26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 34:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T48c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Exploit.BypassUAC Sample 3fa4b6d0419d… — Score 68/100 — Hybrid Analysis","description":"Malicious verdict for sample 3fa4b6d0419d…. Malware family: Exploit.BypassUAC. Threat score 68/100. 1/1 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3fa4b6d0419d69d0c35532f40b358c3af7315397e8952851442af523d69d49ec","keywords":["Malicious","Exploit.BypassUAC","malware analysis","sandbox report","threat intelligence","3fa4b6d0419d69d0c35532f40b358c3af7315397e8952851442af523d69d49ec"],"about":{"@type":"SoftwareApplication","name":"vanguard.exe","applicationCategory":["peexe","executable"],"identifier":"3fa4b6d0419d69d0c35532f40b358c3af7315397e8952851442af523d69d49ec","additionalType":"Malicious sample"},"threatScore":68,"malwareFamily":"Exploit.BypassUAC","antivirusDetections":{"malicious":1,"total":1},"behavioralIndicators":{"malicious":2,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T51d,Spawned process "cmd.exe" with commandline "cmd /C "PING -n 5 127.0.0.1>nul & %TEMP%\del.bat"" (UID: 00018999-00002368) Spawned process "PING.EXE" with commandline "PING -n 5 127.0.0.1" (UID: 00019028-00001500) Spawned process "msword.exe" (UID: 00019342-00002500) Spawned process "cmd.exe" with commandline "cmd /C attrib +h %TEMP%\msword.exe" (UID: 00019757-00002616) Spawned process "cmd.exe" with commandline "cmd /C "eventvwr.exe & PING -n 15 127.0.0.1>nul & %TEMP%\msword.exe"" (UID: 00019761-00002652) Spawned process "attrib.exe" with commandline "attrib +h %TEMP%\msword.exe" (UID: 00019767-00002564) Spawned process "eventvwr.exe" (UID: 00019781-00002588) Spawned process "msword.exe" (UID: 00019806-00002684) Spawned process "PING.EXE" with commandline "PING -n 15 127.0.0.1" (UID: 00019814-00002628) Spawned process "msword.exe" (UID: 00020195-00002748) Spawned process "cmd.exe" with commandline "cmd /C attrib +h %TEMP%\msword.exe" (UID: 00020331-00002784) Spawned process "cmd.exe" with commandline "/C vssadmin delete shadows /all /quiet" (UID: 00020342-00002740) Spawned process "attrib.exe" with commandline "attrib +h %TEMP%\msword.exe" (UID: 00020369-00002572) Spawned process "vssadmin.exe" with commandline "vssadmin delete shadows /all /quiet" (UID: 00020370-00002676)28:T2d62,Heuristic match: "**big.Int" Heuristic match: "*pkix.Name" Heuristic match: "*[]*big.Int" Heuristic match: "*reflect.name" Heuristic match: "*runtime.name" Pattern match: "golang.org/x/sys/windows" Heuristic match: "*func(*big.Int) *big.Int" Pattern match: "github.com/satori/go.uuid" Pattern match: "github.com/stretchr/powerwalk" Pattern match: "golang.org/x/sys/windows/registry" Pattern match: "type..hash.sync/atomic.Value" Pattern match: "type..eq.sync/atomic.Value" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.(*Func).Name" Heuristic match: "runtime.name.name" Heuristic match: "sync.(*Once).Do" Heuristic match: "unicode.to" Heuristic match: "unicode.To" Heuristic match: "os.(*File).Name" Heuristic match: "os.(*fileStat).Name" Heuristic match: "reflect.(*rtype).Name" Heuristic match: "reflect.(*rtype).In" Heuristic match: "reflect.Value.Int" Heuristic match: "reflect.(*funcType).Name" Heuristic match: "reflect.(*funcType).In" Heuristic match: "reflect.(*interfaceType).Name" Heuristic match: "reflect.(*interfaceType).In" Heuristic match: "reflect.(*structType).Name" Heuristic match: "reflect.(*structType).In" Heuristic match: "reflect.(*ptrType).Name" Heuristic match: "reflect.(*ptrType).In" Heuristic match: "reflect.(*funcTypeFixed4).Name" Heuristic match: "reflect.(*funcTypeFixed4).In" Heuristic match: "reflect.(*funcTypeFixed8).Name" Heuristic match: "reflect.(*funcTypeFixed8).In" Heuristic match: "reflect.(*funcTypeFixed16).Name" Heuristic match: "reflect.(*funcTypeFixed16).In" Heuristic match: "reflect.(*funcTypeFixed32).Name" Heuristic match: "reflect.(*funcTypeFixed32).In" Heuristic match: "reflect.(*funcTypeFixed64).Name" Heuristic match: "reflect.(*funcTypeFixed64).In" Heuristic match: "reflect.(*funcTypeFixed128).Name" Heuristic match: "reflect.(*funcTypeFixed128).In" Heuristic match: "reflect.(*sliceType).Name" Heuristic match: "reflect.