 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HackTool.Win32.Binder.bs","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Dropper.Binder.Win32.18577","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"VirTool:Vbinder","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"tactic":"Execution","technique":"Local Job Scheduling","attack_id":"T1168","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1168","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00013737-00003032-10649-27-00032701\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00013737-00003032-10649-35-00033BEC\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00013737-00003032-10649-311-00034991","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00013737-00003032-10649-141-00035173","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$25","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\DEADMIHANA.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\DEADMIHANA.EXE\")\n \"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WINDOWSAPPLICATION23.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WINDOWSAPPLICATION23.EXE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ip-api.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.194.141.58:80\"\n \"99.224.69.184:80\"\n \"95.100.252.17:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"%USERPROFILE%\\Desktop\\Celesty Binder\\Stub\\STATIC\\Stub.pdb\"\n \"%USERPROFILE%\\documents\\visual studio 2015\\Projects\\WindowsApplication23\\WindowsApplication23\\obj\\Debug\\WindowsApplication23.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\DEADMIHANA.EXE\"\n \"\" created file \"%TEMP%\\WINDOWSAPPLICATION23.EXE\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"DBWinMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\QSR_MUTEX_uX2mtFYDPninELmnsw\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"RasPbFile\"\n \"QSR_MUTEX_uX2mtFYDPninELmnsw\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /json/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0Host: ip-api.comConnection: Keep-Alive\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"DEADMIHANA.EXE\" loaded module \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 6A180000\n \"DEADMIHANA.EXE\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll\" at 69620000\n \"WINDOWSAPPLICATION23.EXE\" loaded module \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 6A180000\n \"WINDOWSAPPLICATION23.EXE\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll\" at 69620000\n \"DEADMIHANA.EXE\" loaded module \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 66DF0000\n \"Client.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 668E0000\n \"Client.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll\" at 69620000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"DEADMIHANA.EXE\" (UID: 00015043-00002808) was launched with new environment variables: \"SESSIONNAME=\"Console\"\"\n Process \"DEADMIHANA.EXE\" (UID: 00015043-00002808) was launched with modified environment variables: \"Path\"\n Process \"DEADMIHANA.EXE\" (UID: 00015043-00002808) was launched with missing environment variables: \"PROMPT\"\n Process \"Client.exe\" (UID: 00015110-00003596) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"Client.exe\" (UID: 00015110-00003596) was launched with modified environment variables: \"Path\"\n Process \"Client.exe\" (UID: 00015110-00003596) was launched with missing environment variables: \"SESSIONNAME\"\n Process \"Client.exe\" (UID: 00016220-00004060) was launched with new environment variables: \"SESSIONNAME=\"Console\"\"\n Process \"Client.exe\" (UID: 00016220-00004060) was launched with modified environment variables: \"Path\"\n Process \"Client.exe\" (UID: 00016220-00004060) was launched with missing environment variables: \"PROMPT\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"DEADMIHANA.EXE\" (UID: 00013948-00003000)\n Spawned process \"WINDOWSAPPLICATION23.EXE\" (UID: 00013980-00003056)\n Spawned process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"Quasar Client Startup\" /sc ONLOGON /tr \" ...\" (UID: 00015039-00003564), Spawned process \"DEADMIHANA.EXE\" (UID: 00015043-00002808), Spawned process \"Client.exe\" (UID: 00015110-00003596), Spawned process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"Quasar Client Startup\" /sc ONLOGON /tr \" ...\" (UID: 00016219-00004044)\n Spawned process \"Client.exe\" (UID: 00016220-00004060)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"DEADMIHANA.EXE\" (UID: 00013948-00003000)\n Spawned process \"WINDOWSAPPLICATION23.EXE\" (UID: 00013980-00003056)\n Spawned process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"Quasar Client Startup\" /sc ONLOGON /tr \" ...\" (UID: 00015039-00003564), Spawned process \"DEADMIHANA.EXE\" (UID: 00015043-00002808), Spawned process \"Client.exe\" (UID: 00015110-00003596), Spawned process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"Quasar Client Startup\" /sc ONLOGON /tr \" ...\" (UID: 00016219-00004044)\n Spawned process \"Client.exe\" (UID: 00016220-00004060)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"DEADMIHANA.EXE\" connecting to \"\\ThemeApiPort\"\n \"WINDOWSAPPLICATION23.EXE\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"\n \"Client.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"DEADMIHANA.EXE\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"WINDOWSAPPLICATION23.EXE\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://sche\"\n Pattern match: \"mas.microsoft.com/SMI/2005/WindowsSettings\"\n Heuristic match: \"WindowsApplication23.My\"\n Pattern match: \"http://freegeoip.net/xml/\"\n Pattern match: \"http://api.ipify.org/\"\n Heuristic match: \"ip-api.com\"\n Pattern match: \"http://ip-api.com/json/\"\n Pattern match: \"http://sch\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"DEADMIHANA.EXE\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")\n \"Client.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"DEADMIHANA.EXE\" opened \"\\Device\\KsecDD\"\n \"WINDOWSAPPLICATION23.EXE\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"\n \"Client.