23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 33:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T494,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.VBKryjetor Sample 43ade0732b10… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 43ade0732b10…. Malware family: Trojan.VBKryjetor. Threat score 100/100. 22/28 AV engines flagged this file. 14 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/43ade0732b103beef40c9c65dfe7854c5b29ff274fc8d5bfe954a2564f4d6396","keywords":["Malicious","Trojan.VBKryjetor","malware analysis","sandbox report","threat intelligence","43ade0732b103beef40c9c65dfe7854c5b29ff274fc8d5bfe954a2564f4d6396"],"about":{"@type":"SoftwareApplication","name":"ASDlkoa.exe","applicationCategory":["peexe","executable"],"identifier":"43ade0732b103beef40c9c65dfe7854c5b29ff274fc8d5bfe954a2564f4d6396","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.VBKryjetor","antivirusDetections":{"malicious":22,"total":28},"behavioralIndicators":{"malicious":14,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T888,"explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "HELPLINK"; Value: "00000000010000005A00000068007400740070003A002F002F007700770077002E00610064006F00620065002E0063006F006D002F0067006F002F0066006C0061007300680070006C0061007900650072005F0073007500700070006F00720074002F000000") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "URLINFOABOUT"; Value: "00000000010000002A00000068007400740070003A002F002F007700770077002E00610064006F00620065002E0063006F006D000000") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "URLINFOABOUT"; Value: "00000000010000004800000068007400740070003A002F002F007700770077002E006100750074006F00690074007300630072006900700074002E0063006F006D002F006100750074006F006900740033000000") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA0") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA1")25:T7c1,"explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")26:T723,"explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")27:T18eb,Process "csrss.exe" (UID: 00023934-00000316) was launched with missing environment variables: "ALLUSERSPROFILE, ProgramData, COMPUTERNAME, PUBLIC, CommonProgramFiles, ProgramFiles, USERPROFILE" Process "csrss.exe" (UID: 00023934-00000368) was launched with modified environment variables: "TMP, PROCESSOR_REVISION, USERNAME, PROCESSOR_LEVEL, PROCESSOR_IDENTIFIER, TEMP" Process "csrss.exe" (UID: 00023934-00000368) was launched with missing environment variables: "ALLUSERSPROFILE, ProgramData, HOMEPATH, PUBLIC, PROMPT, LOGONSERVER, LOCALAPPDATA, USERDOMAIN, COMPUTERNAME, CommonProgramFiles, ProgramFiles, HOMEDRIVE, USERPROFILE, APPDATA" Process "winlogon.exe" (UID: 00023942-00000408) was launched with new environment variables: "ALLUSERSPROFILE="C:\ProgramData", ProgramData="C:\ProgramData", COMPUTERNAME="kSFFxGTTYh", PUBLIC="C:\Users\Public", CommonProgramFiles="C:\Program Files\Common Files", ProgramFiles="C:\Program Files", USERPROFILE="C:\Windows\system32\config\systemprofile"" Process "services.exe" (UID: 00023944-00000452) was launched with modified environment variables: "Path" Process "lsass.exe" (UID: 00023951-00000460) was launched with modified environment variables: "TMP, USERNAME, Path, USERPROFILE, TEMP" Process "lsass.exe" (UID: 00023951-00000460) was launched with missing environment variables: "LOGONSERVER, LOCALAPPDATA, HOMEPATH, USERDOMAIN, SESSIONNAME, HOMEDRIVE, APPDATA" Process "lsm.exe" (UID: 00023951-00000468) was launched with modified environment variables: "USERNAME, Path" Process "lsm.exe" (UID: 00023951-00000468) was launched with missing environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA" Process "svchost.exe" (UID: 00023951-00000688) was launched with modified environment variables: "LOCALAPPDATA, TMP, USERDOMAIN, USERPROFILE, TEMP, APPDATA" Process "svchost.exe" (UID: 00023951-00000744) was launched with modified environment variables: "LOCALAPPDATA, TMP, USERDOMAIN, USERPROFILE, TEMP, APPDATA" Process "svchost.exe" (UID: 00023951-00000892) was launched with modified environment variables: "LOCALAPPDATA, TMP, USERPROFILE, TEMP, APPDATA" Process "svchost.exe" (UID: 00023951-00001004) was launched with modified environment variables: "LOCALAPPDATA, TMP, USERDOMAIN, USERPROFILE, TEMP, APPDATA" Process "svchost.exe" (UID: 00023951-00001068) was launched with new environment variables: "LOCALAPPDATA="C:\Windows\ServiceProfiles\NetworkService\AppData\Local", USERDOMAIN="kSFFxGTTY", APPDATA="C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming"" Process "svchost.exe" (UID: 00023951-00001068) was launched with modified environment variables: "TMP, USERNAME, Path, USERPROFILE, TEMP" Process "svchost.exe" (UID: 00023952-00001252) was launched with new environment variables: "LOCALAPPDATA="C:\Windows\ServiceProfiles\LocalService\AppData\Local", USERDOMAIN="kSFFxGTTYh", APPDATA="C:\Windows\ServiceProfiles\LocalService\AppData\Roaming"" Process "svchost.exe" (UID: 00023952-00001252) was launched with modified environment variables: "TMP, USERNAME, USERPROFILE, TEMP" Process "taskeng.exe" (UID: 00023952-00001380) was launched with new environment variables: "ALLUSERSPROFILE="C:\ProgramData", LOCALAPPDATA="C:\Windows\system32\config\systemprofile\AppData\Local", ProgramData="C:\ProgramData", USERDOMAIN="kSFFxGTTY", COMPUTERNAME="kSFFxGTTYh", PUBLIC="C:\Users\Public", CommonProgramFiles="C:\Program Files\Common Files", ProgramFiles="C:\Program Files", USERPROFILE="C:\Windows\system32\config\systemprofile", APPDATA="C:\Windows\system32\config\systemprofile\AppData\Roaming"" Process "taskeng.exe" (UID: 00023952-00001380) was launched with modified environment variables: "PROCESSOR_REVISION, USERNAME, PROCESSOR_LEVEL, PROCESSOR_IDENTIFIER" Process "dwm.exe" (UID: 00023952-00001444) was launched with new environment variables: "ALLUSERSPROFILE="C:\ProgramData", ProgramData="C:\ProgramData", HOMEPATH="\Users\QrCxS4O", PUBLIC="C:\Users\Public", LOGONSERVER="\\PSPUBWS-PC", LOCALAPPDATA="C:\Users\QrCxS4O\AppData\Local", USERDOMAIN="kSFFxGTTYh", COMPUTERNAME="kSFFxGTTYh", HOMEDRIVE="C:", USERPROFILE="C:\Users\QrCxS4O", APPDATA="C:\Users\QrCxS4O\AppData\Roaming"" Process "dwm.exe" (UID: 00023952-00001444) was launched with modified environment variables: "TMP, PROCESSOR_REVISION, USERNAME, PROCESSOR_LEVEL, PROCESSOR_IDENTIFIER, TEMP" Process "explorer.exe" (UID: 00023952-00001468) was launched with new environment variables: "ALLUSERSPROFILE="C:\ProgramData", ProgramData="C:\ProgramData", HOMEPATH="\Users\QrCxS4O", PUBLIC="C:\Users\Public", LOGONSERVER="\\PSPUBWS-PC", LOCALAPPDATA="C:\Users\QrCxS4O\AppData\Local", USERDOMAIN="kSFFxGTTYh", COMPUTERNAME="kSFFxGTTYh", SESSIONNAME="Console", CommonProgramFiles="C:\Program Files\Common Files", ProgramFiles="C:\Program Files", HOMEDRIVE="C:", USERPROFILE="C:\Users\QrCxS4O", APPDATA="C:\Users\QrCxS4O\AppData\Roaming"" Process "explorer.exe" (UID: 00023952-00001468) was launched with modified environment variables: "TMP, PROCESSOR_REVISION, USERNAME, PROCESSOR_LEVEL, PROCESSOR_IDENTIFIER, TEMP" Process "mscorsvw.exe" (UID: 00023952-00002508) was launched with modified environment variables: "LOCALAPPDATA, TMP, USERDOMAIN, Path, USERPROFILE, TEMP, APPDATA" Process "conhost.exe" (UID: 00023952-00002616) was launched with modified environment variables: "TMP, PROCESSOR_REVISION, USERNAME, PROCESSOR_LEVEL, PROCESSOR_IDENTIFIER, TEMP" Process "conhost.exe" (UID: 00023952-00002616) was launched with missing environment variables: "ALLUSERSPROFILE, LOCALAPPDATA, ProgramData, USERDOMAIN, COMPUTERNAME, PUBLIC, USERPROFILE, APPDATA" Process "cmd.exe" (UID: 00025275-00003440) was launched with new environment variables: "PROMPT="$P$G", LOGONSERVER="\\PSPUBWS-PC", HOMEPATH="\Users\QrCxS4O", HOMEDRIVE="C:"" Process "cmd.exe" (UID: 00025275-00003440) was launched with modified environment variables: "LOCALAPPDATA, TMP, USERPROFILE, TEMP, APPDATA" Process "conhost.exe" (UID: 00025280-00003428) was launched with modified environment variables: "TMP, PROCESSOR_REVISION, USERNAME, PROCESSOR_LEVEL, PROCESSOR_IDENTIFIER, TEMP" Process "conhost.exe" (UID: 00025280-00003428) was launched with missing environment variables: "ALLUSERSPROFILE, ProgramData, HOMEPATH, PUBLIC, PROMPT, LOGONSERVER, LOCALAPPDATA, USERDOMAIN, COMPUTERNAME, CommonProgramFiles, ProgramFiles, HOMEDRIVE, USERPROFILE, APPDATA"28:T654,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\System32\rsaenh.dll" "" touched file "C:\Windows\System32\en-US\user32.dll.mui" "" touched file "C:\Windows\Fonts\StaticCache.dat" "" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "99FD.tmp.