(*sliceType).In" Pattern match: "type..hash.math/rand.Rand" Pattern match: "type..eq.math/rand.Rand" Pattern match: "type..hash.math/rand.lockedSource" Pattern match: "type..eq.math/rand.lockedSource" Heuristic match: "crypto/rand.Int" Pattern match: "type..hash.net/url.Error" Pattern match: "type..eq.net/url.Error" Pattern match: "type..hash.net/url.Userinfo" Pattern match: "type..eq.net/url.Userinfo" Pattern match: "type..hash.net/url.URL" Pattern match: "type..eq.net/url.URL" Pattern match: "type..hash.net/http/httptrace.GotConnInfo" Pattern match: "type..eq.net/http/httptrace.GotConnInfo" Pattern match: "type..hash.net/http/internal.chunkedReader" Pattern match: "type..eq.net/http/internal.chunkedReader" Heuristic match: "net/http.(*Client).Do" Pattern match: "type..hash.net/http.httpError" Pattern match: "type..eq.net/http.httpError" Pattern match: "type..hash.net/http.http2FrameHeader" Pattern match: "type..eq.net/http.http2FrameHeader" Pattern match: "type..hash.net/http.http2resAndError" Pattern match: "type..eq.net/http.http2resAndError" Pattern match: "type..hash.net/http.http2PriorityParam" Pattern match: "type..eq.net/http.http2PriorityParam" Pattern match: "type..hash.net/http.http2Setting" Pattern match: "type..eq.net/http.http2Setting" Pattern match: "type..hash.net/http.connectMethodKey" Pattern match: "type..eq.net/http.connectMethodKey" Pattern match: "type..hash.net/http.responseAndError" Pattern match: "type..eq.net/http.responseAndError" Pattern match: "type..hash.net/http.requestAndChan" Pattern match: "type..eq.net/http.requestAndChan" Pattern match: "type..hash.net/http.connectMethod" Pattern match: "type..eq.net/http.connectMethod" Pattern match: "type..hash.net/http.http2dialCall" Pattern match: "type..eq.net/http.http2dialCall" Pattern match: "type..hash.net/http.http2addConnCall" Pattern match: "type..eq.net/http.http2addConnCall" Pattern match: "type..hash.net/http.http2StreamError" Pattern match: "type..eq.net/http.http2StreamError" Pattern match: "type..hash.net/http.http2connError" Pattern match: "type..eq.net/http.http2connError" Pattern match: "type..hash.net/http.http2PingFrame" Pattern match: "type..eq.net/http.http2PingFrame" Pattern match: "type..hash.net/http.http2WindowUpdateFrame" Pattern match: "type..eq.net/http.http2WindowUpdateFrame" Pattern match: "type..hash.net/http.http2PriorityFrame" Pattern match: "type..eq.net/http.http2PriorityFrame" Pattern match: "type..hash.net/http.http2RSTStreamFrame" Pattern match: "type..eq.net/http.http2RSTStreamFrame" Pattern match: "type..hash.net/http.http2httpError" Pattern match: "type..eq.net/http.http2httpError" Pattern match: "type..hash.net/http.http2stickyErrWriter" Pattern match: "type..eq.net/http.http2stickyErrWriter" Pattern match: "type..hash.net/http.http2badStringError" Pattern match: "type..eq.net/http.http2badStringError" Pattern match: "type..hash.net/http.http2GoAwayError" Pattern match: "type..eq.net/http.http2GoAwayError" Pattern match: "type..hash.net/http.http2gzipReader" Pattern match: "type..eq.net/http.http2gzipReader" Pattern match: "type..hash.net/http.badStringError" Pattern match: "type..eq.net/http.badStringError" Pattern match: "type..hash.net/http.readResult" Pattern match: "type..eq.net/http.readResult" Pattern match: "type..hash.net/http.dialRes" Pattern match: "type..eq.net/http.dialRes" Pattern match: "type..hash.net/http.gzipReader" Pattern match: "type..eq.net/http.gzipReader" Pattern match: "type..hash.os/user.User" Pattern match: "type..eq.os/user.User" Pattern match: "github.com/satori/go%2euuid.safeRandom" Pattern match: "github.com/satori/go%2euuid.UUID.String" Pattern match: "github.com/satori/go%2euuid.UUID.MarshalText" Pattern match: "github.com/satori/go%2euuid.(*UUID).UnmarshalText" Pattern match: "github.com/satori/go%2euuid.UUID.Value" Pattern match: "github.com/satori/go%2euuid.FromString" Pattern match: "github.com/satori/go%2euuid.NewV4" Pattern match: "github.com/satori/go%2euuid.init" Pattern match: "github.com/satori/go%2euuid.(*UUID).String" Pattern match: "github.com/satori/go%2euuid.(*UUID).MarshalText" Pattern match: "github.com/satori/go%2euuid.