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Blox_Bot_v0.1.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"DEADMIHANA.EXE\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"WINDOWSAPPLICATION23.EXE\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"DEADMIHANA.EXE\" at 00013948-00003000-00000105-16895686233\n \"WINDOWSAPPLICATION23.EXE\" at 00013980-00003056-00000105-244447284392\n \"DEADMIHANA.EXE\" at 00015043-00002808-00000105-40659343551\n \"Client.exe\" at 00015110-00003596-00000105-42242649962","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"DEADMIHANA.EXE\" is allocating memory with PAGE_GUARD access rights\n \"WINDOWSAPPLICATION23.EXE\" is allocating memory with PAGE_GUARD access rights\n \"Client.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"* FROM Win32_BIOS\" (Indicator: \"win32_bios\"; File: \"Blox_Bot_v0.1.exe.bin\")\n \"SELECT * FROM Win32_BaseBoard\" (Indicator: \"win32_baseboard\"; File: \"Blox_Bot_v0.1.exe.bin\")\n \"t * From Win32_ComputerSystem\" (Indicator: \"win32_computersystem\"; File: \"Blox_Bot_v0.1.exe.bin\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"DEADMIHANA.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WINDOWSAPPLICATION23.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"schtasks.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Client.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"DEADMIHANA.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"WINDOWSAPPLICATION23.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"Client.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"DEADMIHANA.EXE\" sleeping for \"1566804069\" milliseconds\n \"WINDOWSAPPLICATION23.EXE\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/68 reputation engines marked \"http://api.ipify.org/\" as malicious (1% detection rate)\n 1/67 reputation engines marked \"http://ip-api.com/json/\" as malicious (1% detection rate)\n 1/68 reputation engines marked \"http://api.ipify.org\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00013737-00003032-10649-63-00031AD0\n FindResourceA@KERNEL32.DLL at 00013737-00003032-10649-202-000310C0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"DEADMIHANA.EXE\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"WINDOWSAPPLICATION23.EXE\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"DEADMIHANA.EXE\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"QUASAR CLIENT STARTUP\"; Value: \"\"%TEMP%\\DEADMIHANA.EXE\"\")\n \"Client.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"QUASAR CLIENT STARTUP\"; Value: \"\"%APPDATA%\\SubDir\\Client.exe\"\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.3.0.0\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"DEADMIHANA.EXE\" opened \"%APPDATA%\\SubDir\\Client.exe:Zone.Identifier\" with delete access\n \"Client.exe\" opened \"%APPDATA%\\SubDir\\Client.exe:Zone.Identifier\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"Blox_Bot_v0.1.exe.bin\" claimed CRC 115336 while the actual is CRC 440076","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n OutputDebugStringA\n GetModuleFileNameA\n LoadLibraryA\n LockResource\n UnhandledExceptionFilter\n GetStartupInfoW\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n LoadLibraryW\n WriteFile\n GetModuleHandleW\n IsDebuggerPresent\n TerminateProcess\n Sleep\n GetTickCount\n CreateFileA\n FindResourceA\n ShellExecuteA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$27","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"DEADMIHANA.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"WINDOWSAPPLICATION23.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"Client.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"\"DEADMIHANA.EXE\" opened \"%APPDATA%\\SubDir\\Client.exe:Zone.Identifier\" with delete access\n \"Client.exe\" opened \"%APPDATA%\\SubDir\\Client.exe:Zone.Identifier\" with delete access","origin":"API Call","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET POLICY External IP Lookup ip-api.com\" (SID: 2022082, Rev: 3, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"\n Detected alert \"ETPRO TROJAN W32/Quasar 1.3 RAT Connectivity Check\" (SID: 2823676, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"53/67 Antivirus vendors marked sample as malicious (79% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"53/67 Antivirus vendors marked sample as malicious (79% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"43/67 Antivirus vendors marked dropped file \"DEADMIHANA.EXE\" as malicious (classified as \"Generic.MSIL.PasswordStealerA\" with 64% detection rate)\n 2/68 Antivirus vendors marked dropped file \"WINDOWSAPPLICATION23.EXE\" as malicious (classified as \"Static engine \" with 2% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"43/67 Antivirus vendors marked spawned process \"DEADMIHANA.EXE\" (PID: 3000) as malicious (classified as \"Generic.MSIL.PasswordStealerA\" with 64% detection rate)\n 2/68 Antivirus vendors marked spawned process \"WINDOWSAPPLICATION23.EXE\" (PID: 3056) as malicious (classified as \"Static engine \" with 2% detection rate)\n 43/67 Antivirus vendors marked spawned process \"DEADMIHANA.EXE\" (PID: 2808) as malicious (classified as \"Generic.MSIL.PasswordStealerA\" with 64% detection rate)\n 43/67 Antivirus vendors marked spawned process \"Client.exe\" (PID: 3596) as malicious (classified as \"Generic.MSIL.PasswordStealerA\" with 64% detection rate)\n 43/67 Antivirus vendors marked spawned process \"Client.exe\" (PID: 4060) as malicious (classified as \"Generic.MSIL.PasswordStealerA\" with 64% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"\" allocated memory in \"HKCU\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$28","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$29","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ip-api.com\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00013737-00003032)\n Spawned process \"DEADMIHANA.EXE\" (UID: 00013948-00003000)\n Spawned process \"WINDOWSAPPLICATION23.EXE\" (UID: 00013980-00003056)\n Spawned process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"Quasar Client Startup\" /sc