24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T485,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 4b190a407bca… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4b190a407bca…. Malware family: Trojan.Generic. Threat score 100/100. 24/29 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f"],"about":{"@type":"SoftwareApplication","name":"worker.exe","applicationCategory":["peexe","executable"],"identifier":"4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":24,"total":29},"behavioralIndicators":{"malicious":6,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T69e,"AXE8SharedExpat.dll" has type "MS-DOS executable" "fastfuzzer.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Archive ctime=Tue Jan 31 18:54:20 2017 mtime=Tue Jan 31 18:54:20 2017 atime=Thu Feb 9 17:49:30 2017 length=22484 window=hide" "ARCTIC.INF" has type "data" "EXPTOOWS.DLL" has type "MS-DOS executable" "espui.dll" has type "MS-DOS executable" "extensibility.dll" has type "MS-DOS executable" "Component Services.lnk" has type "MS Windows shortcut Has Description string Has Relative path Icon number=0 Archive ctime=Mon Jul 13 21:01:40 2009 mtime=Mon Jul 13 21:01:40 2009 atime=Wed Jun 10 20:17:44 2009 length=124118 window=hide" "AppMem.Reg" has type "data" "al.exe" has type "MS-DOS executable" "c2.dll" has type "MS-DOS executable" "AcroExt.exe" has type "MS-DOS executable" "Downloads.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Read-Only Directory ctime=Sun Feb 15 18:13:15 2015 mtime=Thu Apr 21 20:17:42 2016 atime=Thu Apr 21 20:17:42 2016 length=0 window=hide" "c1.dll" has type "MS-DOS executable" "dt_shmem.dll" has type "MS-DOS executable" "GetAppBoost.Vbs" has type "data" "dumpbin.exe" has type "MS-DOS executable" "c1xx.dll" has type "MS-DOS executable" "Desktop background.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Archive ctime=Thu Apr 21 20:17:38 2016 mtime=Thu Apr 21 20:17:38 2016 atime=Thu Apr 21 20:17:42 2016 length=1277956 window=hide" "Consume.exe" has type "MS-DOS executable" "ACEODDBS.DLL" has type "MS-DOS executable"26:T908,"" opened "C:\$Recycle.Bin\S-1-5-21-4162757579-3804539371-4239455898-1000\desktop.ini" with delete access "" opened "C:\autoexec.bat" with delete access "" opened "C:\config.sys" with delete access "" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\Office64WW.msi" with delete access "" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\Office64WW.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\ose.exe" with delete access "" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\osetup.dll" with delete access "" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\OWOW64WW.cab" with delete access "" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\PidGenX.dll" with delete access "" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\setup.exe" with delete access "" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\StandardWW.msi" with delete access "" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\StandardWW.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\StdWW.cab" with delete access "" opened "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab" with delete access "" opened "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi" with delete access "" opened "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi" with delete access "" opened "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml" with delete access27:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791369067618,"unified_at":"2026-10-07T10:31:07.618Z","metadata":{"hashes":{"sha256":"4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f","sha1":"d02937c29a00c4d15fbcb19a9afd85a9ad3fce6b","md5":"99df60e4e6bd3497f40736a408dd0a46","sha512":"aa902f62c05b5682209459d354dc70d243125612fff1000879b5ee0d32b58c8b503a140942376483ad41de4c4d29502bf3f3f92a4a910418f9af3b5cf6671f32","ssdeep":"6144:ffwD/eHK1rGTAOKPMrYB4D/lkWnIb/YsGG9zKL:ffwDz1+Nr84D/labh+L","ssdeep_chunks":["6144:ffwD/eH","6144:fwD/eHK","6144:wD/eHK1","6144:D/eHK1r","6144:/eHK1rG","6144:eHK1rGT","6144:HK1rGTA","6144:K1rGTAO","6144:1rGTAOK","6144:rGTAOKP","6144:GTAOKPM","6144:TAOKPMr","6144:AOKPMrY","6144:OKPMrYB","6144:KPMrYB4","6144:PMrYB4D","6144:MrYB4D/","6144:rYB4D/l","6144:YB4D/lk","6144:B4D/lkW","6144:4D/lkWn","6144:D/lkWnI","6144:/lkWnIb","6144:lkWnIb/","6144:kWnIb/Y","6144:WnIb/Ys","6144:nIb/YsG","6144:Ib/YsGG","6144:b/YsGG9","6144:/YsGG9z","6144:YsGG9zK","6144:sGG9zKL","12288:ffwD/eH","12288:fwD/eHK","12288:wD/eHK1","12