(*UUID).Value" Pattern match: "github.com/stretchr/powerwalk.Walk" Pattern match: "github.com/stretchr/powerwalk.WalkLimit" Pattern match: "github.com/stretchr/powerwalk.WalkLimit.func1" Pattern match: "github.com/stretchr/powerwalk.WalkLimit.func2" Pattern match: "github.com/stretchr/powerwalk.WalkLimit.func3.1" Pattern match: "github.com/stretchr/powerwalk.WalkLimit.func3" Pattern match: "github.com/stretchr/powerwalk.init" Pattern match: "type..hash.github.com/stretchr/powerwalk.walkArgs" Pattern match: "type..eq.github.com/stretchr/powerwalk.walkArgs" Pattern match: "golang.org/x/sys/windows.(*DLLError).Error" Pattern match: "golang.org/x/sys/windows.LoadDLL" Pattern match: "golang.org/x/sys/windows.(*DLL).FindProc" Pattern match: "golang.org/x/sys/windows.(*LazyDLL).Load" Pattern match: "golang.org/x/sys/windows.(*LazyDLL).NewProc" Pattern match: "golang.org/x/sys/windows.NewLazySystemDLL" Pattern match: "golang.org/x/sys/windows.(*LazyProc).Find" Pattern match: "golang.org/x/sys/windows.(*LazyProc).mustFind" Pattern match: "golang.org/x/sys/windows.(*LazyProc).Addr" Pattern match: "golang.org/x/sys/windows.initCanDoSearchSystem32" Pattern match: "golang.org/x/sys/windows.canDoSearchSystem32" Pattern match: "golang.org/x/sys/windows.isBaseName" Pattern match: "golang.org/x/sys/windows.loadLibraryEx" Pattern match: "golang.org/x/sys/windows.errString.Error" Pattern match: "golang.org/x/sys/windows.Getenv" Pattern match: "golang.org/x/sys/windows.CloseOnExec" Pattern match: "golang.org/x/sys/windows.ByteSliceFromString" Pattern match: "golang.org/x/sys/windows.BytePtrFromString" Pattern match: "golang.org/x/sys/windows.UTF16FromString" Pattern match: "golang.org/x/sys/windows.UTF16PtrFromString" Pattern match: "golang.org/x/sys/windows.Close" Pattern match: "golang.org/x/sys/windows.getStdHandle" Pattern match: "golang.org/x/sys/windows.LoadLibraryEx" Pattern match: "golang.org/x/sys/windows._LoadLibraryEx" Pattern match: "golang.org/x/sys/windows.CreateFile" Pattern match: "golang.org/x/sys/windows.CloseHandle" Pattern match: "golang.org/x/sys/windows.GetStdHandle" Pattern match: "golang.org/x/sys/windows.SetFileTime" Pattern match: "golang.org/x/sys/windows.SetHandleInformation" Pattern match: "golang.org/x/sys/windows.init" Pattern match: "golang.org/x/sys/windows.(*errString).Error" Pattern match: "type..hash.golang.org/x/sys/windows.DLLError" Pattern match: "type..eq.golang.org/x/sys/windows.DLLError" Pattern match: "type..hash.golang.org/x/sys/windows.DLL" Pattern match: "type..eq.golang.org/x/sys/windows.DLL" Pattern match: "type..hash.golang.org/x/sys/windows.Proc" Pattern match: "type..eq.golang.org/x/sys/windows.Proc" Pattern match: "type..hash.golang.org/x/sys/windows.LazyDLL" Pattern match: "type..eq.golang.org/x/sys/windows.LazyDLL" Pattern match: "type..hash.golang.org/x/sys/windows.LazyProc" Pattern match: "type..eq.golang.org/x/sys/windows.LazyProc" Pattern match: "golang.org/x/sys/windows.v" Pattern match: "golang.org/x/sys/windows.getprocaddress" Pattern match: "golang.org/x/sys/windows.loadlibrary" Pattern match: "golang.org/x/sys/windows/registry.Key.Close" Pattern match: "golang.org/x/sys/windows/registry.OpenKey" Pattern match: "golang.org/x/sys/windows/registry.CreateKey" Pattern match: "golang.org/x/sys/windows/registry.DeleteKey" Pattern match: "golang.org/x/sys/windows/registry.(*KeyInfo).ModTime" Pattern match: "golang.org/x/sys/windows/registry.Key.Stat" Pattern match: "golang.org/x/sys/windows/registry.Key.getValue" Pattern match: "golang.org/x/sys/windows/registry.Key.GetStringValue" Pattern match: "golang.org/x/sys/windows/registry.Key.setValue" Pattern match: "golang.org/x/sys/windows/registry.Key.SetDWordValue" Pattern match: "golang.org/x/sys/windows/registry.Key.setStringValue" Pattern match: "golang.org/x/sys/windows/registry.Key.SetStringValue" Pattern match: "golang.org/x/sys/windows/registry.Key.DeleteValue" Pattern match: "golang.org/x/sys/windows/registry.Key.ReadValueNames" Pattern match: "golang.org/x/sys/windows/registry.regCreateKeyEx" Pattern match: "golang.org/x/sys/windows/registry.regDeleteKey" Pattern match: "golang.org/x/sys/windows/registry.regSetValueEx" Pattern match: "golang.org/x/sys/windows/registry.regEnumValue" Pattern match: "golang.org/x/sys/windows/registry.regDeleteValue" Pattern match: "golang.org/x/sys/windows/registry.init" Pattern match: "golang.org/x/sys/windows/registry.