24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransom.Kirk Sample 39a2201a88f1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 39a2201a88f1…. Malware family: Trojan.Ransom.Kirk. Threat score 100/100. 17/29 AV engines flagged this file. 5 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc","keywords":["Malicious","Trojan.Ransom.Kirk","malware analysis","sandbox report","threat intelligence","39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc"],"about":{"@type":"SoftwareApplication","name":"Kirk.Ransom.exe","applicationCategory":["peexe","executable"],"identifier":"39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Ransom.Kirk","antivirusDetections":{"malicious":17,"total":29},"behavioralIndicators":{"malicious":5,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T888,"Kirk.Ransom.exe" queries volume information of "C:\KIRKRA~1.EXE" at 00000000-00003336-00000046-3201155 "Kirk.Ransom.exe" queries volume information of "C:\KIRKRA~1.EXE" at 00000000-00003336-00000046-3224906 "Kirk.Ransom.exe" queries volume information of "C:\KIRKRA~1.EXE" at 00000000-00003336-00000046-3230898 "Kirk.Ransom.exe" queries volume information of "C:\KIRKRA~1.EXE" at 00000000-00003336-00000046-3235154 "Kirk.Ransom.exe" queries volume information of "C:\KIRKRA~1.EXE" at 00000000-00003336-00000046-3245955 "Kirk.Ransom.exe" queries volume information of "C:\KIRKRA~1.EXE" at 00000000-00003336-00000046-3250355 "Kirk.Ransom.exe" queries volume information of "C:\KIRKRA~1.EXE" at 00000000-00003336-00000046-3253876 "Kirk.Ransom.exe" queries volume information of "C:\KIRKRA~1.EXE" at 00000000-00003336-00000046-3259556 "Kirk.Ransom.exe" queries volume information of "C:\KIRKRA~1.EXE" at 00000000-00003336-00000046-3264222 "Kirk.Ransom.exe" queries volume information of "C:\KIRKRA~1.EXE" at 00000000-00003336-00000046-3269037 "Kirk.Ransom.exe" queries volume information of "C:\KIRKRA~1.EXE" at 00000000-00003336-00000046-3272742 "Kirk.Ransom.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI32~1\_ctypes.pyd" at 00000000-00003336-00000046-3277928 "Kirk.Ransom.exe" queries volume information of "C:\KIRKRA~1.EXE" at 00000000-00003336-00000046-3312433 "Kirk.Ransom.exe" queries volume information of "C:\KIRKRA~1.EXE" at 00000000-00003336-00000046-3317739 "Kirk.Ransom.exe" queries volume information of "C:\KIRKRA~1.EXE" at 00000000-00003336-00000046-3323261 "Kirk.Ransom.exe" queries volume information of "C:\KIRKRA~1.EXE" at 00000000-00003336-00000046-3337095 "Kirk.Ransom.exe" queries volume information of "C:\KIRKRA~1.EXE" at 00000000-00003336-00000046-3346886 "Kirk.Ransom.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI32922\tcl\encoding" at 00000000-00003336-00000046-3589103 "Kirk.Ransom.exe" queries volume information of "C:\KIRKRA~1.EXE" at 00000000-00003336-00000046-3612478 "Kirk.Ransom.exe" queries volume information of "C:\KIRKRA~1.EXE" at 00000000-00003336-00000046-361576626:T815,Found dropped filename "cp864.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp850.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp775.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp863.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp437.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp860.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp869.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "dingbats.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp1253.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp852.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "gb2312-raw.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "ascii.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp866.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp865.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp950.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp862.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp1252.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp861.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "ebcdic.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp737.enc" which has been seen in the context of ransomware (Indicator: .ENC)27:T6d4,"C:\Kirk.Ransom.exe" marked "C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml" for deletion "C:\Kirk.Ransom.exe" marked "C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml" for deletion "C:\Kirk.Ransom.exe" marked "C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml" for deletion "C:\Kirk.Ransom.exe" marked "C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml" for deletion "C:\Kirk.Ransom.exe" marked "C:\Program Files\7-Zip\Lang\cs.txt" for deletion "C:\Kirk.Ransom.exe" marked "C:\Program Files\7-Zip\Lang\cy.txt" for deletion "C:\Kirk.Ransom.exe" marked "C:\Program Files\7-Zip\Lang\ext.txt" for deletion "C:\Kirk.Ransom.exe" marked "C:\Program Files\7-Zip\Lang\gu.txt" for deletion "C:\Kirk.Ransom.exe" marked "C:\Program Files\7-Zip\Lang\id.txt" for deletion "C:\Kirk.Ransom.exe" marked "C:\Program Files\7-Zip\Lang\is.txt" for deletion "C:\Kirk.Ransom.exe" marked "C:\Program Files\7-Zip\Lang\ja.txt" for deletion "C:\Kirk.Ransom.exe" marked "C:\Program Files\7-Zip\Lang\ku.txt" for deletion "C:\Kirk.Ransom.exe" marked "C:\Program Files\7-Zip\Lang\lv.txt" for deletion "C:\Kirk.Ransom.exe" marked "C:\Program Files\7-Zip\Lang\ms.txt" for deletion "C:\Kirk.Ransom.exe" marked "C:\Program Files\7-Zip\Lang\nl.txt" for deletion "C:\Kirk.Ransom.exe" marked "C:\Program Files\7-Zip\Lang\pa-in.txt" for deletion "C:\Kirk.Ransom.exe" marked "C:\Program Files\7-Zip\Lang\ru.txt" for deletion "C:\Kirk.Ransom.exe" marked "C:\Program Files\7-Zip\Lang\sk.txt" for deletion "C:\Kirk.Ransom.exe" marked "C:\Program Files\7-Zip\Lang\ta.txt" for deletion "C:\Kirk.Ransom.exe" marked "C:\Program Files\7-Zip\Lang\uz.txt" for deletion28:T7f9,"Kirk.Ransom.exe" opened "C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml" with delete access "Kirk.Ransom.exe" opened "C:\Program Files\7-Zip\Lang\id.txt" with delete access "Kirk.Ransom.exe" opened "C:\Program Files\7-Zip\Lang\ja.txt" with delete access "Kirk.Ransom.exe" opened "C:\Program Files\7-Zip\Lang\lv.txt" with delete access "Kirk.Ransom.exe" opened "C:\Program Files\7-Zip\Lang\nl.txt" with delete access "Kirk.Ransom.exe" opened "C:\Program Files\7-Zip\Lang\pa-in.txt" with delete access "Kirk.Ransom.exe" opened "C:\Program Files\7-Zip\Lang\ru.txt" with delete access "Kirk.Ransom.exe" opened "C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.CGM" with delete access "Kirk.Ransom.exe" opened "C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML" with delete access "Kirk.Ransom.exe" opened "C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\THMBNAIL.PNG" with delete access "Kirk.Ransom.exe" opened "C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\THMBNAIL.PNG" with delete access "Kirk.Ransom.exe" opened "C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml" with delete access "Kirk.Ransom.exe" opened "C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml" with delete access "Kirk.Ransom.exe" opened "C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\THMBNAIL.PNG" with delete access "Kirk.Ransom.exe" opened "C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\THMBNAIL.PNG" with delete access "Kirk.Ransom.exe" opened "C:\Program Files\7-Zip\Lang\cy.txt" with delete access "Kirk.Ransom.exe" opened "C:\Program Files\7-Zip\Lang\ext.txt" with delete access "Kirk.Ransom.exe" opened "C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab" with delete access "Kirk.Ransom.exe" opened "C:\Program Files\7-Zip\Lang\gu.txt" with delete access "Kirk.Ransom.exe" opened "C:\Program Files\7-Zip\Lang\ku.txt" with delete access29:T878,".