ONLOGON /tr \"%TEMP%\\DEADMIHANA.EXE\" /rl HIGHEST /f\" (UID: 00015039-00003564)\n Spawned process \"DEADMIHANA.EXE\" (UID: 00015043-00002808)\n Spawned process \"Client.exe\" (UID: 00015110-00003596)\n Spawned process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"Quasar Client Startup\" /sc ONLOGON /tr \"%APPDATA%\\SubDir\\Client.exe\" /rl HIGHEST /f\" (UID: 00016219-00004044)\n Spawned process \"Client.exe\" (UID: 00016220-00004060)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Tries to identify its external IP address"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]}]},"activity":{"stats":{"process_count":8,"spawned_processes_count":8,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":14,"imported_dlls_count":93,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":392,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["bezigate","binder","bladabindi","coinminer","coinstealer","cooee","damatak","dataeye","donoff","evital","evrial","hancitor","hiddad","irc","ircbot","ircbrute","javascript","jisut","kovonionz","lizarbot","locker","lockscreen","miner","mintluks","moljec","nemucod","njrat","nownawf","occamy","onion","orcus","pemalform","proxychanger","ransomware","rat","rbot","retefe","scamapp","suaban","subti","evasive","infostealer"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5b5d69a77ca3e116e1645893","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"HackTool.Binder","contacted_countries":["CAN","DEU","EU"],"submit_name":"Blox_Bot_v0.1.exe","analysis_start_time":"2018-07-29T08:12:19+00:00","indicators_count":{"informative":21,"suspicious":25,"malicious":15},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.194.141.58","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"address":"99.224.69.184","port":80,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"address":"95.100.252.17","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]}],"dns_resolutions":[{"domain":"ip-api.com","address":"185.194.141.58","ttl":179,"country":"Germany","registrar_name":"Internet Domain Service BS Corp.","registrar_organization":"Whois Privacy Corp.","registrar_creation_date":"2012-04-24T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]}],"http_requests":[{"host":"ip-api.com","host_ip":"185.194.141.58:80","url":"/json/","method":"GET","header":"GET /json/ HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0\nHost: ip-api.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}],"processes":[{"pid":3032,"ppid":0,"name":"Blox_Bot_v0.1.exe","command_line":"","sha256":"2c9f1ef64d6b67253a2d78806bbafdd838074a87aee634be7a0cf40e94a679e5","normalized_path":"C:\\Blox_Bot_v0.1.exe","uid":"00013737-00003032","icon":"$2a"},{"pid":3000,"ppid":3032,"name":"DEADMIHANA.EXE","command_line":"","sha256":"89a8162dae445eb70cd8d2be8934609b8c51aaeb6523552cabc306dc4e9dcc2c","normalized_path":"%TEMP%\\DEADMIHANA.EXE","parent_uid":"00013737-00003032","uid":"00013948-00003000"},{"pid":3564,"ppid":3000,"name":"schtasks.exe","command_line":"\"schtasks\" /create /tn \"Quasar Client Startup\" /sc ONLOGON /tr \"%TEMP%\\DEADMIHANA.EXE\" /rl HIGHEST /f","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00013948-00003000","uid":"00015039-00003564"},{"pid":3596,"ppid":3000,"name":"Client.exe","command_line":"","sha256":"89a8162dae445eb70cd8d2be8934609b8c51aaeb6523552cabc306dc4e9dcc2c","normalized_path":"%APPDATA%\\SubDir\\Client.exe","parent_uid":"00013948-00003000","uid":"00015110-00003596"},{"pid":4044,"ppid":3596,"name":"schtasks.exe","command_line":"\"schtasks\" /create /tn \"Quasar Client Startup\" /sc ONLOGON /tr \"%APPDATA%\\SubDir\\Client.exe\" /rl HIGHEST /f","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00015110-00003596","uid":"00016219-00004044"},{"pid":3056,"ppid":3032,"name":"WINDOWSAPPLICATION23.EXE","command_line":"","sha256":"0d0f78fe610cb85c33ed1de2aa68474fb2afe15baa08f5f34891e75e65c8b9ce","normalized_path":"%TEMP%\\WINDOWSAPPLICATION23.EXE","parent_uid":"00013737-00003032","uid":"00013980-00003056"},{"pid":2808,"ppid":0,"name":"DEADMIHANA.EXE","command_line":"","sha256":"89a8162dae445eb70cd8d2be8934609b8c51aaeb6523552cabc306dc4e9dcc2c","normalized_path":"%TEMP%\\DEADMIHANA.EXE","uid":"00015043-00002808","icon":"$2b"},{"pid":4060,"ppid":0,"name":"Client.exe","command_line":"","sha256":"89a8162dae445eb70cd8d2be8934609b8c51aaeb6523552cabc306dc4e9dcc2c","normalized_path":"%APPDATA%\\SubDir\\Client.exe","uid":"00016220-00004060","icon":"$2c"}],"all_imported_dlls":["System.Core.ni.dll","nlssorting.dll","credssp.dll","comctl32.dll","gdi32.dll","msctf.dll","dhcpcsvc.dll","setupapi.dll","apphelp.dll","clrjit.dll","RpcRtRemote.dll","ntdsapi.dll","mswsock.dll","tzres.dll","System.Runtime.Serialization.dll","rasadhlp.dll","FWPUCLNT.DLL","propsys.dll","cryptsp.dll","rasman.dll","rtutils.dll","Microsoft.VisualBasic.ni.dll","System.Runtime.Remoting.ni.dll","wbemcomn.dll","kernel32.dll","ole32.dll","mscorlib.ni.dll","version.dll","msvcrt.dll","usp10.dll","cryptbase.dll","ntmarta.dll","Wldap32.dll","profapi.dll","System.Management.ni.dll","System.ServiceModel.Internals.dll","urlmon.dll","iertutil.dll","System.ni.dll","bcrypt.dll","nsi.dll","wship6.dll","winhttp.dll","IPHLPAPI.DLL","imm32.dll","sechost.dll","clbcatq.dll","ktmw32.dll","rpcrt4.dll","mscoreei.dll","msvcr120_clr0400.dll","System.Xml.ni.dll","rasapi32.dll","WSHTCPIP.DLL","taskschd.dll","xmllite.dll","shell32.dll","shlwapi.dll","crypt32.dll","System.Configuration.ni.dll","GdiPlus.dll","rpcss.dll","devobj.dll","wbemprox.dll","dnsapi.dll","KernelBase.dll","mscoree.dll","wmiutils.dll","winnsi.dll","dwmapi.dll","System.Windows.Forms.dll","user32.dll","lpk.dll","uxtheme.dll","clr.dll","System.Drawing.ni.dll","wbemsvc.dll","SMDiagnostics.dll","ntdll.dll","oleaut32.dll","wininet.dll","msasn1.dll","mscorlib.dll","WMINet_Utils.dll","webio.dll","dhcpcsvc6.dll","ws2_32.dll","fastprox.dll","advapi32.dll","sspicli.dll","cfgmgr32.dll","System.Windows.Forms.ni.dll","rsaenh.