288:D/eHK1r","12288:/eHK1rG","12288:eHK1rGT","12288:HK1rGTA","12288:K1rGTAO","12288:1rGTAOK","12288:rGTAOKP","12288:GTAOKPM","12288:TAOKPMr","12288:AOKPMrY","12288:OKPMrYB","12288:KPMrYB4","12288:PMrYB4D","12288:MrYB4D/","12288:rYB4D/l","12288:YB4D/lk","12288:B4D/lkW","12288:4D/lkWn","12288:D/lkWnI","12288:/lkWnIb","12288:lkWnIb/","12288:kWnIb/Y","12288:WnIb/Ys","12288:nIb/YsG","12288:Ib/YsGG","12288:b/YsGG9","12288:/YsGG9z","12288:YsGG9zK","12288:sGG9zKL","6144:ffwDz1+","6144:fwDz1+N","6144:wDz1+Nr","6144:Dz1+Nr8","6144:z1+Nr84","6144:1+Nr84D","6144:+Nr84D/","6144:Nr84D/l","6144:r84D/la","6144:84D/lab","6144:4D/labh","6144:D/labh+","6144:/labh+L"],"imphash":"9e85bc8cd0863f7512a06d6eb4c79827"},"file_info":{"file_name":"worker.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":354816,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1528878807000,"last_seen":1660145669000,"last_multi_scan":1660145669000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["Ransomware"]},"stats":{"av":{"malicious_count":24,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":8,"suspicious_count":15,"malicious_count":6,"total":29},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.trtj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Gandcrab02.Exp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1213131","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKDZ.44416","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.PSW.Coins.GH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/S-0ad45733!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKDZ.44416 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.HGKQ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.GandCrab","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005338861 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Agent.abxn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Packed-FGQ!99DF60E4E6BD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.fdrxdh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Trojan.Chapak.ZZ6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/GandCrab-D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan.Gen.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Mal_HPGen-37b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Mal_HPGen-37b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.AMN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Encoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.901770","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 62022-2474-004062C5","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 62022-2522-00413FDA\n GetProcessHeap@KERNEL32.DLL at 00013854-00003392-65467-1-004021D1","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"*.pdb\"\n \"*.pdbx\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\02130ye0T5GMhu3.exe\"\n \"\" created file \"%TEMP%\\02130ye0T5GMhu3.exe:Zone.Identifier\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$25","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\explorer.exe\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"*.COM\"\n Heuristic match: \"*.cat\"\n Heuristic match: \"*.info\"\n Heuristic match: \"*.xxx\"\n Pattern match: \"https://coinatmradar.com/\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"worker.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Writes to a desktop.ini file (may be used to cloak folders)","description":"\"\" wrote 33 bytes to file \"C:\\$RECYCLE.BIN\\S-1-5-21-4162757579-3804539371-4239455898-1000\\DESKTOP.INI\" (Byte Offset: 96): f��B2�J#��v�H��P�0E��","origin":"API Call","relevance":3,"id":"api-34","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 38 calls to GetProcAddress@KERNEL32.dll at 62022-1032-004051C9","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.93829683053","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"worker.exe.bin\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to measure performance","description":"rdtsc at 00013854-00003392-65467-75-0040124F\n rdtsc at 00013854-00003392-65467-4-004010FC","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-6","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"*.vbox-prev\" (Indicator: \"vbox\")\n \"*.vboxsave\" (Indicator: \"vbox\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FreeResource@KERNEL32.DLL at 00013854-00003392-65467-4-004010FC\n FindResourceA@KERNEL32.DLL at 00013854-00003392-65467-16-00401F87","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\$Recycle.Bin\\S-1-5-21-4162757579-3804539371-4239455898-1000\\desktop.ini\"\n \"\" read file \"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AGMGPUOptIn.ini\"\n \"\" read file \"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\DEU\\eula.ini\"\n \"\" read file \"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\ENU\\eula.