(*Key).Close" Pattern match: "type..hash.os/exec.Error" Pattern match: "type..eq.os/exec.Error" Pattern match: "golang.org/x/sys/windows/registry/zsyscall_windows.go" Pattern match: "golang.org/x/sys/windows/registry/value.go" Pattern match: "golang.org/x/sys/windows/registry/key.go" Pattern match: "golang.org/x/sys/windows/asm_windows_386.s" Pattern match: "golang.org/x/sys/windows/ztypes_windows_386.go" Pattern match: "golang.org/x/sys/windows/zsyscall_windows.go" Pattern match: "golang.org/x/sys/windows/syscall_windows.go" Pattern match: "golang.org/x/sys/windows/syscall.go" Pattern match: "golang.org/x/sys/windows/exec_windows.go" Pattern match: "golang.org/x/sys/windows/env_windows.go" Pattern match: "golang.org/x/sys/windows/dll_windows.go" Pattern match: "github.com/stretchr/powerwalk/doc.go" Pattern match: "github.com/stretchr/powerwalk/walker.go" Pattern match: "github.com/satori/go.uuid/uuid.go"29:T6a8,"" wrote bytes "7739a97779a8ad77be72ad77d62dad771de2a87705a2ad77c868ac7757d1b377bee3a877616fad776841ab770050ab7700000000ad3720778b2d2077b641207700000000" to virtual address "0x75601000" (part of module "WSHIP6.DLL") "" wrote bytes "92e6a87779a8ad77be72ad77d62dad771de2a87705a2ad77bee3a877616fad776841ab770050ab7700000000ad3720778b2d2077b641207700000000" to virtual address "0x750E1000" (part of module "WSHTCPIP.DLL") "" wrote bytes "4053ab775858ac77186aac77653cad770000000000bf28770000000056cc2877000000007cca2877000000003768c5756a2cad77d62dad77000000002069c5750000000029a6287700000000a48dc57500000000f70e287700000000" to virtual address "0x77151000" (part of module "NSI.DLL") "PING.EXE" wrote bytes "4053ab775858ac77186aac77653cad770000000000bf28770000000056cc2877000000007cca2877000000003768c5756a2cad77d62dad77000000002069c5750000000029a6287700000000a48dc57500000000f70e287700000000" to virtual address "0x77151000" (part of module "NSI.DLL") "msword.exe" wrote bytes "7739a97779a8ad77be72ad77d62dad771de2a87705a2ad77c868ac7757d1b377bee3a877616fad776841ab770050ab7700000000ad3720778b2d2077b641207700000000" to virtual address "0x75601000" (part of module "WSHIP6.DLL") "msword.exe" wrote bytes "92e6a87779a8ad77be72ad77d62dad771de2a87705a2ad77bee3a877616fad776841ab770050ab7700000000ad3720778b2d2077b641207700000000" to virtual address "0x750E1000" (part of module "WSHTCPIP.DLL") "msword.exe" wrote bytes "4053ab775858ac77186aac77653cad770000000000bf28770000000056cc2877000000007cca2877000000003768c5756a2cad77d62dad77000000002069c5750000000029a6287700000000a48dc57500000000f70e287700000000" to virtual address "0x77151000" (part of module "NSI.DLL")2a:T558,Spawned process "" (UID: 00018495-00002248) Spawned process "cmd.exe" with commandline "cmd /C "PING -n 5 127.0.0.1>nul & %TEMP%\del.bat"" (UID: 00018999-00002368) Spawned process "PING.EXE" with commandline "PING -n 5 127.0.0.1" (UID: 00019028-00001500) Spawned process "msword.exe" (UID: 00019342-00002500) Spawned process "cmd.exe" with commandline "cmd /C attrib +h %TEMP%\msword.exe" (UID: 00019757-00002616) Spawned process "cmd.exe" with commandline "cmd /C "eventvwr.exe & PING -n 15 127.0.0.1>nul & %TEMP%\msword.exe"" (UID: 00019761-00002652) Spawned process "attrib.exe" with commandline "attrib +h %TEMP%\msword.exe" (UID: 00019767-00002564) Spawned process "eventvwr.exe" (UID: 00019781-00002588) Spawned process "msword.exe" (UID: 00019806-00002684) Spawned process "PING.EXE" with commandline "PING -n 15 127.0.0.1" (UID: 00019814-00002628) Spawned process "msword.exe" (UID: 00020195-00002748) Spawned process "cmd.exe" with commandline "cmd /C attrib +h %TEMP%\msword.exe" (UID: 00020331-00002784) Spawned process "cmd.exe" with commandline "/C vssadmin delete shadows /all /quiet" (UID: 00020342-00002740) Spawned process "attrib.exe" with commandline "attrib +h %TEMP%\msword.exe" (UID: 00020369-00002572) Spawned process "vssadmin.exe" with commandline "vssadmin delete shadows /all /quiet" (UID: 