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"DEADMIHANA.EXE","sha256":"89a8162dae445eb70cd8d2be8934609b8c51aaeb6523552cabc306dc4e9dcc2c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"name":"WINDOWSAPPLICATION23.EXE","sha256":"0d0f78fe610cb85c33ed1de2aa68474fb2afe15baa08f5f34891e75e65c8b9ce","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%TEMP%\\WINDOWSAPPLICATION23.EXE.config","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%TEMP%\\WINDOWSAPPLICATION23.EXE","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\b8de0f79bc74f6c423e1c719ee7afefd\\Microsoft.VisualBasic.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Runt73a1fc9d#\\3429c09afbdb2100c619fdeda717963d\\System.Runtime.Remoting.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\marlett.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\ariali.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\arialbd.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\arialbi.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\batang.ttc","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\cour.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\couri.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\courbd.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\courbi.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\daunpenh.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\dokchamp.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\estre.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\euphemia.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\gautami.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\gautamib.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\Vani.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\Vanib.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\gulim.ttc","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\impact.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\iskpota.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\iskpotab.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\kalinga.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\kalingab.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\kartika.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\kartikab.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\KhmerUI.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\KhmerUIb.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\LaoUI.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\LaoUIb.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\latha.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\lathab.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\lucon.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\malgun.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\malgunbd.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\mangal.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\mangalb.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\meiryo.ttc","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\meiryob.ttc","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\himalaya.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\msjh.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\msjhbd.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\msyh.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\msyhbd.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\mingliu.ttc","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\mingliub.ttc","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\monbaiti.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\msgothic.ttc","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\msmincho.ttc","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\mvboli.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\ntailu.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\ntailub.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\nyala.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\phagspa.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\phagspab.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\plantc.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\raavi.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\raavib.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\segoesc.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\segoescb.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\segoeuib.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\segoeuii.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\segoeuiz.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\seguisb.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\segoeuil.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\seguisym.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\shruti.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\shrutib.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\simsun.ttc","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\simsunb.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\sylfaen.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\taile.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\taileb.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\times.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\timesi.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\timesbd.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\timesbi.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\tunga.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\tungab.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\vrinda.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\vrindab.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\Shonar.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\Shonarb.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\msyi.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\tahoma.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\tahomabd.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\micross.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\angsa.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\angsai.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\angsab.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\angsaz.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\aparaj.