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "99FD.tmp.exe" touched file "C:\Windows\System32\rsaenh.dll" "99FD.tmp.exe" touched file "C:\Windows\System32\en-US\user32.dll.mui" "99FD.tmp.exe" touched file "C:\Windows\Fonts\StaticCache.dat" "99FD.tmp.exe" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "explorer.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "explorer.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "explorer.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "explorer.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "explorer.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies\index.dat" "explorer.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History\History.IE5\index.dat" "services.exe" touched file "C:\Windows\System32\LogFiles\Scm\9334c323-f100-4656-9ba0-e4aa69c0f9c2" "services.exe" touched file "C:\Windows\System32\LogFiles\Scm\071d41b6-8806-4eb0-b661-6cb67be6e86e" "services.exe" touched file "C:\Windows\System32\LogFiles\Scm\0d9b5d92-3a22-486d-a887-3aa21597cf27" "services.exe" touched file "C:\Windows\System32\LogFiles\Scm\18e6d428-d26c-4169-bedf-3b5bddc952f6"29:T1881,Heuristic match: "SPO]YY.]ZW@\XWCTRS.sT" Heuristic match: "SPicevpn.com" Pattern match: "www.bing.com" Pattern match: "http://www.msn.com/fr-fr/?ocid=BHEA000" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=40C" Pattern match: "http://+_d.domain+/,u=sj_cook.get(_UR,D),f=sj_cook.get(SRCHS,PC),t=a(),e=h(),o=c();l()||(u=2*e+o,sj_cook.set(_UR,D,u,1,/))}();var" Pattern match: "www.autoitscript.com" Pattern match: "http://www.autoitscript.com/autoit3/" Pattern match: "https://www.autoitscript.com/site/autoit/" Pattern match: "secure2.alphassl.com/cacert/gsalphasha2g2r1.crt05" Pattern match: "http://ocsp2.globalsign.com/gsalphasha2g20W" Pattern match: "https://www.globalsign.com/repository/0" Pattern match: "http://crl2.alphassl.com/gs/gsalphasha2g2.crl0/" Heuristic match: "*.autoitscript.com" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://support.microsoft.com/" Pattern match: "https://support.microsoft.com/" Pattern match: "mscrl.microsoft.com/pki/mscorp/crl/msitwww2.crl" Pattern match: "crl.microsoft.com/pki/mscorp/crl/msitwww2.crl0p" Pattern match: "www.microsoft.com/pki/mscorp/msitwww2.crt0" Pattern match: "http://ocsp.msocsp.com0=" Pattern match: "http://www.microsoft.com/pki/mscorp/cps" Pattern match: "http://cybertrust.omniroot.com/repository.cfm0" Pattern match: "http://ocsp.omniroot.com/baltimoreroot0" Pattern match: "cdp1.public-trust.com/CRL/Omniroot2025.crl0" Pattern match: "http://www.microsoft.com/downloads/details.aspx?FamilyID=c17ba869-9671-4330-a63e-1fd44e0e2505" Pattern match: "www.microsoft.com" Pattern match: "http://schemas.microsoft.com/CMSvNext" Pattern match: "www.microsoft.com/favicon.ico?v2" Pattern match: "http://c.s-microsoft.com/en-us/CMSImages/windows_symbol_clr_56x56.png?version=3db565f2-d75c-d989-182d-07edaedef3c8" Pattern match: "http://c.s-microsoft.com/en-us/CMSStyles/style.csx?k=3c9ade18-bc6a-b6bd-84c3-fc69aaaa7520_899796fc-1ab6-ed87-096b-4f10b915033c_e8d8727e-02f3-1a80-54c3-f87750a8c4de_6e5b2ac7-688a-4a18-9695-a31e8139fa0f_b3dad3e4-0853-1041-fa46-2e9d6598a584_fc29d27f-7342-9cf3" Pattern match: "http://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js" Pattern match: "http://support.microsoft.com/gp/howtoscript" Pattern match: "https://c.s-microsoft.com/Static/UHF/Common/JS/respond.min.js" Pattern match: "http://schema.org/Organization" Pattern match: "https://www.microsoft.com/en-us/store/b/home" Pattern match: "https://www.microsoft.com/en-us/store/b/pc?icid=TopNavDevicesPC" Pattern match: "https://www.microsoft.com/en-us/store/b/office?icid=TopNavSoftwareOffice" Pattern match: "https://www.microsoft.com/en-us/store/collections/xboxgames/pc?icid=TopNavXboxGamesDisc" Pattern match: "https://www.microsoft.com/en-us/store/movies-and-tv?icid=TopNavMoviesAndTv" Pattern match: "https://www.microsoft.com/en-us/store/collections/xboxdeals/pc?Icid=TopNavXboxDeals" Pattern match: "https://www.microsoft.com/en-us/windows" Pattern match: "https://www.microsoft.com/en-us/windows/microsoft-edge" Pattern match: "https://www.microsoft.com/en-us/groove" Pattern match: "https://www.microsoft.com/accessories/en-us" Pattern match: "https://www.microsoft.com/en-us/server-cloud/" Pattern match: "https://www.microsoft.com/surface/en-us/business/overview" Pattern match: "https://developer.microsoft.com/en-us/windows" Pattern match: "https://www.microsoft.com/en-us/education/products/office/default.aspx" Pattern match: "https://www.microsoft.com/en-us/search/result.aspx" Pattern match: "https://www.microsoft.com/en-us/store/buy" Pattern match: "https://login.live.com/me.srf?wa=wsignin1.0"},"aadInfo":{"signOutUrl":"/en-us/store/signout","appId":null,"siteUrl":null,"blockMsaFed":true" Pattern match: "https://www.microsoft.com/en-us/download/windows.aspx" Pattern match: "microsoftwindows.112.2o7.net/b/ss/msstores1-cmstest-prod/1/H.24.4/,e=" Pattern match: "https://c.s-microsoft.com/en-us/CMSStyles/epb.css?version=43583927-EB99-F50D-EDC6-010FA1F6B5C6" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1CxoC?ver=16dd" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1ChLw?ver=9cb0" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1CmPo?ver=f1b3" Pattern match: "http://schema.org/SoftwareApplication" Pattern match: "http://schema.org/Offer" Pattern match: "http://download.microsoft.com/download/8/8/0/8808A472-6450-4723-9C87-977069714B27/ReleaseNotes_Win7RTMSDK.Htm" Pattern match: "http://go.microsoft.com/fwlink/?LinkID=150216&clcid=0x409" Pattern match: "https://www.facebook.com/Microsoft" Pattern match: "https://twitter.com/microsoft" Pattern match: "https://www.microsoft.com/en-us/surface/devices/surface-book-2/overview" Pattern match: "tore.office.com/en-us/appshome.aspx" Pattern match: "https://www.microsoft.com/en-us/education" Pattern match: "https://www.microsoft.com/en-us/sql-server/" Pattern match: "https://technet.microsoft.com/en-us" Pattern match: "https://www.microsoft.com/en-us/diversity/" Pattern match: "assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.22.3/scripts/mwf-auto-init-main.var.min.js" Pattern match: "http://msdn.microsoft.com/en-us/vstudio/default.aspx" Pattern match: "http://ocsp.msocsp.com0" Pattern match: "www.mozilla.org" Pattern match: "www.digicert.com1402" Heuristic match: "mozilla.org" Pattern match: "www.mozilla.org0" Pattern match: "http://crl3.digicert.com/sha2-ev-server-g1.crl04" Pattern match: "http://crl4.digicert.com/sha2-ev-server-g1.crl0K" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "http://ocsp.digicert.com0R" Pattern match: "cacerts.digicert.com/DigiCertSHA2ExtendedValidationServerCA.crt0" Pattern match: "www.digicert.com1+0" Pattern match: "http://ocsp.digicert.com0K" Pattern match: "http://crl4.I" Pattern match: "digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Heuristic match: "securityupdateserver3.com" Heuristic match: "WMP11.AssocFile.AU"2a:T8d9,"explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "explorer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "explorer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")2b:T77c,"" wrote bytes "4053ed765858ee76186aee76653cef760000000000bf36750000000056cc3675000000007cca36750000000037682a756a2cef76d62def760000000020692a750000000029a6367500000000a48d2a7500000000f70e367500000000" to