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI39482\Crypto.Cipher._DES3.pyd" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI39482\Microsoft.VC90.CRT.manifest" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI39482\_ctypes.pyd" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI39482\_hashlib.pyd" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI39482\tcl\encoding\cp863.enc" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI39482\tcl\encoding\cp932.enc" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI39482\tcl\encoding\gb1988.enc" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI39482\tcl\encoding\iso2022-kr.enc" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI39482\tcl\encoding\iso8859-16.enc" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI39482\tcl\encoding\iso8859-8.enc" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI39482\tcl\encoding\macGreek.enc" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI39482\tcl\encoding\macJapan.enc" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI39482\tcl\encoding\macRoman.enc" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI39482\tcl\encoding\macThai.enc" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI39482\tcl\encoding\macUkraine.enc" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI39482\Crypto.Cipher._AES.pyd" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI39482\Crypto.Cipher._DES.pyd" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI39482\Crypto.Hash._SHA256.pyd" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI39482\Crypto.Random.OSRNG.winrandom.pyd" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI39482\Crypto.Util._counter.pyd"2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAZmZniId3dwAAAAAAAAAARmZmaIiIiIiIiIh2ZERAAEZmZmiIiIiIiIiId3d3ZABGZmZoiIiIiIiIiHd3d3YARmZmeIiIiIiIiIh3d3d0AGZmZniIiIiIiIiId3d3dABmZmZ4iIiIiIiIiHd3d3QAZmZmeIiIiIiIiIh3d3dkAGZmZniIiIiIiIiId3d3YABmZmZ3d3d4iIiIiHd3d2AAZnd3d3d3d3d3d3d3d3dgBGeIi7d4iId3d3d3d3d3YARnu7u7u4////iIiId3d2AEe7u7u7u4/////////4dgBHu7u7u7uP////////+HYAY7u7u7u7j/////////hkAGO7u7u7u4/////////3ZABju7u7u7uP////////92QAY7u7u7u7iIiP//////dgAGO7u7u7u7u7v//////2YABju7u7u7uzO7//////hmAAY7u7u7u7sAO//////4ZgBGO7u7u7u7M7v/////+GYARzu7u7u7u7u4//////hmAEc7u7u7u7u7j//////4ZgBnO7u7u7iI////////+GQAZzu7u7u4//////////dkAEY7u7u7uP/////////3ZAAAO7u7u7eIj///////9mAAADu7u7szAERGd3iIj/ZgAAADM7szMAAAAAAAAEREQADgAAAH4AAAB8AAAAHAAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAABwAAAAcAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAA4AAAAOAAAADgAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAAA8AAAAfADAAH4B//Bw==2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAZmZniId3dwAAAAAAAAAARmZmaIiIiIiIiIh2ZERAAEZmZmiIiIiIiIiId3d3ZABGZmZoiIiIiIiIiHd3d3YARmZmeIiIiIiIiIh3d3d0AGZmZniIiIiIiIiId3d3dABmZmZ4iIiIiIiIiHd3d3QAZmZmeIiIiIiIiIh3d3dkAGZmZniIiIiIiIiId3d3YABmZmZ3d3d4iIiIiHd3d2AAZnd3d3d3d3d3d3d3d3dgBGeIi7d4iId3d3d3d3d3YARnu7u7u4////iIiId3d2AEe7u7u7u4/////////4dgBHu7u7u7uP////////+HYAY7u7u7u7j/////////hkAGO7u7u7u4/////////3ZABju7u7u7uP////////92QAY7u7u7u7iIiP//////dgAGO7u7u7u7u7v//////2YABju7u7u7uzO7//////hmAAY7u7u7u7sAO//////4ZgBGO7u7u7u7M7v/////+GYARzu7u7u7u7u4//////hmAEc7u7u7u7u7j//////4ZgBnO7u7u7iI////////+GQAZzu7u7u4//////////dkAEY7u7u7uP/////////3ZAAAO7u7u7eIj///////9mAAADu7u7szAERGd3iIj/ZgAAADM7szMAAAAAAAAEREQADgAAAH4AAAB8AAAAHAAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAABwAAAAcAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAA4AAAAOAAAADgAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAAA8AAAAfADAAH4B//Bw==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790818033086,"unified_at":"2026-10-01T01:27:13.086Z","metadata":{"hashes":{"sha256":"39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc","sha1":"0d4dfe880f8ec4b394f49f1a2608200dd06ba8a6","md5":"78117f7acc8b385e9b29fe711436d16d","sha512":"0a6e8732d0e9b8ec104a3d65d5629548fd1a2575ac2808c939e002601f3306726586daa87412b4698d2bba3fbb8aa383dedf9d209aa728c6859be1e79b6206e9","ssdeep":"98304:/IEyVyGHAeBysDq7g5SspYPchCPgkMOu4+vQqzKdJcqXlduupA5gEbvU0Ods+0kb:QXl/qSSspHI7vu4+vicqy5Jv6dsuV","ssdeep_chunks":["98304:/IEyVyG","98304:IEyVyGH","98304:EyVyGHA","98304:yVyGHAe","98304:VyGHAeB","98304:yGHAeBy","98304:GHAeBys","98304:HAeBysD","98304:AeBysDq","98304:eBysDq7","98304:BysDq7g","98304:ysDq7g5","98304:sDq7g5S","98304:Dq7g5Ss","98304:q7g5Ssp","98304:7g5SspY","98304:g5SspYP","98304:5SspYPc","98304:SspYPch","98304:spYPchC","98304:pYPchCP","98304:YPchCPg","98304:PchCPgk","98304:chCPgkM","98304:hCPgkMO","98304:CPgkMOu","98304:PgkMOu4","98304:gkMOu4+","98304:kMOu4+v","98304:MOu4+vQ","98304:Ou4+vQq","98304:u4+vQqz","98304:4+vQqzK","98304:+vQqzKd","98304:vQqzKdJ","98304:QqzKdJc","98304:qzKdJcq","98304:zKdJcqX","98304:KdJcqXl","98304:dJcqXld","98304:JcqXldu","98304:cqXlduu","98304:qXlduup","98304:XlduupA","98304:lduupA5","98304:duupA5g","98304:uupA5gE","98304:upA5gEb","98304:pA5gEbv","98304:A5gEbvU","98304:5gEbvU0","98304:gEbvU0O","98304:EbvU0Od","98304:bvU0Ods","98304:vU0Ods+","98304:U0Ods+0","98304:0Ods+0k","98304:Ods+0kb","196608:/IEyVyG","196608:IEyVyGH","196608:EyVyGHA","196608:yVyGHAe","196608:VyGHAeB","196608:yGHAeBy","196608:GHAeBys","196608:HAeBysD","196608:AeBysDq","196608:eBysDq7","196608:BysDq7g","196608:ysDq7g5","196608:sDq7g5S","196608:Dq7g5Ss","196608:q7g5Ssp","196608:7g5SspY","196608:g5SspYP","196608:5SspYPc","196608:SspYPch","196608:spYPchC","196608:pYPchCP","196608:YPchCPg","196608:PchCPgk","196608:chCPgkM","196608:hCPgkMO","196608:CPgkMOu","196608:PgkMOu4","196608:gkMOu4+","196608:kMOu4+v","196608:MOu4+vQ","196608:Ou4+vQq","196608:u4+vQqz","196608:4+vQqzK","196608:+vQqzKd","196608:vQqzKdJ","196608:QqzKdJc","196608:qzKdJcq","196608:zKdJcqX","196608:KdJcqXl","196608:dJcqXld","196608:JcqXldu","196608:cqXlduu","196608:qXlduup","196608:XlduupA","196608:lduupA5","196608:duupA5g","196608:uupA5gE","196608:upA5gEb","196608:pA5gEbv","196608:A5gEbvU","196608:5gEbvU0","196608:gEbvU0O","196608:EbvU0Od","196608:bvU0Ods","196608:vU0Ods+","196608:U0Ods+0","196608:0Ods+0k","196608:Ods+0kb","98304:QXl/qSS","98304:Xl/qSSs","98304:l/qSSsp","98304:/qSSspH","98304:qSSspHI","98304:SSspHI7","98304:SspHI7v","98304:spHI7vu","98304:pHI7vu4","98304:HI7vu4+","98304:I7vu4+v","98304:7vu4+vi","98304:vu4+vic","98304:u4+vicq","98304:4+vicqy","98304:+vicqy5","98304:vicqy5J","98304:icqy5Jv","98304:cqy5Jv6","98304:qy5Jv6d","98304:y5Jv6ds","98304:5Jv6dsu","98304:Jv6dsuV"],"imphash":"05a03ed18d2e75f8c4f1c5bcf287ac56"},"file_info":{"file_name":"Kirk.Ransom.