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\aparajb.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\aparajbi.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\aparaji.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\cordia.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\cordiai.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\cordiab.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\cordiaz.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\ebrima.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\ebrimabd.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\gisha.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\gishabd.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\kokila.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\kokilab.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\kokilabi.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\kokilai.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\leelawad.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\leelawdb.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\msuighur.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\moolbor.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\symbol.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\utsaah.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\utsaahb.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\utsaahbi.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\utsaahi.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\vijaya.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\vijayab.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\wingding.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\modern.fon","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\roman.fon","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\script.fon","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\andlso.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\arabtype.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\simpo.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\simpbdo.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\simpfxo.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\majalla.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\majallab.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\trado.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\tradbdo.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\ahronbd.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\david.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\davidbd.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\frank.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\lvnm.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\lvnmbd.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\mriam.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\mriamc.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\nrkis.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\rod.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\simfang.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\simhei.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\simkai.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\angsau.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\angsaui.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\angsaub.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\angsauz.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\browa.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\browai.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\browab.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\browaz.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\browau.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\browaui.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\browaub.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\browauz.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\cordiau.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\cordiaub.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\cordiauz.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\cordiaui.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upcdl.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upcdi.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upcdb.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upcdbi.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upcel.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upcei.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upceb.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upcebi.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upcfl.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upcfi.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upcfb.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upcfbi.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upcil.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upcii.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upcib.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upcibi.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upcjl.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upcji.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upcjb.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upcjbi.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upckl.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upcki.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upckb.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upckbi.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upcll.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upcli.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upclb.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\upclbi.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\kaiu.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\l_10646.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\ariblk.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\calibri.