00020370-00002676)2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmd4/2ZmZmZmZmZmZmZmd4j///9mZmZmZmZmZmZmb///////b/////ZmZmZmZm///////2/////2ZmZmZmZv//////9v////9mZmZmZmb////4//ZmZmb/ZmZmZmZm/4aPdo/2ZmZm/2ZmZmZmZv92f2aP9v////9mZmZmZmb/Z29mf/b/////ZmZmZmZm/2dnZ2/2ZmZm/2ZmZmZmZvhoZmho9mZmZv9mZmZmZmb4b3Z/aPb/////ZmZmZmZm92+Gj2f2/////2ZmZmZmZv//+P//9mZmZv9mZmZmZmb///////ZmZmb/ZmZmZmZm///////2/////2ZmZmZmZv//////9v////9mZmZmZmb///////b/////ZmZmZmZmZ3iP///2ZmZmZmZmZmZmZmZmZneP9mZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==2d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAB3dwAAAAAAAAAAAAAAAHd3d4cQAAAAAAAAAAAHd3d3iIiHhwAAAAAAAAd3d3iIiIiIh4cAAAAAAAAHeHiIiIiHd4eHAAAAAAAId3d4iHd3d3iHhwAAAAAAB4d3d3dxF3iIh4cAAAAAAAiHd3hxEREXd4eHAAAAAAAId3d4cfd/F4iHh3cAAAAAB4eHdxGf9xGIh4cAAAAAAAiHd3gXf/cRd4eHAAAAAAAId3h4d/efF4iHhwAAAAAAB4eIeHd3cRiIh4cAAAAAAAiHiHiIcRd4iIeHAAAAAAAId3h4iIiIiIiHhwAAAAAAB4eIeIiIiIiIh4cAAAAAAAiHiHiIczMzN4eHAAAAAAAId3h4iDuzC7OHhwAAAAAAB4eIeIiLuzu3h4cAAAAAAAiHiHiIg7MLOIf3AAAAAAAId3h4iIezC3iH9wAAAAAAB4eIeIiIszuIh/cAAAAAAAiHiHiIiDu3iIf3AAAAAAAId3h4iIiDOIj39wAAAAAAB4eIeIiIiIiI9/cAAAAAAAiHiH+IiIiIiPf3AAAAAAAId3h/iIiIiIiH9wAAAAAAB4eIeIiHd3d3j4cAAAAAAAiHd3d4iP///4iHAAAAAAAId4j4iIh3d3d3dwAAAAAAAIh3d3d3d3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//+A///4AH//AAAP8AAAB/AAAAfAAAAHwAAAB8AAAA/AAAB/wAAB/8AAAf/AAAH/wAAB/8AAAf/AAAH/wAAB/8AAAf/AAAH/wAAB/8AAAf/AAAH/wAAB/8AAAf/AAAH/wAAB/8AAAf/AAAH/wAAB/8AAAf/AAAH/4AD///////w==30:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmd4/2ZmZmZmZmZmZmZmd4j///9mZmZmZmZmZmZmb///////b/////ZmZmZmZm///////2/////2ZmZmZmZv//////9v////9mZmZmZmb////4//ZmZmb/ZmZmZmZm/4aPdo/2ZmZm/2ZmZmZmZv92f2aP9v////9mZmZmZmb/Z29mf/b/////ZmZmZmZm/2dnZ2/2ZmZm/2ZmZmZmZvhoZmho9mZmZv9mZmZmZmb4b3Z/aPb/////ZmZmZmZm92+Gj2f2/////2ZmZmZmZv//+P//9mZmZv9mZmZmZmb///////ZmZmb/ZmZmZmZm///////2/////2ZmZmZmZv//////9v////9mZmZmZmb///////b/////ZmZmZmZmZ3iP///2ZmZmZmZmZmZmZmZmZneP9mZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==31:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==32:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==33:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmd4/2ZmZmZmZmZmZmZmd4j///9mZmZmZmZmZmZmb///////b/////ZmZmZmZm///////2/////2ZmZmZmZv//////9v////9mZmZmZmb////4//ZmZmb/ZmZmZmZm/4aPdo/2ZmZm/2ZmZmZmZv92f2aP9v////9mZmZmZmb/Z29mf/b/////ZmZmZmZm/2dnZ2/2ZmZm/2ZmZmZmZvhoZmho9mZmZv9mZmZmZmb4b3Z/aPb/////ZmZmZmZm92+Gj2f2/////2ZmZmZmZv//+P//9mZmZv9mZmZmZmb///////ZmZmb/ZmZmZmZm///////2/////2ZmZmZmZv//////9v////9mZmZmZmb///////b/////ZmZmZmZmZ3iP///2ZmZmZmZmZmZmZmZmZneP9mZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"3fa4b6d0419d69d0c35532f40b358c3af7315397e8952851442af523d69d49ec","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":68,"unified_at_epoch_ms":1790440363521,"unified_at":"2026-09-26T16:32:43.521Z","metadata":{"hashes":{"sha256":"3fa4b6d0419d69d0c35532f40b358c3af7315397e8952851442af523d69d49ec","sha1":"efa8c95d6dc13e3e067a893c5e190fc88e2dba5d","md5":"c1ecbeab431839baedca41693ce5c20d","sha512":"ac3b3ded47dbbd2a0a30c2360320842ec4d4733c6dc305b224eea75f7decaf8cfa02b3c1a47b40aee21c0763a9f33a34058928a368953296fe15f05263d0fb36","ssdeep":"49152:g7AMFYCkdHPKaWQ/lK3OUDhCbr1dCmimHqxrIav6J0zoBpveWmxWTj:/Ck1TWuI+aD2j","ssdeep_chunks":["49152:g7AMFYC","49152:7AMFYCk","49152:AMFYCkd","49152:MFYCkdH","49152:FYCkdHP","49152:YCkdHPK","49152:CkdHPKa","49152:kdHPKaW","49152:dHPKaWQ","49152:HPKaWQ/","49152:PKaWQ/l","49152:KaWQ/lK","49152:aWQ/lK3","49152:WQ/lK3O","49152:Q/lK3OU","49152:/lK3OUD","49152:lK3OUDh","49152:K3OUDhC","49152:3OUDhCb","49152:OUDhCbr","49152:UDhCbr1","49152:DhCbr1d","49152:hCbr1dC","49152:Cbr1dCm","49152:br1dCmi","49152:r1dCmim","49152:1dCmimH","49152:dCmimHq","49152:CmimHqx","49152:mimHqxr","49152:imHqxrI","49152:mHqxrIa","49152:HqxrIav","49152:qxrIav6","49152:xrIav6J","49152:rIav6J0","49152:Iav6J0z","49152:av6J0zo","49152:v6J0zoB","49152:6J0zoBp","49152:J0zoBpv","49152:0zoBpve","49152:zoBpveW","49152:oBpveWm","49152:BpveWmx","49152:pveWmxW","49152:veWmxWT","49152:eWmxWTj","98304:g7AMFYC","98304:7AMFYCk","98304:AMFYCkd","98304:MFYCkdH","98304:FYCkdHP","98304:YCkdHPK","98304:CkdHPKa","98304:kdHPKaW","98304:dHPKaWQ","98304:HPKaWQ/","98304:PKaWQ/l","98304:KaWQ/lK","98304:aWQ/lK3","98304:WQ/lK3O","98304:Q/lK3OU","98304:/lK3OUD","98304:lK3OUDh","98304:K3OUDhC","98304:3OUDhCb","98304:OUDhCbr","98304:UDhCbr1","98304:DhCbr1d","98304:hCbr1dC","98304:Cbr1dCm","98304:br1dCmi","98304:r1dCmim","98304:1dCmimH","98304:dCmimHq","98304:CmimHqx","98304:mimHqxr","98304:imHqxrI","98304:mHqxrIa","98304:HqxrIav","98304:qxrIav6","98304:xrIav6J","98304:rIav6J0","98304:Iav6J0z","98304:av6J0zo","98304:v6J0zoB","98304:6J0zoBp","98304:J0zoBpv","98304:0zoBpve","98304:zoBpveW","98304:oBpveWm","98304:BpveWmx","98304:pveWmxW","98304:veWmxWT","98304:eWmxWTj","49152:/Ck1TWu","49152:Ck1TWuI","49152:k1TWuI+","49152:1TWuI+a","49152:TWuI+aD","49152:WuI+aD2","49152:uI+aD2j"],"imphash":"f4cc01c5888458a51fcb49aa4355a29d"},"file_info":{"file_name":"vanguard.