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":5756255,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499287518000,"last_seen":1660523754000,"last_multi_scan":1660523754000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["abaddonpos","adware","adwind","airacrop","alienspy","alma","almanahe","alureon","andromeda","anserin","anunak","apt","apt.naikon","apt12","apt15","apt23","apt28","apt3","apt30","asprox","autoit","autorun","backdoor","bamital","bandarchor","bandook","banker","banload","bbsrat","bebloh","bedep","beebus","bernhardpos","betabot","bitcryptor","blackenergy","blackmoon","bladabindi","boaxxe","bolek","botnet","bredolab","bublik","buckeye","buterat","buzus","calcteam","camerashy","carbanak","carberp","carbonspider","careto","cerber","chanitor","chthonic","citadel","clickfraud","cmstar","coinminer","corebot","coverton","cridex","crimson","crimsoniron","cryptfile2","cryptodefense","cryptofortress","cryptojoker","cryptolocker","cryptoluck","crypton","cryptorbit","cryptoroger","cryptowall","cryptxxx","cutwail","cycbot","darkcomet","darkhotel","darkkomet","darkrat","darkstrat","dealerschoice","derusbi","detoxcrypto","diamondfox","dircrypt","dnscalc","downloader","dragon","dreambot","dridex","dubnium","duqu","dyncalc","dyre","dyreza","emdivi","emissary","emotet","enfal","etumbot","fake","fakeav","falloutteam","fancybear","fareit","fastpos","filecoder","fileless","fin7","flame","flashback","flystudio","formerfirstrat","fynloski","gamarue","glassrat","goopic","gootkit","gothicpanda","govrat","gozi","graftor","gref","group-4127","group22","group6","group74","group88","hacktool","hancitor","hawkeye","hippoteam","hupigon","hydracrypt","hyteod","infostealer","irontwilight","isfb","ixeshe","jaku","jigsaw","jrat","karagany","karba","ke3chang","kelihos","keyboy","keylogger","kimjongrat","kins","knobface","koobface","krakenrat","kryptolocker","krypton","kuluoz","lanfiltrator","locker","lockscreen","locky","lokibot","luder","luminositylink","lurid","maktub","metasploit","meterpreter","metushy","miner","mirage","mirai","mobef","moose","msil","murofet","mydoom","naikon","nanocore","nanolocker","nemim","nemucod","neshta","netwire","neutrino","neverquest","nitol","njrat","noobcrypt","numberedpanda","nymaim","onionduke","overridepanda","padcrypt","palevo","panda","papras","pawnstorm","pcclient","petya","pfinet","philadelphia","piratepanda","pirpi","plaunit78020","playfuldragon","plugx","poisonivy","pony","pos","poweliks","predator","promethiumm","qadars","qakbot","qhost","qrat","quedagh","r980","radamant","ramdo","ramnit","ransomlock","ransomware","rat","ratty","redyms","regin","remsec","rootkit","rovnix","sakula","sality","samsam","sandworm","sandwormteam","sasfis","scieron","screenlocker","sednit","shamoon","shifu","shimrat","shiz","simda","sinowal","snake","snslocker","socialnetworkteam","sofacy","spambot","spammer","spora","spyeye","spyware","stealer","stration","strongpity","strontium","stuxnet","swallowtail","swisyn","synolocker","tag_0530","tag_0700","tapaoux","temp.noble","teslacrypt","tg-0110","tg-2754","tg-4127","themask","tinba","tinbanker","tinybanker","tinyloader","tinyzbot","tofsee","torlocker","torpig","torrentlocker","trojan","troldesh","tsarteam","turkojan","turla","turlagroup","turlateam","unlock92","upatre","ups","upsteam","uroburos","ursnif","vaultcrypt","vawtrak","venomousbear","venuslocker","virut","vixenpanda","vobfus","voodoobear","waledac","wanacrypt0r","wannacry","warezov","waterbug","wcry","webshell","wraith","xratlocker","zbot","zcrypt","zeroaccess","zerolocker","zeus","zlob","zxshell","Kirk"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":13},"sandbox_signatures":{"informative_count":19,"suspicious_count":17,"malicious_count":5,"total":41},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Ransom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/KirkRansom.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Kirk.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Kirk.A (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Python/Filecoder.Kirk.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Kirky","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Gen.cyk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FLWD!78117F7ACC8B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.KirkRansom.fflnyb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-EJN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Ransom.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_KIRK.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_KIRK.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Hoax.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Ransom.Kirk","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query local/system time"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"malicious","value":"Reads mail related files"}],"sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Creates a writable file in a temporary directory"}],"sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003292-34504-1-004014E0\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003292-34504-121-00409B60\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003336-34629-1-004014E0\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003336-34629-116-00409B60","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003292-34504-90-00409AB0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003336-34629-85-00409AB0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003292-34504-90-00409AB0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003336-34629-85-00409AB0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Kirk.Ransom.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Kirk.Ransom.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$25","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"Kirk.Ransom.exe\" (UID: 00000000-00003336) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\", _MEIPASS2=\"%TEMP%\\_MEI32922\"\"\n Process \"Kirk.Ransom.exe\" (UID: 00000000-00003336) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Kirk.Ransom.exe\" (UID: 00000000-00003336)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"Kirk.Ransom.exe\" (UID: 00000000-00003336)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"Kirk.Ransom.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"calendar_single_orange.png.kirked\" has type \"data\"\n \"AG00135_.GIF.kirked\" has type \"data\"\n \"DGWEBSBR.XML.kirked\" has type \"data\"\n \"fa.msg\" has type \"ASCII text\"\n \"display_filters.txt.kirked\" has type \"data\"\n \"button_left_mouseover.png.kirked\" has type \"data\"\n \"BD15059_.GIF.kirked\" has type \"data\"\n \"BD14513_.GIF.kirked\" has type \"data\"\n \"fo_fo.msg\" has type \"ASCII text\"\n \"faf_field_grabber.png.kirked\" has type \"data\"\n \"com.jrockit.mc.console.ui_5.5.1.172852.jar.kirked\" has type \"data\"\n \"BD21505_.GIF.kirked\" has type \"data\"\n \"ffjcext.zip.kirked\" has type \"data\"\n \"blocklist.xml.kirked\" has type \"data\"\n \"babypink.png.kirked\" has type \"data\"\n \"com.jrockit.mc.components.ui.zh_CN_5.5.1.172852.jar.kirked\" has type \"data\"\n \"derbyLocale_fr.jar.kirked\" has type \"data\"\n \"about.html.kirked\" has type \"data\"\n \"arrow-left.gif.kirked\" has type \"data\"\n \"Inovar.xml.kirked\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \";kT|goTNM@q.tR\"\n Heuristic match: \":tMtRs.Ge\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Kirk.Ransom.