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\calibrii.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\calibrib.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\calibriz.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\cambria.ttc","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\cambriai.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\cambriab.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\cambriaz.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\Candara.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\Candarai.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\Candarab.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\Candaraz.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\comic.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\comicbd.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\consola.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\consolai.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\consolab.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\consolaz.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\constan.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\constani.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\constanb.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\constanz.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\corbel.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\corbeli.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\corbelb.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\corbelz.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\framd.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\framdit.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\Gabriola.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\georgia.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\georgiai.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\georgiab.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\georgiaz.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\pala.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%APPDATA%\\SubDir","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\palai.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\palab.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\palabi.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\segoepr.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\segoeprb.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\trebuc.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\trebucit.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\trebucbd.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\trebucbi.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\verdana.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\verdanai.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\verdanab.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\verdanaz.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\webdings.ttf","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\coure.fon","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\serife.fon","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\sserife.fon","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\smalle.fon","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\smallf.fon","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\HATTEN.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\ANTQUAB.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\ANTQUABI.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\ANTQUAI.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\BKANT.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\GOTHIC.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\GOTHICB.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\GOTHICBI.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\GOTHICI.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\ARIALN.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\ARIALNB.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\ARIALNBI.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\ARIALNI.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\GARA.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\GARABD.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\GARAIT.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\MTCORSVA.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\AGENCYB.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\AGENCYR.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\ARLRDBD.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\ITCBLKAD.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\BOD_B.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\BOD_BI.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\BOD_I.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\BOD_R.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\BOD_BLAI.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\BOD_BLAR.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\BOD_CB.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\BOD_CBI.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\BOD_CI.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\BOD_CR.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\BOOKOS.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\BOOKOSB.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\BOOKOSBI.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\BOOKOSI.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\BRADHITC.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\CALIST.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\CALISTB.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\CALISTBI.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\CALISTI.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\CASTELAR.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\CENSCBK.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\SCHLBKB.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\SCHLBKBI.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\SCHLBKI.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\COPRGTB.