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"AXE8SharedExpat.dll\" has type \"MS-DOS executable\"\n \"EXPTOOWS.DLL\" has type \"MS-DOS executable\"\n \"espui.dll\" has type \"MS-DOS executable\"\n \"extensibility.dll\" has type \"MS-DOS executable\"\n \"al.exe\" has type \"MS-DOS executable\"\n \"c2.dll\" has type \"MS-DOS executable\"\n \"AcroExt.exe\" has type \"MS-DOS executable\"\n \"c1.dll\" has type \"MS-DOS executable\"\n \"dt_shmem.dll\" has type \"MS-DOS executable\"\n \"dumpbin.exe\" has type \"MS-DOS executable\"\n \"c1xx.dll\" has type \"MS-DOS executable\"\n \"Consume.exe\" has type \"MS-DOS executable\"\n \"ACEODDBS.DLL\" has type \"MS-DOS executable\"\n \"ehiUserXp.ni.dll\" has type \"MS-DOS executable\"\n \"Accessibility.ni.dll\" has type \"MS-DOS executable\"\n \"ASWhook.dll\" has type \"MS-DOS executable\"\n \"EnvDTE.ni.dll\" has type \"MS-DOS executable\"\n \"DW20.EXE\" has type \"MS-DOS executable\"\n \"ACECORE.DLL\" has type \"MS-DOS executable\"\n \"ACEEXCH.DLL\" has type \"MS-DOS executable\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"ALCMETER\"; Value: \"%TEMP%\\02130ye0T5GMhu3.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$26","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"ehiUserXp.ni.dll\" claimed CRC 4220319378 while the actual is CRC 378247\n \"Accessibility.ni.dll\" claimed CRC 878497390 while the actual is CRC 116596\n \"EnvDTE.ni.dll\" claimed CRC 1082730051 while the actual is CRC 87921\n \"ehRecObj.ni.dll\" claimed CRC 4220319378 while the actual is CRC 583504\n \"ehiwmp.ni.dll\" claimed CRC 4220319378 while the actual is CRC 707529\n \"EnvDTE80.ni.dll\" claimed CRC 1082730051 while the actual is CRC 359082\n \"ehiExtens.ni.dll\" claimed CRC 4220319378 while the actual is CRC 308159\n \"dfsvc.ni.exe\" claimed CRC 1012014663 while the actual is CRC 221140","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"DeviceIoControl\n LoadLibraryW\n GetModuleFileNameA\n GetCommandLineW\n LoadLibraryExW\n GetStartupInfoW\n GetCommandLineA\n GetProcAddress\n UnhandledExceptionFilter\n FindFirstFileExA\n GetTempPathW\n FindNextFileA\n GetModuleHandleW\n TerminateProcess\n GetModuleHandleExW\n WriteFile\n CreateFileW\n IsDebuggerPresent\n GetTickCount\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%TEMP%\\02130ye0T5GMhu3.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"44/67 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"44/67 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"Internal YARA signature matched on process \"worker.exe\"\n Internal YARA signature matched on file \"all.bstring\"","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"_ReadMe_.txt\" which has been seen in the context of ransomware (Indicator: README_.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\\worker.exe:Zone.Identifier\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"The analysis extracted a known ransomware file"}],"sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":17,"dropped_files_count":0,"extracted_files_count":209,"files_written_count":73,"files_deleted_count":0,"registry_keys_created_count":7,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["Ransomware"],"sample_flags":["Extracted Files","User Comment"],"sandbox_reports":[{"id":"5b20d4c77ca3e17c480faeb6","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"worker.exe","analysis_start_time":"2018-06-13T09:22:24+00:00","indicators_count":{"informative":8,"suspicious":19,"malicious":7},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}],"processes":[{"pid":3392,"ppid":0,"name":"worker.exe","command_line":"","sha256":"4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f","normalized_path":"C:\\worker.exe","uid":"00013854-00003392","icon":"$27"}],"all_imported_dlls":["msctf.dll","lpk.dll","imm32.dll","advapi32.dll","comctl32.dll","msvcr100.dll","KernelBase.dll","gdi32.dll","msvcrt.dll","shell32.dll","user32.dll","usp10.dll","shlwapi.dll","sechost.dll","rpcrt4.dll","ntdll.dll","kernel32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"extensibility.dll","sha256":"7303a84c424e4becf5d127eb6a8c10e0646f22c17c255f160ff17e936237eeb5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