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"Kirk.Ransom.exe\" at 00000000-00003336-00000033-17256835","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rdata\n .rsrc with unusual entropies 7.01235997654\n 7.5169618376","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Kirk.Ransom.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"otnm@q.tr\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Detects sample launching another instance of itself","description":"C:\\Kirk.Ransom.exe","origin":"API Call","relevance":8,"id":"api-8704","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"Kirk.Ransom.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The analysis extracted file with a known ransomware suffix","description":"$26","origin":"Binary File","relevance":10,"id":"binary-22","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"Kirk.Ransom.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"Kirk.Ransom.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSAPPCOMPAT\")","origin":"Registry Access","mitre_attack_id":"T1021.001","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$27","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$28","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc.bin\" claimed CRC 153666 while the actual is CRC 5820317","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n GetTickCount\n VirtualProtect\n LoadLibraryA\n GetCommandLineW\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n GetProcAddress\n GetModuleHandleA\n GetTempPathW\n TerminateProcess\n CreateProcessW\n Sleep","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"Kirk.Ransom.exe\" wrote bytes \"c0df1a771cf91977ccf819770d641b7700000000c0111a7500000000fc3e1a7500000000e0131a75000000009457cc7625e01a77c6e01a7700000000bc6acb7600000000cf311a75000000009319cc76000000002c321a7500000000\" to virtual address \"0x75371000\" (part of module \"NSI.DLL\")\n \"Kirk.Ransom.exe\" wrote bytes \"71118d007a3b8c00ab8b02007f950200fc8c0200729602006cc805001ecd89007d268900\" to virtual address \"0x769307E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"Kirk.Ransom.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"Kirk.Ransom.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"Kirk.Ransom.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Kirk.Ransom.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc.bin\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"42/67 Antivirus vendors marked sample as malicious (62% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"42/67 Antivirus vendors marked sample as malicious (62% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"42/67 Antivirus vendors marked spawned process \"Kirk.Ransom.exe\" (PID: 3336) as malicious (classified as \"Trojan.Ransom.Kirk\" with 62% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Reads mail related files","description":"\"Kirk.Ransom.exe\" read 65536 bytes from file \"%PROGRAMFILES%\\Windows Mail\\wab.exe\"\n \"Kirk.Ransom.exe\" read 8192 bytes from file \"%PROGRAMFILES%\\Windows Mail\\wab.exe\"","origin":"API Call","mitre_attack_id":"T1114.001","relevance":5,"id":"api-52","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"DllHost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"$29","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"tcl85.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"tk85.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"DllHost.exe\" touched \"SHACCT Profile Notification Handler\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{56EA1054-1959-467F-BE3B-A2A787C4B6EA}\")\n \"DllHost.exe\" touched \"PSIProfileNotify\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}\")\n \"DllHost.exe\" touched \"Identity Store Profile Notification\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{ECF5BF46-E3B6-449A-B56B-43F58F867814}\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\System32\\tzres.dll\"\n \".exe\" touched file \"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui\"\n \".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \".exe\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"tcl85.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"python27.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"tk85.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"tcl85.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"python27.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"tk85.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"1/69 Antivirus vendors marked dropped file \"python27.dll\" as malicious (classified as \"Trojan.Raas\" with 1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"The analysis extracted file with a known ransomware suffix"}],"sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Reads mail related files"}],"sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":40,"dropped_files_count":0,"extracted_files_count":52,"files_written_count":249,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["abaddonpos","adware","adwind","airacrop","alienspy","alma","almanahe","alureon","andromeda","anserin","anunak","apt","apt.naikon","apt12","apt15","apt23","apt28","apt3","apt30","asprox","autoit","autorun","backdoor","bamital","bandarchor","bandook","banker","banload","bbsrat","bebloh","bedep","beebus","bernhardpos","betabot","bitcryptor","blackenergy","blackmoon","bladabindi","boaxxe","bolek","botnet","bredolab","bublik","buckeye","buterat","buzus","calcteam","camerashy","carbanak","carberp","carbonspider","careto","cerber","chanitor","chthonic","citadel","clickfraud","cmstar","coinminer","corebot","coverton","cridex","crimson","crimsoniron","cryptfile2","cryptodefense","cryptofortress","cryptojoker","cryptolocker","cryptoluck","crypton","cryptorbit","cryptoroger","cryptowall","cryptxxx","cutwail","cycbot","darkcomet","darkhotel","darkkomet","darkrat","darkstrat","dealerschoice","derusbi","detoxcrypto","diamondfox","dircrypt","dnscalc","downloader","dragon","dreambot","dridex","dubnium","duqu","dyncalc","dyre","dyreza","emdivi","emissary","emotet","enfal","etumbot","fake","fakeav","falloutteam","fancybear","fareit","fastpos","filecoder","fileless","fin7","flame","flashback","flystudio","formerfirstrat","fynloski","gamarue","glassrat","goopic","gootkit","gothicpanda","govrat","gozi","graftor","gref","group-4127","group22","group6","group74","group88","hacktool","hancitor","hawkeye","hippoteam","hupigon","hydracrypt","hyteod","infostealer","irontwilight","isfb","ixeshe","jaku","jigsaw","jrat","karagany","karba","ke3chang","kelihos","keyboy","keylogger","kimjongrat","kins","knobface","koobface","krakenrat","kryptolocker","krypton","kuluoz","lanfiltrator","locker","lockscreen","locky","lokibot","luder","luminositylink","lurid","maktub","metasploit","meterpreter","metushy","miner","mirage","mirai","mobef","moose","msil","murofet","mydoom","naikon","nanocore","nanolocker","nemim","nemucod","neshta","netwire","neutrino","neverquest","nitol","njrat","noobcrypt","numberedpanda","nymaim","onionduke","overridepanda","padcrypt","palevo","panda","papras","pawnstorm","pcclient","petya","pfinet","philadelphia","piratepanda","pirpi","plaunit78020","playfuldragon","plugx","poisonivy","pony","pos","poweliks","predator","promethiumm","qadars","qakbot","qhost","