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\COPRGTL.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%TEMP%\\DEADMIHANA.EXE.config","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%TEMP%\\DEADMIHANA.EXE","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\CURLZ___.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\ITCEDSCR.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\ELEPHNT.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\ELEPHNTI.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\ENGR.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\ERASBD.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\ERASDEMI.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%APPDATA%\\SubDir\\Client.exe.config","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%APPDATA%\\SubDir\\Client.exe","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\ERASLGHT.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\ERASMD.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\FELIXTI.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\FORTE.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\FRABK.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\FRABKIT.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\FRADM.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\FRADMIT.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\FRADMCN.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\FRAHV.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\FRAHVIT.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\FRAMDCN.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\FRSCRIPT.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\GIGI.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\GILBI___.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\GILB____.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\GILI____.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\GIL_____.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\GILC____.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\GILSANUB.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\GILLUBCD.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\GLSNECB.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\GLECB.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\GOUDOS.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\GOUDOSB.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\GOUDOSI.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\GOUDYSTO.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\IMPRISHA.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\8990487b8c05ada1e1febe7dcb6c0410\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\24db7e31c7ba5b0e824e2f521c0914bc\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\250e8e6af918e7ca66787117bc8633e3\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\LSANS.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\LSANSD.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\LSANSDI.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\LSANSI.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\LTYPE.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\LTYPEB.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\LTYPEBO.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\LTYPEO.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\MAIAN.TTF","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\75790ba48ebfa82fae7da9a114bc9886\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\a28d99c0b82e7decf411fb2587cce83f\\System.Management.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Runteb92aa12#\\293cfe2c05a8ee921726927fd00ea81c\\System.Runtime.Serialization.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Runtime.Serialization\\v4.0_4.0.0.0__b77a5c561934e089\\System.Runtime.Serialization.dll","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\SMDiagnostics\\98e3281d79512c9a2a0a89e3bc2e554f\\SMDiagnostics.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\SMDiagnostics\\v4.0_4.0.0.0__b77a5c561934e089\\SMDiagnostics.dll","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Servd1dec626#\\df55f04bc0ebe6c1abde4bc467bf4d03\\System.ServiceModel.Internals.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ServiceModel.Internals\\v4.0_4.0.0.0__31bf3856ad364e35\\System.ServiceModel.Internals.dll","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\7152ca3b4e8d992fb4be5317321c2ee5\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\870a651e78e8d414b516df1ecae18884\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\System32\\en-US\\schtasks.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\DEADMIHANA_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\CLIENT_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\QSR_MUTEX_uX2mtFYDPninELmnsw","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]},{"name":"QSR_MUTEX_uX2mtFYDPninELmnsw","sources":[{"report_type":"sandbox","report_id":"5b5d69a77ca3e116e1645893"}]}]}},"report_ids":{"sandbox_job_ids":["5b5d69a77ca3e116e1645893"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious VirTool:Vbinder Sample 2c9f1ef64d6b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2c9f1ef64d6b…. Malware family: VirTool:Vbinder. Threat score 100/100. 8/8 AV engines flagged this file. 11 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2c9f1ef64d6b67253a2d78806bbafdd838074a87aee634be7a0cf40e94a679e5"}],["$","meta","4",{"property":"og:title","content":"Malicious VirTool:Vbinder Sample 2c9f1ef64d6b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2c9f1ef64d6b…. Malware family: VirTool:Vbinder. Threat score 100/100. 8/8 AV engines flagged this file. 11 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2c9f1ef64d6b67253a2d78806bbafdd838074a87aee634be7a0cf40e94a679e5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious VirTool:Vbinder Sample 2c9f1ef64d6b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2c9f1ef64d6b…. Malware family: VirTool:Vbinder. Threat score 100/100. 8/8 AV engines flagged this file. 11 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]