virtual address "0x76FE1000" (part of module "NSI.DLL") "explorer.exe" wrote bytes "08572d76047836760000000051c1a2759498a275ee9ca27575dca475273ea475efb2a8750000000046ce3675013d377538ed3775cfcd367531233675de2f3775c4ca367580bb3675aa6e37759fbb367592bb367546ba36750abf367500000000" to virtual address "0x73831000" (part of module "SHFOLDER.DLL") "explorer.exe" wrote bytes "4053ed765858ee76186aee76653cef760000000000bf36750000000056cc3675000000007cca36750000000037682a756a2cef76d62def760000000020692a750000000029a6367500000000a48d2a7500000000f70e367500000000" to virtual address "0x76FE1000" (part of module "NSI.DLL") "explorer.exe" wrote bytes "e9a2b38789" to virtual address "0x77096F01" (part of module "WS2_32.DLL") "explorer.exe" wrote bytes "e965de8789" to virtual address "0x77094406" (part of module "WS2_32.DLL") "99FD.tmp.exe" wrote bytes "4053ed765858ee76186aee76653cef760000000000bf36750000000056cc3675000000007cca36750000000037682a756a2cef76d62def760000000020692a750000000029a6367500000000a48d2a7500000000f70e367500000000" to virtual address "0x76FE1000" (part of module "NSI.DLL") "99FD.tmp.exe" wrote bytes "e9a2b34d89" to virtual address "0x77096F01" ("send@WS2_32.DLL") "99FD.tmp.exe" wrote bytes "e965de4d89" to virtual address "0x77094406" ("WSASend@WS2_32.DLL") "explorer.exe" wrote bytes "e9a2b32689" to virtual address "0x77096F01" (part of module "WS2_32.DLL") "explorer.exe" wrote bytes "e965de2689" to virtual address "0x77094406" (part of module "WS2_32.DLL") "explorer.exe" wrote bytes "e9a2b3fd88" to virtual address "0x77096F01" (part of module "WS2_32.DLL") "explorer.exe" wrote bytes "e965defd88" to virtual address "0x77094406" (part of module "WS2_32.DLL")2c:T73c,Injected into "csrss.exe" at 2017-11-10.06:06:11.629 (UID: 00023934-00000316) Injected into "csrss.exe" at 2017-11-10.06:06:11.208 (UID: 00023934-00000368) Injected into "winlogon.exe" at 2017-11-10.06:06:11.288 (UID: 00023942-00000408) Injected into "services.exe" at 2017-11-10.06:06:11.659 (UID: 00023944-00000452) Injected into "lsass.exe" at 2017-11-10.06:06:11.659 (UID: 00023951-00000460) Injected into "lsm.exe" at 2017-11-10.06:06:18.469 (UID: 00023951-00000468) Injected into "svchost.exe" at 2017-11-10.06:06:13.261 (UID: 00023951-00000572) Injected into "svchost.exe" at 2017-11-10.06:06:11.990 (UID: 00023951-00000688) Injected into "svchost.exe" at 2017-11-10.06:06:14.543 (UID: 00023951-00000744) Injected into "svchost.exe" at 2017-11-10.06:06:12.320 (UID: 00023951-00000864) Injected into "svchost.exe" at 2017-11-10.06:06:12.160 (UID: 00023951-00000892) Injected into "svchost.exe" at 2017-11-10.06:06:11.729 (UID: 00023951-00001004) Injected into "svchost.exe" at 2017-11-10.06:06:11.689 (UID: 00023951-00001068) Injected into "svchost.exe" at 2017-11-10.06:07:40.792 (UID: 00023952-00001252) Injected into "taskhost.exe" at 2017-11-10.06:06:11.699 (UID: 00023952-00001332) Injected into "taskeng.exe" at 2017-11-10.06:21:35.221 (UID: 00023952-00001380) Injected into "dwm.exe" at 2017-11-10.06:06:11.699 (UID: 00023952-00001444) Injected into "explorer.exe" at 2017-11-10.06:06:11.629 (UID: 00023952-00001468) Injected into "conhost.exe" at 2017-11-10.06:06:11.699 (UID: 00023952-00001796) Injected into "conhost.exe" at 2017-11-10.06:06:11.699 (UID: 00023952-00002448) Injected into "mscorsvw.exe" at 2017-11-10.06:06:18.469 (UID: 00023952-00002508) Injected into "conhost.exe" at 2017-11-10.06:06:11.699 (UID: 00023952-00002528) Injected into "conhost.exe" at 2017-11-10.06:06:11.699 (UID: 00023952-00002616)2d:T152b,Found malicious artifacts related to "212.227.91.231" (ASN: , Owner: ): ... URL: http://www.autoitscript.com/forum/files/download/83-youtube-download-center/ (AV positives: 1/64 scanned on 11/03/2017 03:51:24) URL: http://www.autoitscript.com/forum/files/download/100-welcome-to-autoit-1-2-3/ (AV positives: 1/64 scanned on 11/02/2017 08:08:29) URL: https://www.autoitscript.com/autoit3/files/archive/autoit/autoit-v3.3.2.0-setup.exe (AV positives: 1/63 scanned on 10/25/2017 22:33:02) URL: http://www.autoitscript.com/autoit3/files/beta/autoit/archive/sqlite/sqlite3_300800403.dll (AV positives: 1/63 scanned on 10/23/2017 09:12:04) URL: http://www.autoitscript.com/autoit3/scite/download/SciTE4AutoIt3.exe (AV positives: 1/65 scanned on 09/07/2017 08:25:44) File SHA256: ea51469e1fae44aeb055b2efa90ad2cdf739d114e1df39c14b68b58054d8d782 (Scanned on 11/06/2017 09:58:26) File SHA256: 64ef202b89edd2b3d10f3b631edb57026e4d240786463a1825599eb9c61fdf72 (AV positives: 1/70 scanned on 11/01/2017 02:00:31) File SHA256: fc941d6c9983bf56bdc202a2a5ded5d61f95bbaef34e0256f7583f01feec3a31 (AV positives: 3/63 scanned on 10/26/2017 02:54:36) File SHA256: 2efde99179c422d7cfc026c3f97f37f64b11085f02b01f38d69244f8ce4b271e (AV positives: 10/67 scanned on 10/26/2017 09:11:38) File SHA256: 298785131ac5d295bbc2baff9f7ddfd1162a0cee1176ff7168f7a97a471b5634 (AV positives: 2/56 scanned on 10/20/2017 08:09:42) File SHA256: cf1e58cb8f317e1f2ab76ffaf5d33de1cbd4cd254adc8c026e05c1b32637eb32 (AV positives: 7/65 scanned on 09/30/2017 15:52:09) Found malicious artifacts related to "104.16.40.2" (ASN: , Owner: ): ... File SHA256: 1401859c48b674cebca9d2dcf21aefd69a20701f872ef7773b081abec2bc0ca8 (AV positives: 36/67 scanned on 10/30/2017 15:55:08) File SHA256: 9b56a2c5ee55c087abb4c6887892c01cfe68d96b983ccc9afcdb8c4a9e6984c8 (AV positives: 59/65 scanned on 10/20/2017 04:08:39) File SHA256: 53df4f0eea3ea9d0036e8d947d6ec7c725f496b987fa049bdd1989dd01ec2bf5 (AV positives: 58/65 scanned on 10/11/2017 15:11:05) File SHA256: d506736a2b11ea74b1b192533509faf0b813295772b92d39b5fe3f35e65b265c (AV positives: 58/65 scanned on 10/09/2017 09:53:54) File SHA256: 15d05118fa2884e71d9af761e9aafc2baf39d172d95cc0af4e5288644236da63 (AV positives: 1/65 scanned on 10/04/2017 21:31:15) File SHA256: 7b2449f74570c12b795fd3d0ba1a6fe9d75fa7fde7c75ea6b1d4b5195f7da921 (Scanned on 08/25/2017 16:29:41) File SHA256: 7dc4dfef3c1660b2fd28b9e1c808ec0fa57e94644a2b4184a01494837f50533f (Scanned on 08/11/2017 18:28:44) File SHA256: a033155e87236cce4e7981129340793f51b807762709b3d8430ea18db962b2d4 (Scanned on 08/06/2017 23:16:08) File SHA256: 6f2714f5914bfb9a030269bab0f431038c9c3bc622bb1004f3d42f922b15dee0 (Scanned on 07/24/2017 12:52:40) File SHA256: 9d091d5b5936d1db431f3cb68cc96193a64fb209276743ec6dac9a0282cdbabb (Scanned on 07/22/2017 11:31:10) Found malicious artifacts related to "216.58.201.228" (ASN: , Owner: ): ... File SHA256: ab94f7556cead232fc43e022b778ce319c0d16bbc626932048baab694cde2e66 (Scanned on 11/07/2017 09:51:27) File SHA256: 68f31154b04521a17b266cb1f1deac14e2636a86fb5af0c10c215b5593305a78 (AV positives: 38/68 scanned on 11/06/2017 22:32:01) File SHA256: aff9165399c0062cc4d9dd57fc695bb6c3d9e91352ee3cabcbddad0fdbe1237c (AV positives: 33/68 scanned on 11/06/2017 17:39:50) File SHA256: 38f16a1ea3958315362ef20689fe8e0127295ad4cdc3d1c2eac4460bd19c22b1 (AV positives: 55/68 scanned on 11/06/2017 10:37:11) File SHA256: b7d375fb1269735421cb368c02999fdb24112840ddd7bd11a2c0a43264335718 (Scanned on 11/06/2017 20:26:31) File SHA256: 822aae806fa7041a631abe836847c9f21d4911bbdfc7c744e6cd81da16f50667 (Scanned on 11/06/2017 20:19:13) File SHA256: e8138c5db0ddc9d7d2b4a792af86e5b323332a264bb25a1433b6f0867d46a392 (Scanned on 11/06/2017 20:10:02) File SHA256: dbd5ad721612116ffb7b87bdd1bab02ce03abbfa0d3168eb484a64fa365abd32 (Scanned on 11/03/2017 15:36:44) File SHA256: d1ef20ad127bde73011eedee679ea03259596cc1659efa4760dbc8a8eda38126 (AV positives: 59/67 scanned on 10/31/2017 18:34:55) File SHA256: e93d628c0aed69f122f5890fe443cd26a93e2e3a488f5b590579f0f677c35c53 (AV positives: 57/67 scanned on 10/31/2017 15:10:07) Found malicious artifacts related to "216.58.201.238" (ASN: , Owner: ): ... File SHA256: 784ba7c0e56c5cbcab3d07cbec38a840e035bdbbf00d74e5fca897611eab8e14 (AV positives: 28/67 scanned on 11/10/2017 01:09:06) File SHA256: 02b7c635ef94ab17788ca0fc0b8da7df9a0ae1a4313f7e3a68d1d8561116c6bb (Scanned on 