qrat","quedagh","r980","radamant","ramdo","ramnit","ransomlock","ransomware","rat","ratty","redyms","regin","remsec","rootkit","rovnix","sakula","sality","samsam","sandworm","sandwormteam","sasfis","scieron","screenlocker","sednit","shamoon","shifu","shimrat","shiz","simda","sinowal","snake","snslocker","socialnetworkteam","sofacy","spambot","spammer","spora","spyeye","spyware","stealer","stration","strongpity","strontium","stuxnet","swallowtail","swisyn","synolocker","tag_0530","tag_0700","tapaoux","temp.noble","teslacrypt","tg-0110","tg-2754","tg-4127","themask","tinba","tinbanker","tinybanker","tinyloader","tinyzbot","tofsee","torlocker","torpig","torrentlocker","trojan","troldesh","tsarteam","turkojan","turla","turlagroup","turlateam","unlock92","upatre","ups","upsteam","uroburos","ursnif","vaultcrypt","vawtrak","venomousbear","venuslocker","virut","vixenpanda","vobfus","voodoobear","waledac","wanacrypt0r","wannacry","warezov","waterbug","wcry","webshell","wraith","xratlocker","zbot","zcrypt","zeroaccess","zerolocker","zeus","zlob","zxshell","Kirk"],"sample_flags":["Multi-Process","Extracted Files","User Comment","Simulated analysis"],"sandbox_reports":[{"id":"61b40b56a715ba133a3838a0","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Ransom.Kirk","submit_name":"Kirk.Ransom.exe","analysis_start_time":"2021-12-11T02:22:16+00:00","indicators_count":{"informative":13,"suspicious":22,"malicious":5},"tags":["Multi-Process","Extracted Files","User Comment","Simulated analysis"],"is_in_unified_schema":true},{"id":"61982c01463fdd559853ccc2","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Ransom.Kirk","submit_name":"39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc","analysis_start_time":"2021-11-19T22:58:12+00:00","indicators_count":{"informative":19,"suspicious":21,"malicious":5},"tags":["Multi-Process","Extracted Files","User Comment","Simulated analysis"],"is_in_unified_schema":true},{"id":"61981c18fa0ba3133761099e","environment_id":100,"environment_description":"Windows 7 32 bit","state":"ERROR","error_type":"Failed to save report to webservice","verdict":"undetected","submit_name":"39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc","analysis_start_time":"2021-11-19T21:50:16+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"58cb047daac2edfd5af5c8ec","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":93,"malware_family":"Trojan.Agent","submit_name":"39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc","analysis_start_time":"2017-03-16T22:34:36+00:00","indicators_count":{"informative":9,"suspicious":13,"malicious":3},"tags":["Multi-Process","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}],"processes":[{"pid":3096,"ppid":0,"name":"DllHost.exe","command_line":"/Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}","sha256":"f7ad4b09afb301ce46df695b22114331a57d52e6d4163ff74787bf68ccf44c78","normalized_path":"%WINDIR%\\system32\\DllHost.exe","uid":"00000000-00003096","icon":"$2a"},{"pid":3948,"ppid":0,"name":"39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc.exe","command_line":"","sha256":"39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc","normalized_path":"C:\\39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc.exe","uid":"00000000-00003948","icon":"$2b"},{"pid":3576,"ppid":3948,"name":"39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc.exe","command_line":"","sha256":"39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc","normalized_path":"C:\\39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc.exe","parent_uid":"00000000-00003948","uid":"00000000-00003576"}],"all_imported_dlls":["kernel32.dll","user32.dll","msvcrt.dll","ole32.dll","msvcr90.dll","clbcatq.dll","ntdll.dll","usp10.dll","advapi32.dll","cryptbase.dll","nsi.dll","oleaut32.dll","tzres.dll","shell32.dll","uxtheme.dll","rpcrt4.dll","wow64win.dll","imm32.dll","api-ms-win-core-synch-l1-2-0.dll","tcl85.dll","dwmapi.dll","cryptsp.dll","apphelp.dll","gdi32.dll","sechost.dll","ws2_32.dll","wow64cpu.dll","comctl32.dll","KernelBase.dll","lpk.dll","sspicli.dll","wow64.dll","shlwapi.dll","comdlg32.dll","python27.dll","tk85.dll","rsaenh.dll","imageres.dll","msctf.dll","rpcss.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"calendar_single_orange.png.kirked","sha256":"7d08d99c9fbc5f6d9973dde6829e3d2f9727a687e321ddcb5f071aeee8ae643c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"}]},{"name":"AG00135_.GIF.kirked","sha256":"a3f932b1b993e7cf3ba4002c08fda16b12310a59426f96a450af5c2fa326accc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"name":"DGWEBSBR.XML.kirked","sha256":"7876bd6f943870cc1282bc4260d666e7bcd62e7634234e2058c016ec08bfc952","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"}]},{"name":"fa.msg","sha256":"f9ca4819e8c8b044d7d68c97fc67e0f4ccd6245e30024161dab24d0f7c3a9683","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"}]},{"name":"display_filters.txt.kirked","sha256":"675a6a258f5611f965e7bb4b8d05cbf76665c46979d7aad570bb4975946eb16a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"}]},{"name":"button_left_mouseover.png.kirked","sha256":"3cf20479298b692884532f56d203ae74faae0b2e650013cffd397df9fb8a8845","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"}]},{"name":"BD15059_.GIF.kirked","sha256":"95c537f46e68df008821f3a69001809e1cc272765d2889cc47c6733eb36a8e1d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"name":"BD14513_.GIF.kirked","sha256":"b336d251c5749f1fe6365b727d9ee633e604b3edc3e9abd7ecf99ca057f4ffa9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"name":"fo_fo.msg","sha256":"7145b57ac5c074bca968580b337c04a71bbd6efb93afaf291c1361fd700dc791","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"}]},{"name":"faf_field_grabber.png.kirked","sha256":"29f6f21e2dbd7fbf34e6d5affc8ade54e65de267e49bbf182bb95522297b7b69","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"}]},{"name":"com.jrockit.mc.console.ui_5.5.1.172852.jar.kirked","sha256":"e17a35bdda4335501a1e4a7ab3033c4cfa5d1bb646447e2ba4b3d95184adc933","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"}]},{"name":"BD21505_.GIF.kirked","sha256":"7275c946a8d1817107f8b17f451183da688a5c399a3c408f018d75576d55b8f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"name":"ffjcext.zip.kirked","sha256":"c23a15588ccd53e5355e2ad5ce7029cee4f592eedc30767b60fd426d7f27aad4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"}]},{"name":"blocklist.xml.kirked","sha256":"64c9c213a651f99296f90d3a6eb9ee30595fbc05f668835c1128038845547d73","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"}]},{"name":"babypink.png.kirked","sha256":"6e6334394b37dd59c6ba9211021c8b407ac7354d8a38633fb01883e6bcb7ee04","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"name":"com.jrockit.mc.components.ui.zh_CN_5.5.1.172852.jar.kirked","sha256":"7784d26da1f892e5a02a56418d2945319af60b08bdafd0722068fb082d9b2a95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"}]},{"name":"derbyLocale_fr.jar.kirked","sha256":"77fe933afbf37fc82e5147a63472e78732d97484d9375807d15dec609e85c3b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"}]},{"name":"about.html.kirked","sha256":"20c2bdf50af01092251b821bc14d7ee18f61bdadf219e41e95834febbcede74a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"}]},{"name":"arrow-left.gif.kirked","sha256":"ff2368ba1ea63258ca3470ab624ff2c1c31817825b4cbd5cb82061ea265c1ab3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"}]},{"name":"Inovar.xml.kirked","sha256":"ec0cd11231b5991f125a82ecdf408d9fbb38bfa31aa9e89f4187a093b3f02260","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61b40b56a715ba133a3838a0"}]},{"name":"python27.dll","sha256":"19bd517ed3fa62d94e1103592d0d35d3a16fa5fea020ee9379e9d9f58c177aa1","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"name":"tcl85.dll","sha256":"d947ff20950215c58d446ba6c2a9276fdd916aee9037540d5535b0ad1644c038","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"name":"tk85.dll","sha256":"0e731b2d9b2abaf90cb9cc973e826ede8d7c923ccd0d646eeafc09c2b33f8a57","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"name":"Crypto.Cipher._DES.pyd","sha256":"1bb4e0d2460ab5b61d2ee08cd0634f0d911c2739529cdeb1dd20e98013be3883","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"name":"Crypto.Cipher._DES3.pyd","sha256":"33f03a9413ffca0ad7589f014403112c0714578c03c495fe7808f56d8ab02de2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"name":"Crypto.Hash._SHA256.pyd","sha256":"7ab6462bbe944352645f712161959b06762b676ea3755763cc03216c1100a948","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"name":"Crypto.Util.strxor.pyd","sha256":"0048f401ad04089e54a2716247dd05e25dd8a3e9115a1590c6ea6604c99dcc7f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"name":"Microsoft.VC90.CRT.manifest","sha256":"c0d4a525c4015f7d2e68483eb62b2d5005b397db2d0586644ccc32c69208569c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"name":"bz2.pyd","sha256":"69b4ec17de1368a9ea62313954629e1ace3f414a7eaedcedbfc79b110cadbaac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"name":"loic_win32.exe.manifest","sha256":"7eee7cbe0443a884cd7f5298701d96dcadf138ca667a3c704fa9541430b6b629","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"name":"select.pyd","sha256":"039981e17c2eb88cb2d08e50f2d323027e27683a7b3b3bc042e76fba40d34ab2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"name":"auto.tcl","sha256":"6082f2eb2af9cd53fd5ac819b19acbf428027107ce0b80d9ad836cde1d091b43","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"name":"clock.tcl","sha256":"d2aeffa593947ca60bda3ec7ae9d2b54273f9ed2f4a3d0b630a157ab3cd98fd4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"name":"ascii.enc","sha256":"294c97175fd0894093b866e73548ae660aeed0c3cc1e73867eb66e52d34c0dd2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"name":"big5.enc","sha256":"465ae2d4880b8006b1476cd60facf676875438244c1d93a7dbe4cde1035e745f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"name":"cp1250.enc","sha256":"1b42df7e7d6b0feb17cb0bc8d97e6ce6899492306dd880c48a39d1a2f0279004","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"name":"cp1251.enc","sha256":"2d1bed2422e131a140087faf1b12b8a46f7de3b6413bae8bc395c06f0d70b9b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"name":"cp1252.enc","sha256":"14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"name":"cp1253.enc","sha256":"2174d94e1c1d5ad93717b9e8c20569ed95a8af51b2d3ab2bce99f1a887049c0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"name":"cp1254.enc","sha256":"bc4cbe4c99fd65abea45fbdaf28cc1d5c42119280125fbbd5c2c11892ae460b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"name":"cp1255.enc","sha256":"f8bd79ae5a90e5390d77dc31cb3065b0f93cb8813c9e67accec72e2db2027a08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"name":"cp1256.enc","sha256":"bbacea81d4f7a3a7f3c036273a4534d31dbf8b6b5cca2bcc4c00cb1593cf03d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"name":"Casey","sha256":"63f6001a9f330a9ef8c28dc9eb003c216ba3799ade5404ec23fa77049f801208","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"name":"capture.cpp.kirked","sha256":"18a5b7ae58a62f1a51bbea1e62645c4a8097f3d6080d27fa45c74289f21c5b74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"name":"authen.h.kirked","sha256":"57a024f60447eda4da6c469a523c821c83bed2c711eb54d8a0401502927b07ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"name":"clrver.exe.kirked","sha256":"ebc2b91d56eea7d9c7c3353ad3d1d76c00b1912565de24c63f1dcff914a8b5cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"name":"command.cpp.kirked","sha256":"e3cca33765e05553751aa83021dd4a642fb6378c72e391c72e7a87f73e016f40","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"name":"comdlg.tcl","sha256":"2591bbd2bc87d8f551a12d5f7f3f3ef21f070244e5eba62e09db003787f91790","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"name":"calendardeviceservice.h.kirked","sha256":"c35df78203166af59e689f6941be183b7eaa6b8c918cb3711953031dc9cbb0fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"name":"binder.h.kirked","sha256":"ab173ef9fa44addd834b0f67b2ab1459a890aac48ed3f0ce31f035993e8b0971","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"name":"AcroRd32.exe.kirked","sha256":"72b4de034b5797e1f6395e0d22ba0ee6eb43b0f53a42ddb3ab72495f42eabc17","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"name":"boxed-split.avi.kirked","sha256":"d082226f603ce0200e1315f5470a4ff31918229364d22c5c39e4f42eee4864c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]}],"files_written":[{"path":"%TEMP%\\_MEI39482\\Crypto.Cipher._DES3.pyd","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\Microsoft.VC90.CRT.manifest","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp863.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp932.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\gb1988.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\iso2022-kr.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\iso8859-16.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\iso8859-8.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\macGreek.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\macJapan.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\macRoman.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\macThai.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\macUkraine.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39~1","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"C:\\39A220~1.EXE","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39~1\\pyimod00_crypto_key.pyd","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39~1\\pyimod00_crypto_key.py","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39~1\\pyimod00_crypto_key.pyw","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39~1\\pyimod00_crypto_key.pyc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39~1\\tcl","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"C:\\Users\\hPNOTkm","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl8.5\\encoding","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\lib\\tcl8.5\\encoding","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%LOCALAPPDATA%\\library\\encoding","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp1252.