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":3442176,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499287884000,"last_seen":1626849737000,"last_multi_scan":1626849737000}},"detections":{"summary":{"verdict":"malicious","score":68,"tags":["ransomware"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":1},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":8,"suspicious_count":15,"malicious_count":2,"total":25},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Exploit.BypassUAC","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\msword.exe\"\n \"\" created file \"%TEMP%\\del.bat\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\Vanguard\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /C \"PING -n 5 127.0.0.1>nul & %TEMP%\\del.bat\"\" on 2017-2-23.06:16:27.451\n \"cmd /C attrib +h %TEMP%\\msword.exe\" on 2017-2-23.06:16:34.837\n \"cmd /C \"eventvwr.exe & PING -n 15 127.0.0.1>nul & %TEMP%\\msword.exe\"\" on 2017-2-23.06:16:34.891\n \"cmd /C attrib +h %TEMP%\\msword.exe\" on 2017-2-23.06:16:40.683\n \"/C vssadmin delete shadows /all /quiet\" on 2017-2-23.06:16:40.732","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$27","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"msword.exe\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"\n \"del.bat\" has type \"DOS batch file ASCII text with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%WINDIR%\\System32\\wshtcpip.dll\"\n \"\" touched file \"%WINDIR%\\System32\\wship6.dll\"\n \"\" touched file \"%WINDIR%\\System32\\wshqos.dll\"\n \"msword.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"msword.exe\" touched file \"%WINDIR%\\System32\\wshtcpip.dll\"\n \"msword.exe\" touched file \"%WINDIR%\\System32\\wship6.dll\"\n \"msword.exe\" touched file \"%WINDIR%\\System32\\wshqos.dll\"\n \"msword.exe\" touched file \"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui\"\n \"msword.exe\" touched file \"%WINDIR%\\System32\\msxml3r.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"msword.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"msword.exe\" at 00019806-00002684-00000105-48484726","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"PING.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"eventvwr.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"msword.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"msword.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"msword.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"msword.exe\" called \"OpenService\" to access the \"VSS\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"msword.exe\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"msword.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"VANGUARD\"; Value: \"%TEMP%\\msword.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \">1.3.6.1.5.5.7.3.1\"\n Heuristic match: \"1.3.6.1.4.1.311.10.3.3\"\n Heuristic match: \"cmd /C \"PING -n 5 127.0.0.1>nul & %TEMP%\\del.bat\"\"\n Heuristic match: \"PING -n 5 127.0.0.1\"\n Heuristic match: \"cmd /C \"eventvwr.exe & PING -n 15 127.0.0.1>nul & %TEMP%\\msword.exe\"\"\n Heuristic match: \"PING -n 15 127.0.0.1\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks network status using ping","description":"Process \"PING.EXE\" with commandline \"PING -n 5 127.0.0.1\" (UID: 00019028-00001500)\n Process \"PING.EXE\" with commandline \"PING -n 15 127.0.0.1\" (UID: 00019814-00002628)","origin":"Monitored Target","relevance":5,"id":"target-22","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"eventvwr.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"eventvwr.