11/10/2017 04:58:41) File SHA256: 4e3714e9b80632575acb7f31cd26f3cebe3e7fc316faacf07f1062f1228d4a0c (Scanned on 11/10/2017 04:53:07) File SHA256: 3f06504a1cc71d9fcd72fa3cc67632a798ae699eff76ef9e594734ed76da80e0 (Scanned on 11/10/2017 02:56:07) File SHA256: f4d775ae36f738e9a3c6c7f365123052cdbb83c43234b6ef367ca22c956d9f44 (Scanned on 11/10/2017 02:54:04) File SHA256: fbc0d79339d9aae7300cc37f654fb777e283c71618aefef33be5b15b8107ce5d (Scanned on 11/10/2017 00:07:21) File SHA256: 67b6e30ac67e695a9423bcb4e1252d34cd62350ddec66733c9cc92dbc99d4230 (AV positives: 29/39 scanned on 11/09/2017 20:37:30) File SHA256: 7004f0b7a9db11ae1cea622b38bcfa4bfe222edd8ce98bf3a969919b32bbc81b (AV positives: 53/64 scanned on 11/09/2017 19:28:07) File SHA256: a5b2a770d38d4a2a6c276d234bc47a5ed7a3c41ae1706000cb354c7cec15a079 (AV positives: 23/53 scanned on 11/09/2017 16:49:38) File SHA256: 1d6136e542041726aae638dcb3e86d6b4e0538ad9bc6c968a1d7694dcad9a767 (AV positives: 32/67 scanned on 11/09/2017 15:46:25)2e:T152b,Found malicious artifacts related to "212.227.91.231" (ASN: , Owner: ): ... URL: http://www.autoitscript.com/forum/files/download/83-youtube-download-center/ (AV positives: 1/64 scanned on 11/03/2017 03:51:24) URL: http://www.autoitscript.com/forum/files/download/100-welcome-to-autoit-1-2-3/ (AV positives: 1/64 scanned on 11/02/2017 08:08:29) URL: https://www.autoitscript.com/autoit3/files/archive/autoit/autoit-v3.3.2.0-setup.exe (AV positives: 1/63 scanned on 10/25/2017 22:33:02) URL: http://www.autoitscript.com/autoit3/files/beta/autoit/archive/sqlite/sqlite3_300800403.dll (AV positives: 1/63 scanned on 10/23/2017 09:12:04) URL: http://www.autoitscript.com/autoit3/scite/download/SciTE4AutoIt3.exe (AV positives: 1/65 scanned on 09/07/2017 08:25:44) File SHA256: ea51469e1fae44aeb055b2efa90ad2cdf739d114e1df39c14b68b58054d8d782 (Scanned on 11/06/2017 09:58:26) File SHA256: 64ef202b89edd2b3d10f3b631edb57026e4d240786463a1825599eb9c61fdf72 (AV positives: 1/70 scanned on 11/01/2017 02:00:31) File SHA256: fc941d6c9983bf56bdc202a2a5ded5d61f95bbaef34e0256f7583f01feec3a31 (AV positives: 3/63 scanned on 10/26/2017 02:54:36) File SHA256: 2efde99179c422d7cfc026c3f97f37f64b11085f02b01f38d69244f8ce4b271e (AV positives: 10/67 scanned on 10/26/2017 09:11:38) File SHA256: 298785131ac5d295bbc2baff9f7ddfd1162a0cee1176ff7168f7a97a471b5634 (AV positives: 2/56 scanned on 10/20/2017 08:09:42) File SHA256: cf1e58cb8f317e1f2ab76ffaf5d33de1cbd4cd254adc8c026e05c1b32637eb32 (AV positives: 7/65 scanned on 09/30/2017 15:52:09) Found malicious artifacts related to "104.16.40.2" (ASN: , Owner: ): ... File SHA256: 1401859c48b674cebca9d2dcf21aefd69a20701f872ef7773b081abec2bc0ca8 (AV positives: 36/67 scanned on 10/30/2017 15:55:08) File SHA256: 9b56a2c5ee55c087abb4c6887892c01cfe68d96b983ccc9afcdb8c4a9e6984c8 (AV positives: 59/65 scanned on 10/20/2017 04:08:39) File SHA256: 53df4f0eea3ea9d0036e8d947d6ec7c725f496b987fa049bdd1989dd01ec2bf5 (AV positives: 58/65 scanned on 10/11/2017 15:11:05) File SHA256: d506736a2b11ea74b1b192533509faf0b813295772b92d39b5fe3f35e65b265c (AV positives: 58/65 scanned on 10/09/2017 09:53:54) File SHA256: 15d05118fa2884e71d9af761e9aafc2baf39d172d95cc0af4e5288644236da63 (AV positives: 1/65 scanned on 10/04/2017 21:31:15) File SHA256: 7b2449f74570c12b795fd3d0ba1a6fe9d75fa7fde7c75ea6b1d4b5195f7da921 (Scanned on 08/25/2017 16:29:41) File SHA256: 7dc4dfef3c1660b2fd28b9e1c808ec0fa57e94644a2b4184a01494837f50533f (Scanned on 08/11/2017 18:28:44) File SHA256: a033155e87236cce4e7981129340793f51b807762709b3d8430ea18db962b2d4 (Scanned on 08/06/2017 23:16:08) File SHA256: 6f2714f5914bfb9a030269bab0f431038c9c3bc622bb1004f3d42f922b15dee0 (Scanned on 07/24/2017 12:52:40) File SHA256: 9d091d5b5936d1db431f3cb68cc96193a64fb209276743ec6dac9a0282cdbabb (Scanned on 07/22/2017 11:31:10) Found malicious artifacts related to "216.58.201.228" (ASN: , Owner: ): ... File SHA256: ab94f7556cead232fc43e022b778ce319c0d16bbc626932048baab694cde2e66 (Scanned on 11/07/2017 09:51:27) File SHA256: 68f31154b04521a17b266cb1f1deac14e2636a86fb5af0c10c215b5593305a78 (AV positives: 38/68 scanned on 11/06/2017 22:32:01) File SHA256: aff9165399c0062cc4d9dd57fc695bb6c3d9e91352ee3cabcbddad0fdbe1237c (AV positives: 33/68 scanned on 11/06/2017 17:39:50) File SHA256: 38f16a1ea3958315362ef20689fe8e0127295ad4cdc3d1c2eac4460bd19c22b1 (AV positives: 55/68 scanned on 11/06/2017 10:37:11) File SHA256: b7d375fb1269735421cb368c02999fdb24112840ddd7bd11a2c0a43264335718 (Scanned on 11/06/2017 20:26:31) File SHA256: 822aae806fa7041a631abe836847c9f21d4911bbdfc7c744e6cd81da16f50667 (Scanned on 11/06/2017 20:19:13) File SHA256: e8138c5db0ddc9d7d2b4a792af86e5b323332a264bb25a1433b6f0867d46a392 (Scanned on 11/06/2017 20:10:02) File SHA256: dbd5ad721612116ffb7b87bdd1bab02ce03abbfa0d3168eb484a64fa365abd32 (Scanned on 11/03/2017 15:36:44) File SHA256: d1ef20ad127bde73011eedee679ea03259596cc1659efa4760dbc8a8eda38126 (AV positives: 59/67 scanned on 10/31/2017 18:34:55) File SHA256: e93d628c0aed69f122f5890fe443cd26a93e2e3a488f5b590579f0f677c35c53 (AV positives: 57/67 scanned on 10/31/2017 15:10:07) Found malicious artifacts related to "216.58.201.238" (ASN: , Owner: ): ... File SHA256: 784ba7c0e56c5cbcab3d07cbec38a840e035bdbbf00d74e5fca897611eab8e14 (AV positives: 28/67 scanned on 11/10/2017 01:09:06) File SHA256: 02b7c635ef94ab17788ca0fc0b8da7df9a0ae1a4313f7e3a68d1d8561116c6bb (Scanned on 11/10/2017 04:58:41) File SHA256: 4e3714e9b80632575acb7f31cd26f3cebe3e7fc316faacf07f1062f1228d4a0c (Scanned on 11/10/2017 04:53:07) File SHA256: 3f06504a1cc71d9fcd72fa3cc67632a798ae699eff76ef9e594734ed76da80e0 (Scanned on 11/10/2017 02:56:07) File SHA256: f4d775ae36f738e9a3c6c7f365123052cdbb83c43234b6ef367ca22c956d9f44 (Scanned on 11/10/2017 02:54:04) File SHA256: fbc0d79339d9aae7300cc37f654fb777e283c71618aefef33be5b15b8107ce5d (Scanned on 11/10/2017 00:07:21) File SHA256: 67b6e30ac67e695a9423bcb4e1252d34cd62350ddec66733c9cc92dbc99d4230 (AV positives: 29/39 scanned on 11/09/2017 20:37:30) File SHA256: 7004f0b7a9db11ae1cea622b38bcfa4bfe222edd8ce98bf3a969919b32bbc81b (AV positives: 53/64 scanned on 11/09/2017 19:28:07) File SHA256: a5b2a770d38d4a2a6c276d234bc47a5ed7a3c41ae1706000cb354c7cec15a079 (AV positives: 23/53 scanned on 11/09/2017 16:49:38) File SHA256: 1d6136e542041726aae638dcb3e86d6b4e0538ad9bc6c968a1d7694dcad9a767 (AV positives: 32/67 scanned on 11/09/2017 15:46:25)2f:T404,"explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\MSNMESSENGER") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\MESSENGERSERVICE") "explorer.exe" (Path: "HKCU\IDENTITIES\{57AB3677-534E-4173-8F92-6566F6F82F10}\SOFTWARE\MICROSOFT\MESSENGERSERVICE") "explorer.exe" (Path: "HKCU\SOFTWARE\YAHOO\PAGER") "explorer.exe" (Path: "HKCU\SOFTWARE\GOOGLE\GOOGLE TALK\ACCOUNTS") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET ACCOUNT MANAGER\ACCOUNTS") "explorer.exe" (Path: "HKCU\IDENTITIES\{57AB3677-534E-4173-8F92-6566F6F82F10}\SOFTWARE\MICROSOFT\INTERNET ACCOUNT MANAGER\ACCOUNTS") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\OUTLOOK\OMI ACCOUNT MANAGER\ACCOUNTS") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK") "explorer.exe" (Path: "HKLM\SOFTWARE\INCREDIMAIL\IDENTITIES") "explorer.exe" (Path: "HKCU\SOFTWARE\INCREDIMAIL\IDENTITIES") "explorer.exe" (Path: "HKCU\SOFTWARE\GROUP MAIL")30:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAoAAAAAAgAAAAAAAAAAAAAAd3d3d3Z2BzMzMAAAAAAHd3d3d3d3V3MzMzMAAAAHd3d3d3d3d3czMzMzMAAAd3d3d3d3h3dzc4i7MzAAAHd3d4iIj/+IgziIu7MwAAd3Z4+I/////zN4i7uzMAAHd4iIiId3d4cziLu4tzAAB3eHeLd3ZmZmZoi7uDMwAHd4h3h3dmZmZmZnu/szAAB3eIiId2ZmZmZmZmizNwAAd3+Ih3Zm7u7u7mdnM3cAAHd/iIdmbu7u7u7mZnd3AAB3j7uHZojuZm7j7mZ3dwAAd4+Ih2aGZmZmbu5md3cAAHePiIdshnZmZm7v5md3AAB3f4iHaId3Zmbm7sZndwAAd3+Ih2j3d3ZmZu7mZ3cAAHeP+Ihn+Hd3ZmbuZmh3AAB3f/iIZo+HdnZmbmZ4dwEAd3/4iIZ/+HdmbOhmiHcAAAd4+IiGaP/4iIhmaId3AAAHeP+IiGZoiIh2Zn+HdwAACHj/jodzZmbGZmeIh3cAAAh4v/iHd3dmZneIeId3IAAAiP//iHiIiIiIiHiHcAABBIiP/////4iIiIj4czAAAACIh4j//f/////4h3dwAAAACIh3eIiIiIiHd3d3AAAAAgAIh3d3d3d3d3d3cAAAAAAAAAAHZ3d3d3d3AAIAAAAAAAAAAAAgAAAAAAAAAAz//////8ACB/4AAAP4AAAB8AAAAfAAAAHgAAAB4AAAAeAAAAHAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8BOAAPAAAADwAAAA8AAAAPgAAADfAAAA+AAAAPgAAAD8AAAB/AAAAfwAAAH+AAAD/4HAB//hAD//////w==31:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAABmZmZgAAAAAAZmZmYAAAAGeIiIZgAAAAAGiIiGYAB3d3iIiHd3d3d3dod3hnd3iPiIiIh4iIiIiIaIiIa7t4+IiIiIeIiIiIu2iIiGu7ePiIiIiHiIiIiIhoiIh7u3j4iIiIiId3d3d2eIiIiLt4+IiIiIiIiIiIiIiIj4i7ePiIiP/4iIiIiIiIiI+Iu3j4+P//+IiIiIiIiIiPiLh4+Pj////////4iIiIj4i4eP/4///4iIiIiIiIj/iIiHj//4iI+IiIh3d3d3d4iIh4/////4+IiIiIiIiIiIiIeP////iI+IiIiIiIiIiIiHj/////iI+IiIiIiIiIiIh4//////iIiIiIiIiIiIiIeP//////+IiIiIiIiIiIiHj///////+IiIiIiIiIiIh4/////////4j///////iIeP//////////+IiIiHd3eHiP/////////4iIiIiIiIh4iIiIiIiIiIiIjub///iIeIiIiIiIiIiIiI7u///4iHiIiIiIiImZ//iIh3d3d3dwiIiIiIiJmf///4iIiIiHAIiKov/4iIiIiId3d3d3dwCIiqr///+Ih3AAAAAAAAAACIiIiIiIiHcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwH/gP4A/4BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAGAAD//wAB//////////////////w==32:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"43ade0732b103beef40c9c65dfe7854c5b29ff274fc8d5bfe954a2564f4d6396","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790285300412,"unified_at":"2026-09-24T21:28:20.412Z","metadata":{"hashes":{"sha256":"43ade0732b103beef40c9c65dfe7854c5b29ff274fc8d5bfe954a2564f4d6396","sha1":"0378fef84e0494127bf60110ccc615a4cbf9fa86","md5":"cfc5759ef1af8bc3f7c3d2004fd0de58","sha512":"8ef01ed32f77441d0a7f78b1e48e0027b2931a95091283915dcaf9b60e7c6f319dfb2f166d8947e3a3f699bbd4e725665954f482e0870a0e2aab904243b091c8","ssdeep":"3072:oGd/bJ5GnnWxnQqc5eYHRMfP8yEbsc6qfPrjyUf16h8L:ou/NPxQquRMfkNbsc6qbjhf1UE","ssdeep_chunks":["3072:oGd/bJ5","3072:Gd/bJ5G","3072:d/bJ5Gn","3072:/bJ5Gnn","3072:bJ5GnnW","3072:J5GnnWx","3072:5GnnWxn","3072:GnnWxnQ","3072:nnWxnQq","3072:nWxnQqc","3072:WxnQqc5","3072:xnQqc5e","3072:nQqc5eY","3072:Qqc5eYH","3072:qc5eYHR","3072:c5eYHRM","3072:5eYHRMf","3072:eYHRMfP","3072:YHRMfP8","3072:HRMfP8y","3072:RMfP8yE","3072:MfP8yEb","3072:fP8yEbs","3072:P8yEbsc","3072:8yEbsc6","3072:yEbsc6q","3072:Ebsc6qf","3072:bsc6qfP","3072:sc6qfPr","3072:c6qfPrj","3072:6qfPrjy","3072:qfPrjyU","3072:fPrjyUf","3072:PrjyUf1","3072:rjyUf16","3072:jyUf16h","3072:yUf16h8","3072:Uf16h8L","6144:oGd/bJ5","6144:Gd/bJ5G","6144:d/bJ5Gn","6144:/bJ5Gnn","6144:bJ5GnnW","6144:J5GnnWx","6144:5GnnWxn","6144:GnnWxnQ","6144:nnWxnQq","6144:nWxnQqc","6144:WxnQqc5","6144:xnQqc5e","6144:nQqc5eY","6144:Qqc5eYH","6144:qc5eYHR","6144:c5eYHRM","6144:5eYHRMf","6144:eYHRMfP","6144:YHRMfP8","6144:HRMfP8y","6144:RMfP8yE","6144:MfP8yEb","6144:fP8yEbs","6144:P8yEbsc","6144:8yEbsc6","6144:yEbsc6q","6144:Ebsc6qf","6144:bsc6qfP","6144:sc6qfPr","6144:c6qfPrj","6144:6qfPrjy","6144:qfPrjyU","6144:fPrjyUf","6144:PrjyUf1","6144:rjyUf16","6144:jyUf16h","6144:yUf16h8","6144:Uf16h8L","3072:ou/NPxQ","3072:u/NPxQq","3072:/NPxQqu","3072:NPxQquR","3072:PxQquRM","3072:xQquRMf","3072:QquRMfk","3072:quRMfkN","3072:uRMfkNb","3072:RMfkNbs","3072:MfkNbsc","3072:fkNbsc6","3072:kNbsc6q","3072:Nbsc6qb","3072:bsc6qbj","3072:sc6qbjh","3072:c6qbjhf","3072:6qbjhf1","3072:qbjhf1U","3072:bjhf1UE"],"imphash":"ff1e6a8049e4c119aa16a4bb02a0115f"},"file_info":{"file_name":"ASDlkoa.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":208896,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1510291005000,"last_seen":1678783310000,"last_multi_scan":1678783310000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["dofoil","sharik","smokeloader"]},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":18,"suspicious_count":16,"malicious_count":14,"total":48},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.VBKryjetor","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1225527","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.PonyStealer.mm0@eWifMQpi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packer.VbPack-0-6334882-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Fareit.CM.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.PonyStealer.mm0@eWifMQpi (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Injector.DQHW trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Agent.gw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0051b7e31 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.VBKryjetor.aqho","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.crw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.VBKryjetor.euwrdq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/FareitVB-M","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_TERMINATE.F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_TERMINATE.F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.VBKryjetor","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.VBKryjetor.Win32.4878","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.VBKryjetor","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".data\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$24","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$25","origin":"Registry Access","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$26","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.autoitscript.com\"\n \"securityupdateserver3.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"212.227.91.231:80\"\n \"212.227.91.231:443\"\n \"145.249.104.14:80\"\n \"104.16.40.2:443\"\n \"216.58.201.228:80\"\n \"216.58.201.238:80\"\n \"216.58.201.228:443\"\n \"216.58.201.238:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\~DFC8D10B1FB63E4901.TMP\"\n \"99FD.tmp.exe\" created file \"%TEMP%\\~DFDB76EF35BD7D28E2.TMP\"\n \"99FD.tmp.exe\" created file \"%TEMP%\\upd5d22bc58.bat\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\64117FF65CCA910EF18EABCA412EE6C9\"\n \"\\Sessions\\1\\BaseNamedObjects\\F690ED4BA8DB8BDC869ED8A95463F2E4C326F2B8\"\n \"\\Sessions\\1\\BaseNamedObjects\\19D3E22116838B64477091C8F5B54E31\"\n \"Sandboxie_SingleInstanceMutex_Control\"\n \"Frz_State\"\n \"19D3E22116838B64477091C8F5B54E31\"\n \"\\Sessions\\1\\BaseNamedObjects\\Sandboxie_SingleInstanceMutex_Control\"\n \"\\Sessions\\1\\BaseNamedObjects\\Frz_State\"\n \"\\Sessions\\1\\BaseNamedObjects\\524C36F1CE47DDC4480E108A3AEE5C08\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!qrcxs4o!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!qrcxs4o!appdata!roaming!microsoft!windows!cookies!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!qrcxs4o!appdata!local!microsoft!windows!history!history.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\C34DA1DC6013081E3ED24D69DBE96771\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /autoit3/ HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: www.autoitscript.com\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"informative","category":"General","name":"Loads the visual basic runtime environment","description":"\"\" loaded module \"%WINDIR%\\System32\\msvbvm60.dll\" at 72940000\n \"99FD.tmp.exe\" loaded module \"%WINDIR%\\System32\\msvbvm60.dll\" at 72940000","origin":"Loaded Module","id":"module-0","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$27","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c \"%TEMP%\\upd5d22bc58.bat\"\" on 2017-11-10.06:09:44.668","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"explorer.exe\" searching for window \"View Available Networks\"\n \"explorer.exe\" searching for window \"Network Flyout\"\n \"explorer.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"explorer.exe\" (UID: 00016909-00002868)\n Spawned process \"99FD.tmp.exe\" (UID: 00023573-00003096)\n Spawned process \"explorer.exe\" (UID: 00023850-00003120)\n Spawned process \"explorer.exe\" (UID: 00023860-00003144)\n Spawned process \"explorer.exe\" (UID: 00023860-00003212)\n Spawned process \"cmd.exe\" with commandline \"/c \"%TEMP%\\upd5d22bc58.bat\"\" (UID: 00025275-00003440)\n Spawned process \"conhost.exe\" (UID: 00025280-00003428)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"\"POST /blog/wp.php HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nContent-Length: 63\nHost: securityupdateserver3.com\"","origin":"Network Traffic","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"99FD.tmp.