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"C:\\pwd","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\init.tcl","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%USERPROFILE%\\.Xdefaults","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"C:\\lib\\tclIndex","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI39482\\tclIndex","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\tclIndex","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\auto.tcl","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tk\\tk.tcl","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\tm.tcl","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\package.tcl","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tk\\pkgIndex.tcl","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\http1.0\\pkgIndex.tcl","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\opt0.4\\pkgIndex.tcl","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"C:\\39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc.exe","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"},{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI39482","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\Crypto.Cipher._AES.pyd","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\Crypto.Cipher._DES.pyd","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\Crypto.Hash._SHA256.pyd","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\Crypto.Random.OSRNG.winrandom.pyd","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\Crypto.Util._counter.pyd","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\Crypto.Util.strxor.pyd","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\_tkinter.pyd","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\bz2.pyd","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\msvcm90.dll","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\msvcp90.dll","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\msvcr90.dll","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\select.pyd","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl85.dll","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tk85.dll","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\clock.tcl","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\ascii.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\big5.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp1250.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp1251.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp1253.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp1254.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp1255.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp1256.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp1257.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp1258.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp437.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp737.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp775.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp850.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp852.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp855.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp857.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp860.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp861.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp862.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp864.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp865.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp866.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp869.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp874.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp936.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp949.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\cp950.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\dingbats.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\ebcdic.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\euc-cn.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\euc-jp.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\euc-kr.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\gb12345.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\gb2312-raw.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\gb2312.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\iso2022-jp.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\iso2022.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\iso8859-1.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\iso8859-10.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\iso8859-13.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\iso8859-14.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\iso8859-15.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\iso8859-2.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\iso8859-3.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\iso8859-4.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\iso8859-5.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\iso8859-6.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\iso8859-7.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\iso8859-9.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\jis0201.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\jis0208.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\jis0212.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\koi8-r.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\koi8-u.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\ksc5601.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\macCentEuro.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\macCroatian.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\macCyrillic.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\macDingbats.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\macIceland.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\macRomania.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\macTurkish.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI39482\\tcl\\encoding\\shiftjis.enc","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]},{"path":"%TEMP%\\_MEI21082","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\Crypto.Cipher._AES.pyd","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\Crypto.Cipher._DES.pyd","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\Crypto.Cipher._DES3.pyd","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\Crypto.Hash._SHA256.pyd","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\Crypto.Random.OSRNG.winrandom.pyd","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\Crypto.Util._counter.pyd","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\Crypto.Util.strxor.pyd","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\Microsoft.VC90.CRT.manifest","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\_tkinter.pyd","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\bz2.pyd","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\msvcm90.dll","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\msvcp90.dll","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\msvcr90.dll","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\select.pyd","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl85.dll","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tk85.dll","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\clock.tcl","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\ascii.