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"eventvwr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryW\n LoadLibraryA\n GetProcAddress\n GetThreadContext\n CreateThread\n WriteFile\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$29","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"attrib.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"vanguard.exe.bin\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by Ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00020370-00002676)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2a","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Deletes volume snapshots (often used by Ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]}]},"activity":{"stats":{"process_count":15,"spawned_processes_count":15,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":5,"imported_dlls_count":59,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":18,"files_deleted_count":0,"registry_keys_created_count":7,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Multi-Process","Extracted Files","User Comment"],"sandbox_reports":[{"id":"58aeee2faac2ed201e2d5656","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":68,"submit_name":"vanguard.exe","analysis_start_time":"2017-02-23T15:14:50+00:00","indicators_count":{"informative":8,"suspicious":19,"malicious":3},"tags":["Multi-Process","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}],"processes":[{"pid":2248,"ppid":0,"name":"vanguard.exe","command_line":"","normalized_path":"C:\\vanguard.exe","uid":"00018495-00002248","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFLSURBVFhH7Va7EsFAFPU9fsAP+AEKLbVoFTqdGa1QmVGoKDIqlUehQ4voNFGgYhSqK2fNnckYyYbYpNmd2ck+kj1nzz13s6l0oUNJ1lSS4MDWBLQCXyuQqw6oZk7Imtm0O1wIJYqRAwlky30ymmNqDVa03DgC7FNRQsA5XX0B3ydAQFb8SPoqIFvQO68JBHmAlfpLCFbbIznnlzdsNwNQZVkQiUCxPqJMqSvWMIdrkW54omAc80xA5pmfFGj0FgL0dn9QxU1HtAEKFbxklJnQmu8FEKTHjtHGE30eVxoC3invvtaeCmDuQxmlBDjWWaMvgGE6ViHvHslegynxABbl3TIghwL+iIUAu58BYUKoAH/IUsxrzp+y4JOs8AVMyPFX7gFZbJWeA2HAlRFI/HcM0yR6IfFzbaxXsihXrbDffn0pDbtw2Pc0Aa3AEwBVL6K7a4YRAAAAAElFTkSuQmCC"},{"pid":2368,"ppid":2248,"name":"cmd.exe","command_line":"cmd /C \"PING -n 5 127.0.0.1>nul & %TEMP%\\del.bat\"","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00018495-00002248","uid":"00018999-00002368","icon":"$2b"},{"pid":1500,"ppid":2368,"name":"PING.EXE","command_line":"PING -n 5 127.0.0.1","normalized_path":"%WINDIR%\\System32\\PING.EXE","parent_uid":"00018999-00002368","uid":"00019028-00001500"},{"pid":2500,"ppid":2368,"name":"msword.exe","command_line":"","normalized_path":"%TEMP%\\msword.exe","parent_uid":"00018999-00002368","uid":"00019342-00002500","icon":"$2c"},{"pid":2616,"ppid":2500,"name":"cmd.exe","command_line":"cmd /C attrib +h %TEMP%\\msword.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00019342-00002500","uid":"00019757-00002616","icon":"$2d"},{"pid":2564,"ppid":2616,"name":"attrib.exe","command_line":"attrib +h %TEMP%\\msword.exe","normalized_path":"%WINDIR%\\System32\\attrib.exe","parent_uid":"00019757-00002616","uid":"00019767-00002564"},{"pid":2652,"ppid":2500,"name":"cmd.exe","command_line":"cmd /C \"eventvwr.exe & PING -n 15 127.0.0.1>nul & %TEMP%\\msword.exe\"","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00019342-00002500","uid":"00019761-00002652","icon":"$2e"},{"pid":2588,"ppid":2652,"name":"eventvwr.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\eventvwr.exe","parent_uid":"00019761-00002652","uid":"00019781-00002588","icon":"$2f"},{"pid":2684,"ppid":2588,"name":"msword.exe","command_line":"","normalized_path":"%TEMP%\\msword.exe","parent_uid":"00019781-00002588","uid":"00019806-00002684","icon":"$30"},{"pid":2784,"ppid":2684,"name":"cmd.exe","command_line":"cmd /C attrib +h %TEMP%\\msword.