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"upd5d22bc58.bat\" has type \"DOS batch file ASCII text with CRLF line terminators\"\n \"CMD.EXE-4A81B364.pf\" has type \"data\"\n \"lastalive1.dat\" has type \"data\"\n \"Policy.vpol\" has type \"data\"\n \"lastalive0.dat\" has type \"data\"\n \"Preferred\" has type \"data\"\n \"2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch\" has type \"data\"\n \"e891cb00-7b39-4f50-9ec6-ae749b8589c3\" has type \"data\"\n \"Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx\" has type \"MS Windows Vista Event Log 1 chunks (no. 0 in use) next record no. 27 DIRTY\"\n \"wgjavues\" has type \"data\"\n \"Security.evtx\" has type \"MS Windows Vista Event Log 26 chunks (no. 25 in use) next record no. 2411 DIRTY\"\n \"3CCD5499-87A8-4B10-A215-608888DD3B55.vsch\" has type \"data\"\n \"CONHOST.EXE-1F3E9D7E.pf\" has type \"data\"\n \"EXPLORER.EXE-A80E4F97.pf\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$28","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$29","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"svchost.exe\" is protecting 8192 bytes with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .text with unusual entropies 7.21171057474\n 7.20485064096","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"explorer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"99FD.tmp.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"99FD.tmp.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"explorer.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"services.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ALL_ACCESS\" (0xf003f)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /autoit3 HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nContent-Length: 54\nHost: www.autoitscript.com\" with no payload\n \"POST /blog/wp.php HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nContent-Length: 63\nHost: securityupdateserver3.com\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"explorer.exe\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"explorer.exe\" called \"OpenService\" to access the \"gpsvc\" service\n \"explorer.exe\" called \"OpenService\" to access the \"WinHttpAutoProxySvc\" service\n \"explorer.exe\" called \"OpenService\" to access the \"VaultSvc\" service\n \"explorer.exe\" called \"OpenService\" to access the \"ProtectedStorage\" service\n \"explorer.exe\" called \"OpenService\" to access the \"ProtectedStorage\" service requesting \"SERVICE_START\" (0X10) access rights\n \"services.exe\" called \"OpenService\" to access the \"\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"explorer.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"gpsvc\"\n \"explorer.exe\" called \"ControlService\" and sent control code \"0XFC\" to the service \"gpsvc\"\n \"explorer.exe\" called \"ControlService\" and sent control code \"0X400\" to the service \"ProtectedStorage\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"99FD.tmp.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"99FD.tmp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"send@WS2_32.DLL\" in \"99FD.tmp.exe\"\n \"WSASend@WS2_32.DLL\" in \"99FD.tmp.exe\"","origin":"Hook Detection","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$2a","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"99FD.tmp.exe\" claimed CRC 232419 while the actual is CRC 265337","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2b","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"99FD.tmp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"svchost.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"LOCALENAME\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"conhost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the windows product ID","description":"\"99FD.tmp.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"DIGITALPRODUCTID\")","origin":"Registry Access","relevance":6,"id":"registry-5","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET TROJAN Sharik/Smoke Loader Microsoft Connectivity Check\" (SID: 2022124, Rev: 6, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)\n Detected alert \"ET TROJAN Generic - POST To .php w/Extended ASCII Characters\" (SID: 2017259, Rev: 11, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)\n Detected alert \"ET TROJAN Sharik/Smoke Loader Microsoft Connectivity check\" (SID: 2018677, Rev: 3, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)\n Detected alert \"ETPRO TROJAN Smoke/Sharik HTTP 404 Containing EXE\" (SID: 2816171, Rev: 2, Severity: 1) categorized as \"Attempted User Privilege Gain\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"18/67 Antivirus vendors marked sample as malicious (26% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"18/67 Antivirus vendors marked sample as malicious (26% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00023952-00001468)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into remote processes","description":"$2c","origin":"Monitored Target","relevance":6,"id":"target-0","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%WINDIR%\\explorer.exe\" (Handle: 364)\n \"\" wrote 52 bytes to a remote process \"%WINDIR%\\explorer.exe\" (Handle: 364)\n \"\" wrote 4 bytes to a remote process \"%WINDIR%\\explorer.exe\" (Handle: 364)\n \"dwm.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\explorer.exe\" (Handle: 636)\n \"dwm.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\conhost.exe\" (Handle: 1088)\n \"dwm.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\explorer.exe\" (Handle: 388)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2d","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$2e","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"mimikatz_lsass_mdmp\" matched process \"lsass.exe\" as \"LSASS minidump file for mimikatz\" based on indicators: \"System32\\lsass.exe\" (Author: Benjamin DELPY (gentilkiwi))","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Hooks internet related APIs","description":"\"send@WS2_32.DLL\" in \"99FD.tmp.exe\"\n \"WSASend@WS2_32.DLL\" in \"99FD.tmp.exe\"","origin":"Hook Detection","relevance":10,"id":"hooks-5","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Scans for artifacts that may help identify the target","description":"$2f","origin":"Registry Access","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Touched instant messenger related registry keys","description":"\"explorer.exe\" (Path: \"HKCU\\SOFTWARE\\CAMFROG\\CLIENT\")\n \"explorer.exe\" (Path: \"HKCU\\SOFTWARE\\YAHOO\\PAGER\")\n \"explorer.exe\" (Path: \"HKCU\\SOFTWARE\\GOOGLE\\GOOGLE TALK\\ACCOUNTS\")\n \"explorer.exe\" (Path: \"HKCU\\SOFTWARE\\PALTALK\")","origin":"Registry Access","relevance":5,"id":"registry-34","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00014456-00003056)\n Spawned process \"explorer.exe\" (UID: 00016909-00002868)\n Spawned process \"99FD.tmp.exe\" (UID: 00023573-00003096)\n Spawned process \"explorer.exe\" (UID: 00023850-00003120)\n Spawned process \"explorer.exe\" (UID: 00023860-00003144)\n Spawned process \"explorer.exe\" (UID: 00023860-00003212)\n Spawned process \"cmd.exe\" with commandline \"/c \"%TEMP%\\upd5d22bc58.bat\"\" (UID: 00025275-00003440)\n Spawned process \"conhost.exe\" (UID: 00025280-00003428)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Hooks internet related APIs"},{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"Stealer/Phishing","details_count":2,"details":[{"detail":"Touched instant messenger related registry keys"},{"detail":"Scans for artifacts that may help identify the target"}],"sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Persists itself using auto-execute at a hidden registry location"},{"detail":"Injects into remote processes"},{"detail":"Spawns a lot of