"AXE8SharedExpat.dll","sha256":"1f9820c292bf2f0e3259da087a211eac661ce1a753ec0e805f3567bdb5b703a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"AXSLE.dll","sha256":"1126c2541c8faf44b1d71627b4c05ceea06d40954356f805dd60c083fe976741","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"AcroExt.exe","sha256":"116e7e5fa172c1fd46f1bcd490bab0c7fc49fd7a1988566712f4802e4ad2a6e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"cef.pak","sha256":"7d2820ad9d4b227bf4bbe7e26e0e4ecca6727f212f4089723c02acb679f96a25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"AcroRdIF.dll","sha256":"4302edfa6a0823af5c29eccca0ab65a6eaa889130c450ca126f66f8387e47845","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Acrofx32.dll","sha256":"247738dfdb3588163dd21567faee45f0fbba4fafce97c35dd8d7c0d3e6d95981","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"AdobeCollabSync.exe","sha256":"7a5d442ea4eb54620781f463c376c0c4f6dfa5ec49cb5cc9a9170503dc6f4e86","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"AdobeXMP.dll","sha256":"98c7e4d7b69d45bd1b0005c18ab19003c40bdcbe58317f9e1ddfd66a7b9c3c22","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ExtendScript.dll","sha256":"12f1ec60e0d21c50cb1cddce42b0292f2db0703eb50b3e871a71cc65d043f5ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"AdobeID.pdf","sha256":"613a1487207489482b355c4675d9d88afa73b7ca4516ce4719a240454cbf578a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"DefaultID.pdf","sha256":"4c1baa6715e9ac990be01ab3afdd08cd3cb06283b2bf665379df7d316c5cdee9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"eula.ini","sha256":"b3161cf5f2a18fe67163ff44a3fa40cf22394b22b70b63207adc79fd77c424a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"DEXShare.spi","sha256":"ef5173fc594310c3c75cc4c46e1a55c94e75c62becb71adbeeb15326192250e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"create_form.gif","sha256":"b86714d0e0acad3cc09039e516684cb61fea717c6c251f165a58b05fef013bf4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"distribute_form.gif","sha256":"25f3535759fe15d60dfeedbb8b90c733a2e61137ee661b7bf59b9e674010526e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"email_initiator.gif","sha256":"fed4c7e9681ef6d9d2a6b326547b8b3f024c3b481c9d089764aad9bf0a67b926","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ended_review_or_form.gif","sha256":"64393faf62f79c041cb95f9943d60c8b8ef577b44a21bcb2edb6b6e2510f2540","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"forms_super.gif","sha256":"b7e540795ff448e31a8261cf72b89844cc6d363765ace6d82c8ccbc25e0b79cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"adoberfp.dll","sha256":"6ca07f9f7ab16300408bf9d93276834c9e8383724b459bac4fa85ca6089a8d7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ccme_base.dll","sha256":"361e0c2549a8a720d47d1ca10d959524bb0f15637ae35e5e2bf542aa364a99b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ccme_base_non_fips.dll","sha256":"7f4ceaf0e82415556e3f01c5384978e3826406e68dab4a943af05c858fcbb638","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ccme_ecc.dll","sha256":"856b7f58e1523119e7d38f57ee86591ad9a979d88bde8c6dcc9a86a7c78095d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Application Verifier.lnk","sha256":"236e65c6b1eb99af74dc95bbed54c416e9349d612da6d1c29cc3e51186ddd543","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"AutoItX3.PowerShell.dll","sha256":"3477cf2c7955c92d470d545d43c7c7174a602977cca8fe77855410d9ea9c5d10","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"AutoItX3.dll","sha256":"d94008b47abedc61536ddf23b6f44cf0077f7a9ce186a62f18718bf0a8125d63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"calculator.vbs","sha256":"44e9dd1be88b617fa945dfd6aa757362bf44eeae7b581717c58e0810bfd333e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"_Excel4.xls","sha256":"e284dfbd3bccb3d5ae425e4a48a5f16ccaa34df5be7a5870615c76093d55735c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"02130ye0T5GMhu3.exe","sha256":"3945f1f0bf9b0a6b7aa222284b1d6362e1132e80a5b137863816fde6eecef97a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ExcelMUI.msi","sha256":"a71927e0f1140e321814282b1f31a5a1ab130c96a87154047f4728c0f511a51b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"DW20.EXE","sha256":"038b2fd0061646880b953d8855114fb1ae75aae11a9c95348369470bf27030c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"dwdcw20.dll","sha256":"58789344c41953aa609a4750e620993d18d87e5db1d96d0065f3c200ec8f11b7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"fastfuzzer.lnk","sha256":"bda7392e1833b61b69d487edb0c041c42124cfe36674b98a902b5c09efda63ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ARCTIC.INF","sha256":"a703c5800c7ecc3e97b1833cc505b7ee7c3d68eca21e73d5a6838228f3ae5e43","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"EXPTOOWS.DLL","sha256":"0d720502b580007c5d4232d7a71ee8fb23e09405757a7bbb0f6d6fc344be0616","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"espui.dll","sha256":"c39ae6d46886239e30773a6d6c523cec9ce4d56960887de3c4fb58b5207b6645","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Component