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\big5.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp1250.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp1251.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp1253.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp1254.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp1255.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp1256.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp1257.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp1258.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp437.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp737.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp775.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp850.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp852.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp855.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp857.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp860.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp861.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp862.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp863.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp864.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp865.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp866.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp869.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp874.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp932.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp936.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp949.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp950.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\dingbats.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\ebcdic.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\euc-cn.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\euc-jp.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\euc-kr.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\gb12345.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\gb1988.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\gb2312-raw.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\gb2312.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\iso2022-jp.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\iso2022-kr.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\iso2022.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\iso8859-1.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\iso8859-10.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\iso8859-13.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\iso8859-14.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\iso8859-15.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\iso8859-16.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\iso8859-2.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\iso8859-3.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\iso8859-4.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\iso8859-5.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\iso8859-6.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\iso8859-7.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\iso8859-8.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\iso8859-9.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\jis0201.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\jis0208.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\jis0212.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\koi8-r.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\koi8-u.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\ksc5601.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\macCentEuro.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\macCroatian.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\macCyrillic.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\macDingbats.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\macGreek.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\macIceland.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\macJapan.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\macRoman.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\macRomania.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\macThai.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\macTurkish.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\macUkraine.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\shiftjis.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21~1","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%WINDIR%\\system32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21~1\\pyimod00_crypto_key.pyd","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21~1\\pyimod00_crypto_key.py","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21~1\\pyimod00_crypto_key.pyw","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21~1\\pyimod00_crypto_key.pyc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21~1\\tcl","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl8.5\\encoding","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\encoding\\cp1252.enc","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\init.tcl","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tclIndex","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\tclIndex","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\auto.tcl","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tk\\tk.tcl","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\tm.tcl","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\package.tcl","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tk\\pkgIndex.tcl","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\http1.0\\pkgIndex.tcl","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"%TEMP%\\_MEI21082\\tcl\\opt0.4\\pkgIndex.tcl","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]},{"path":"C:\\Users\\VBXgeyW","sources":[{"report_type":"sandbox","report_id":"58cb047daac2edfd5af5c8ec"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\IDENTITYSTORE\\CACHE\\S-1-5-21-2092356043-4041700817-663127204-1001\\","sources":[{"report_type":"sandbox","report_id":"61982c01463fdd559853ccc2"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["61982c01463fdd559853ccc2","61b40b56a715ba133a3838a0","58cb047daac2edfd5af5c8ec"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Ransom.Kirk Sample 39a2201a88f1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 39a2201a88f1…. Malware family: Trojan.Ransom.Kirk. Threat score 100/100. 17/29 AV engines flagged this file. 5 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Ransom.Kirk Sample 39a2201a88f1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 39a2201a88f1…. Malware family: Trojan.Ransom.Kirk. Threat score 100/100. 17/29 AV engines flagged this file. 5 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Ransom.Kirk Sample 39a2201a88f1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 39a2201a88f1…. Malware family: Trojan.Ransom.Kirk. Threat score 100/100. 17/29 AV engines flagged this file. 5 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]