processes"},{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows product ID"},{"detail":"Reads the windows installation date"},{"detail":"Reads the active computer name"},{"detail":"Scans for artifacts that may help identify the target"}],"sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"May try to detect DeepFreeze frozen state"}],"sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":17,"imported_dlls_count":75,"dropped_files_count":0,"extracted_files_count":15,"files_written_count":100,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":8,"dns_resolutions_count":2,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":["dofoil","sharik","smokeloader"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5a0533fc7ca3e1413f3779d4","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"TROJ_TERMINATE.F","contacted_countries":["DEU","RUS","USA"],"submit_name":"ASDlkoa.exe","analysis_start_time":"2017-11-10T06:04:05+00:00","indicators_count":{"informative":18,"suspicious":24,"malicious":18},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"212.227.91.231","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"address":"212.227.91.231","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"address":"145.249.104.14","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"address":"104.16.40.2","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"address":"216.58.201.228","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"address":"216.58.201.238","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"address":"216.58.201.228","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"address":"216.58.201.238","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]}],"dns_resolutions":[{"domain":"securityupdateserver3.com","address":"145.249.104.14","country":"Russian Federation","registrar_name":"NAMECHEAP INC","registrar_organization":"WhoisGuard, Inc.","registrar_creation_date":"2017-08-30T18:01:32+00:00","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"domain":"www.autoitscript.com","address":"212.227.91.231","country":"Germany","registrar_name":"1&1 Internet SE","registrar_organization":"AutoIt Consulting Ltd","registrar_name_servers":"NS1.BDM.MICROSOFTONLINE.COM","registrar_creation_date":"2004-05-05T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]}],"http_requests":[{"host":"www.autoitscript.com","host_ip":"212.227.91.231:80","url":"/autoit3","method":"POST","response_code":"301","response_phrase":"Moved Permanently","header":"POST /autoit3 HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nContent-Length: 54\nHost: www.autoitscript.com","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"host":"www.autoitscript.com","host_ip":"212.227.91.231:80","url":"/autoit3/","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /autoit3/ HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: www.autoitscript.com","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"host":"securityupdateserver3.com","host_ip":"145.249.104.14:80","url":"/blog/wp.php","method":"POST","response_code":"404","response_phrase":"Not Found","header":"POST /blog/wp.php HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nContent-Length: 63\nHost: securityupdateserver3.com","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}],"processes":[{"pid":3056,"ppid":0,"name":"43ade0732b103beef40c9c65dfe7854c5b29ff274fc8d5bfe954a2564f4d6396.exe","command_line":"","sha256":"43ade0732b103beef40c9c65dfe7854c5b29ff274fc8d5bfe954a2564f4d6396","normalized_path":"C:\\43ade0732b103beef40c9c65dfe7854c5b29ff274fc8d5bfe954a2564f4d6396.exe","uid":"00014456-00003056","icon":"$30"},{"pid":2868,"ppid":3056,"name":"explorer.exe","command_line":"","sha256":"0a8ce026714e03e72c619307bd598add5f9b639cfd91437cb8d9c847bf9f6894","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00014456-00003056","uid":"00016909-00002868","icon":"$31"},{"pid":3096,"ppid":2868,"name":"99FD.tmp.exe","command_line":"","sha256":"c918073b252617b8f9ef0bbf3e213397806b5ef2ab95eba68c4277b75c8baef2","normalized_path":"%TEMP%\\99FD.tmp.exe","parent_uid":"00016909-00002868","uid":"00023573-00003096","icon":"$32"},{"pid":3440,"ppid":3096,"name":"cmd.exe","command_line":"/c \"%TEMP%\\upd5d22bc58.bat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00023573-00003096","uid":"00025275-00003440"}],"all_imported_dlls":["msvcrt.dll","ole32.dll","nsi.dll","setupapi.dll","uxtheme.dll","cryptsp.dll","clbcatq.dll","dhcpcsvc.dll","urlmon.dll","devobj.dll","wshqos.dll","ncrypt.dll","ntdll.dll","lpk.dll","msctf.dll","userenv.dll","netapi32.dll","shfolder.dll","msvbvm60.dll","winnsi.dll","shlwapi.dll","webio.dll","GdiPlus.dll","mswsock.dll","rasadhlp.dll","rsaenh.dll","rpcss.dll","WSHTCPIP.DLL","srvcli.dll","gdi32.dll","advapi32.dll","dwmapi.dll","slc.dll","FWPUCLNT.DLL","user32.dll","cfgmgr32.dll","wsock32.dll","schannel.dll","propsys.dll","KernelBase.dll","msasn1.dll","dnsapi.dll","dui70.dll","wship6.dll","kernel32.dll","sechost.dll","rpcrt4.dll","oleaut32.dll","ws2_32.dll","crypt32.dll","ExplorerFrame.dll","sspicli.dll","sxs.dll","IPHLPAPI.DLL","duser.dll","bcryptprimitives.dll","gpapi.dll","winbrand.dll","usp10.dll","imm32.dll","apphelp.dll","netutils.dll","powrprof.dll","dhcpcsvc6.dll","profapi.dll","wkscli.dll","shell32.dll","iertutil.dll","bcrypt.dll","psapi.dll","wininet.dll","secur32.dll","cryptbase.dll","winhttp.dll","credssp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"upd5d22bc58.bat","sha256":"fa598dd422d618ac9193099c2e05c8e4748a48e16fe89f6bb2d8382f2031f101","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch","sha256":"8096304561d2f2ffe11c77150535c6a1b66ec14018dd74ed929237457669b490","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"3CCD5499-87A8-4B10-A215-608888DD3B55.vsch","sha256":"afd00d029fe0c34f952c0b98b60b7935fac85c2440883a85ddd36669844a3876","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"Preferred","sha256":"b379c853f1399ef9194a1898612340fffab9186c441782a319561abb5f5366dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"wgjavues","sha256":"b7150c6d0e6762bbc50daa3a8584b74f0615d86f09f01c334d3403a175486ffe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"Policy.vpol","sha256":"04849b5dbc3c49915469b4eb6b0183875a8c92e62f83d311af59df0448b735a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"99FD.tmp.exe","sha256":"c918073b252617b8f9ef0bbf3e213397806b5ef2ab95eba68c4277b75c8baef2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"CMD.EXE-4A81B364.pf","sha256":"0e6ce79e63ad4d1d2fead40ba6b48542825dd81f3b12488047388b38541cf7a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"CONHOST.EXE-1F3E9D7E.pf","sha256":"a888af9b70e370d4f7eb9c69bae59c4b2fbab1358b878808c0889dc5e96ac946","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"EXPLORER.EXE-A80E4F97.pf","sha256":"87f5a33cdee07aae30df4f80651ab417ea5915fd92353f87cdda817e35e1dae3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"lastalive0.dat","sha256":"e4008d7631762442a6e0cc0140207252e48f7c901082e3a0d7e9e4b4d13eacb1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"lastalive1.dat","sha256":"75c5896ffc81a2f71f08304cfea692d520fa75f144d8511d91d436592eeb41fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"e891cb00-7b39-4f50-9ec6-ae749b8589c3","sha256":"29a568f8bd678ef4958ded1f6e89b9fdc5d538ac78bfa8b37fe0de0657bba59f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx","sha256":"ea38f5631f5850993f8a84e1c06203746f987a2b8e17e4f5c841aeafa35d4ad3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"Security.evtx","sha256":"3938a9deac8ef621793a5c825d369e447e559e830993e765df6193baedff0aca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]}],"files_written":[{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"C:\\43ade0732b103beef40c9c65dfe7854c5b29ff274fc8d5bfe954a2564f4d6396.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%APPDATA%\\Microsoft\\wgjavues","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%APPDATA%\\Microsoft\\wgjavues\\tdcgwcsi.exe","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%APPDATA%\\Microsoft\\wgjavues\\wgjavues","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\en-US\\explorer.