Services.lnk","sha256":"4b62a3aec39878d88c8a89846053f7e8da9f70be4ff5704bf1d8ad498a5e1588","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"AppMem.Reg","sha256":"004ce3e180930e2b867080ff53000bbce43e9ecee34151df958e6132ab1f9e31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"al.exe","sha256":"7dc8bf26577c626e26e3a97c44e25b8be882cd0963f65d5617f6f5b0f35443ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"c2.dll","sha256":"eb300901dbe8cd08c4b131ce36af436202b9db357e87998bdbc8f6dc31e92a50","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Downloads.lnk","sha256":"ac022d277bd5f6e4f96db09e87db2d815b4d856179969e5461f966ebc4cdcd29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"c1.dll","sha256":"e6103b72c766b8afe79c9709d6ce3a02fdebf4367dd81871f6ce90c3898648e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"dt_shmem.dll","sha256":"6e6b8126e4a1fc7f1657ab3e20db18673ad6874df6297a7f62e6573a9f661c03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"GetAppBoost.Vbs","sha256":"9ed21220a9cb7f123cfd780594441e06dac8a02c6926d188ef1401d660f0b2eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"dumpbin.exe","sha256":"38a284ca23f10e56b3666616463f4f559c85c1ffba4ddbfdebeed8a9e1dbd8d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"c1xx.dll","sha256":"da1eedcd2aa04a03550904f9e08c2e550a18a4dadf7dd3f3ad3ec87b4051a570","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Desktop background.lnk","sha256":"8c774f4e3adf1bdd9af40b5a648468be5e57c36d16500d76208ef920d02b951d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Consume.exe","sha256":"06aeefd0a543839c4df80c261787a95a2f1cd5b625d1d3d07b7c858dff8a3102","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ACEODDBS.DLL","sha256":"4a3d111c6820e97f750e228f3de3038cf345cba7be0b3923b0b7c2a5d823e773","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ehiUserXp.ni.dll","sha256":"41e61c030d664b15a0b600ebb454c1d39d59589d4315833d0846e0da0bd30f0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"demo_script.ps1","sha256":"6798858fb3b40301aeccb2500b425512162ef48c7627f2ac17f4863a7b47ab4c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Accessibility.ni.dll","sha256":"69cabd3384e635a38c9463b83b8879987e305624f79d15a83f7fa9bae1904028","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"classreg2.reg","sha256":"5373f289bcbf64b90f1e9a81c6f52cab5fb2b7e6f53d825ec9dbd58d9742afee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ASWhook.dll","sha256":"78aa17f732696d00b2ed7132189be9ac02cfa4529c2ea005b2ad7eaf6342800c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"EnvDTE.ni.dll","sha256":"78c288caf0027748faef0657574ad81f7f21c3fc9e6a47943616f081dbbb30b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ACECORE.DLL","sha256":"66f3477372fcc90a5b3ecac809b14d21856f89a409d86f492a72a8522427e675","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"CANYON.INF","sha256":"9c2e52b5a4d8dee8fe5d25e060f2f22eb321d70abc2ab81057ff1732c63a06e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ACEEXCH.DLL","sha256":"1ba3a6581bd3f26293c8b364490e7156462ab615441464bf85be49dde1337a84","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"6SZfLTu9z.doc","sha256":"b6f2df4155227654ca0ba6cfdf75e556156072ad663b6fc9cbb62a631d9ee29c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"BLUEPRNT.INF","sha256":"6085baaa18d60a9b36a7f01454eaf73b2c326a32b09e7fae43b84b5cd9a6e8b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Associations.reg","sha256":"e2c9f322dc94a0b610c2679e02e3a22cb3798552661c490ab6a9ff48967c3a96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ftquery.exe","sha256":"e7fa7610ca11988320c521e43fffc08d6a76f0d4e59c159d07741af21ef4fdb5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"first.vbs","sha256":"c9e971f61192c01bd04c854710465988ef80c87e923acd149a57148d79451fe1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"content_classifier.ps1","sha256":"9f7bd2cf65f7412f54f601d1e5ad2bdec240063a60ff050df8088367d14d16b