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00019806-00002684","uid":"00020331-00002784","icon":"$31"},{"pid":2572,"ppid":2784,"name":"attrib.exe","command_line":"attrib +h %TEMP%\\msword.exe","normalized_path":"%WINDIR%\\System32\\attrib.exe","parent_uid":"00020331-00002784","uid":"00020369-00002572"},{"pid":2740,"ppid":2684,"name":"cmd.exe","command_line":"/C vssadmin delete shadows /all /quiet","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00019806-00002684","uid":"00020342-00002740","icon":"$32"},{"pid":2676,"ppid":2740,"name":"vssadmin.exe","command_line":"vssadmin delete shadows /all /quiet","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00020342-00002740","uid":"00020370-00002676"},{"pid":2628,"ppid":2652,"name":"PING.EXE","command_line":"PING -n 15 127.0.0.1","normalized_path":"%WINDIR%\\System32\\PING.EXE","parent_uid":"00019761-00002652","uid":"00019814-00002628"},{"pid":2748,"ppid":2652,"name":"msword.exe","command_line":"","normalized_path":"%TEMP%\\msword.exe","parent_uid":"00019761-00002652","uid":"00020195-00002748","icon":"$33"}],"all_imported_dlls":["msctf.dll","wshqos.dll","msxml3.dll","usp10.dll","WSHTCPIP.DLL","apphelp.dll","clbcatq.dll","spp.dll","vsstrace.dll","msvcrt.dll","ws2_32.dll","shell32.dll","shlwapi.dll","cryptbase.dll","winbrand.dll","rsaenh.dll","vss_ps.dll","winnsi.dll","urlmon.dll","srclient.dll","cfgmgr32.dll","devobj.dll","user32.dll","sechost.dll","uxtheme.dll","Wldap32.dll","msasn1.dll","rpcss.dll","gdi32.dll","nsi.dll","mswsock.dll","wininet.dll","atl.dll","lpk.dll","imm32.dll","sspicli.dll","ntdll.dll","IPHLPAPI.DLL","vssapi.dll","dsrole.dll","msxml3r.dll","wship6.dll","ulib.dll","oleaut32.dll","iertutil.dll","rpcrt4.dll","advapi32.dll","setupapi.dll","cryptsp.dll","kernel32.dll","propsys.dll","crypt32.dll","RpcRtRemote.dll","KernelBase.dll","winmm.dll","ole32.dll","comctl32.dll","ntmarta.dll","profapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"del.bat","sha256":"000eb338a82f1f233c4cd0a2e3c8b43ee93662b9e7ebd51902722e88c68cae2f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"name":"msword.exe","sha256":"3fa4b6d0419d69d0c35532f40b358c3af7315397e8952851442af523d69d49ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]}],"files_written":[{"path":"%WINDIR%\\system32\\attrib.exe","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"path":"%WINDIR%\\system32\\eventvwr.exe","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"path":"%WINDIR%\\system32\\en-US\\eventvwr.exe.mui","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"path":"%WINDIR%\\system32\\eventvwr.msc","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"path":"%WINDIR%\\system32\\en-US\\PING.EXE.mui","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"path":"%TEMP%\\del.bat","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"path":"%WINDIR%\\system32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"path":"%WINDIR%\\system32\\en-US\\attrib.exe.mui","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"path":"%WINDIR%\\system32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"path":"PIPE\\lsarpc","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\CLASSES\\MSCFILE\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"key":"HKCU\\SOFTWARE\\CLASSES\\","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"key":"HKCU\\MSCFILE\\","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"key":"HKCU\\MSCFILE\\SHELL\\","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"key":"HKCU\\MSCFILE\\SHELL\\OPEN\\","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"key":"HKCU\\MSCFILE\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\Vanguard","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58aeee2faac2ed201e2d5656"}]}]}},"report_ids":{"sandbox_job_ids":["58aeee2faac2ed201e2d5656"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Exploit.BypassUAC Sample 3fa4b6d0419d… — Score 68/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3fa4b6d0419d…. Malware family: Exploit.BypassUAC. Threat score 68/100. 1/1 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3fa4b6d0419d69d0c35532f40b358c3af7315397e8952851442af523d69d49ec"}],["$","meta","4",{"property":"og:title","content":"Malicious Exploit.BypassUAC Sample 3fa4b6d0419d… — Score 68/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3fa4b6d0419d…. Malware family: Exploit.BypassUAC. Threat score 68/100. 1/1 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3fa4b6d0419d69d0c35532f40b358c3af7315397e8952851442af523d69d49ec"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Exploit.BypassUAC Sample 3fa4b6d0419d… — Score 68/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3fa4b6d0419d…. Malware family: Exploit.BypassUAC. Threat score 68/100. 1/1 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L34","11",{}]]