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\psbase.dll","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\Prefetch\\99FD.TMP.EXE-DFD2393C.pf","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\en-US\\vaultsvc.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\Microsoft\\Protect\\S-1-5-18\\User\\e891cb00-7b39-4f50-9ec6-ae749b8589c3","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\Microsoft\\Protect\\S-1-5-18\\User\\Preferred","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Vault","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%APPDATA%\\Microsoft\\Vault","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%APPDATA%\\Microsoft\\Protect\\S-1-5-21-4162757579-3804539371-4239455898-1000\\Preferred","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Vault","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Vault\\4BF4C442-9B8A-41A0-B380-DD4A704DDB28","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Vault\\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\\Policy.vpol","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\Prefetch\\EXPLORER.EXE-A80E4F97.pf","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\LogFiles\\Scm\\9334c323-f100-4656-9ba0-e4aa69c0f9c2","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\LogFiles\\Scm\\071d41b6-8806-4eb0-b661-6cb67be6e86e","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\LogFiles\\Scm\\0d9b5d92-3a22-486d-a887-3aa21597cf27","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\LogFiles\\Scm\\18e6d428-d26c-4169-bedf-3b5bddc952f6","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\LogFiles\\Scm\\45d7c1f9-cfe5-4085-a4ee-896c9f759239","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\LogFiles\\Scm\\5b184694-64c3-4633-94c5-945b3fa561d6","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\LogFiles\\Scm\\6b7ac694-8d6d-481b-9dd8-2a3a741ada6d","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\LogFiles\\Scm\\9efacbe6-a797-4905-a0c6-014cd3000dbb","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\LogFiles\\Scm\\a1cfa52f-06f2-418d-addb-cd6456d66f43","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\LogFiles\\Scm\\a316e645-1c56-45a6-bd6a-7dca79778090","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\LogFiles\\Scm\\a6394592-54ce-4e93-8d64-1a068f462632","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\LogFiles\\Scm\\b9bee219-c29e-4310-819c-147a5a0e045e","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\LogFiles\\Scm\\d21f6024-191f-4454-bbbc-09a650da2549","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\LogFiles\\Scm\\d8bb5b7f-d0ca-4f67-a3d7-73e1d05f63da","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\drivers\\mssmbios.sys","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\drivers\\hdaudbus.sys","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\drivers\\portcls.sys","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\drivers\\monitor.sys","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\advapi32.dll","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\en-US\\advapi32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\drivers\\acpi.sys","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\drivers\\en-US\\acpi.sys.mui","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\drivers\\ndis.sys","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"C:\\popupkiller.exe","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"C:\\stimulator.exe","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"C:\\TOOLS\\execute.exe","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\en-US\\conhost.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\ega.cpi","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%TEMP%\\upd5d22bc58.bat","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\Prefetch\\CMD.EXE-4A81B364.pf","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\Prefetch\\CONHOST.EXE-1F3E9D7E.pf","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\winevt\\Logs\\Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\winevt\\Logs\\Security.evtx","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Themes\\slideshow.ini","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\systemsf.ebd","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\Prefetch\\AgAppLaunch.db","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\Prefetch\\LOGONUI.EXE-09140401.pf","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\ServiceProfiles\\LocalService\\AppData\\Local\\lastalive1.dat","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\winsxs\\Manifests\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\winsxs\\Manifests\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9.manifest","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\en-US\\VAN.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\en-US\\WWanMM.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\en-US\\rasmm.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\en-US\\wlanmm.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\System32\\NetworkList\\Icons\\{09477111-DE61-43CD-A5AA-D9F7B489301F}_32.bin","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"path":"%WINDIR%\\ServiceProfiles\\LocalService\\AppData\\Local\\lastalive0.dat","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\64117FF65CCA910EF18EABCA412EE6C9","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\F690ED4BA8DB8BDC869ED8A95463F2E4C326F2B8","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\19D3E22116838B64477091C8F5B54E31","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"Sandboxie_SingleInstanceMutex_Control","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"Frz_State","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"19D3E22116838B64477091C8F5B54E31","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Sandboxie_SingleInstanceMutex_Control","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Frz_State","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"15878708E1CEB77C7C41E08809A8D981","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"B2075DA07ECA483BDC426C6D719409D0","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"BFF659F3B36D795A1714A7EC985194C3","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"C50E7ADBFF2E359776602185719BDDE5","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"845E0471BDA45BBB4D7F3B7DBFFDD85F","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"B0689E61646F7C8D8401DD7E49363731","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"EFECFF57E6C681499101464178CCA8CD","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]},{"name":"FD8211AADC813A5BAF37ABC7C1FF8D1C","sources":[{"report_type":"sandbox","report_id":"5a0533fc7ca3e1413f3779d4"}]}]}},"report_ids":{"sandbox_job_ids":["5a0533fc7ca3e1413f3779d4"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Trojan.VBKryjetor Sample 43ade0732b10… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 43ade0732b10…. Malware family: Trojan.VBKryjetor. Threat score 100/100. 22/28 AV engines flagged this file. 14 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/43ade0732b103beef40c9c65dfe7854c5b29ff274fc8d5bfe954a2564f4d6396"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.VBKryjetor Sample 43ade0732b10… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 43ade0732b10…. Malware family: Trojan.VBKryjetor. Threat score 100/100. 22/28 AV engines flagged this file. 14 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/43ade0732b103beef40c9c65dfe7854c5b29ff274fc8d5bfe954a2564f4d6396"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.VBKryjetor Sample 43ade0732b10… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 43ade0732b10…. Malware family: Trojan.VBKryjetor. Threat score 100/100. 22/28 AV engines flagged this file. 14 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L33","11",{}]]