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"cvtres.exe","sha256":"62ba4d4527a969093e51fb2e82f07decc5dbacb5bf0287d6f164be3e26f73806","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"coloader80.dll","sha256":"792658390bceb9d0f8056d5b5375c6e1eae29f10bbc4811acaba9d9d010c1f94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"1394dbg.cat","sha256":"efabb58ef076e548d8567c7bdc618726d7f647903131818bc4030ea484e70b5e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ehRecObj.ni.dll","sha256":"975696545560bf2c8dc26dcf0ceb4de1dfb52482d41ea2011761ab336831a640","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"envdte.dll","sha256":"a46d9080b6fd38351cb3a920a000905a8145ee6dd3f6c1977755d19a7af8c8ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"computer.lnk","sha256":"90065f02838c0ba52d15755f5a339b645770de1cb6a31220e6f4311d006c4e9e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"dnsns.jar","sha256":"159481c9d367a7199b25fd71de665e2adb9784cce9f824227dafdc5dd029aeac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Desktop.lnk","sha256":"8d1230720f93f50299c6e48097a55ced2aeb610b28301091344695436d5c7986","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Fusion Log Viewer.lnk","sha256":"9c078cb9561a090f547e35b079cc1224d972cc662a96ca8e89374381cfc8d487","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"FDATE.DLL","sha256":"495eab3bca78db565f71846a374bc775f31c8d78e9978a0b3d3c95de105940f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Appearance and Personalization.lnk","sha256":"e12166a4317d25fdf643023ee7e94b35ebff471599b0563e1b14b87e2b01ee4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ehiwmp.ni.dll","sha256":"11337dadc7d219c4965ba68f9ebdf5d681d0bcc307937630897640d3d60a6ff6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"dbghelp.dll","sha256":"b76fa74e54b262aaf8f514702dd4db74b1a70c8c735e457a7515ba4d1fcdd081","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Debugging Help.lnk","sha256":"f2952605b849ff95244c45c840108effb436080a8d58597a38c79cf287fc361e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"cmddefui.dll","sha256":"69047467aa0c956403784ce74a530eb154a6e12ce73b8dd14106ee7d9f64ffe7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"6WMjwc1zqk3IB.exe","sha256":"55e5c8e3a9c6cb43a3e258a0cc80807312257bd98e5618ea7813c765c678d18a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"fltkd.dll","sha256":"7876bd11fe00ec4e761345a27343b2d83a38421421f260c4838a82d64745d425","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"EXPEDITN.INF","sha256":"8ea60238db0923e434accc42b06cbe35098f1c247d63eadac19a59e93695ea23","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"AXIS.INF","sha256":"3d8f77675e7825b71612ac0682ab86bfbaefc68addb13dc308d567ccfd6cd147","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"custsat.dll","sha256":"fc61598f553607463d1384e98c392ab00d91431f2f67622d8766b05cd63701cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"clrver.exe","sha256":"34d4f6b87664e0c316f59b2eb55ef4031e351fccd3c35559d322988d24006c69","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"chkrzm.exe","sha256":"b207e59a7fec2d8f545fed16635b54fc0c5cf1be7bbfcb2eba0bb5c4dc863a0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"EMSMDB32.DLL","sha256":"913d26c96caf7c271c1179086fd5be87abac129e3cca4baa35842b26e568861c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"cvsindex.cmd","sha256":"10e5f7e1e8dfd5f702e89db47a86b65f20ae3502994146e8799a10dcbe53f918","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"adplus.vbs","sha256":"439768c78c89a10c780546fb0c2c597523a31f7a6fc450e0acfede5e0b4db82e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"deploy.cmd","sha256":"232ff15da7fcb95b6b0568501e4b0e2e4b9d8b61df4cb5b0469256b80f7ef83e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"checkv4.exe","sha256":"e1edb27a1c0f9d95f9584f310a17c4c9ee3815a2085bcf27b3024089d6669e20","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"EEINTL.DLL","sha256":"1695cdb356bfd661764655de139d233af19c3a160ed15a867a27b2d5ebd3357b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ext.dll","sha256":"91cdd5cc2956ae9fb26dcbaef017ebddf1f40414217ccc947791558ccab2604b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"EnvDTE80.ni.dll","sha256":"0aeae72134f81c1cee8b18a766a07e1a46591638e58b2e2619fad93ca743a3e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ACEODBCI.DLL","sha256":"b3ac3886982497a515c179967737b189176a96c89af24e83c5f90330de4d3def","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ehiExtens.ni.dll","sha256":"a3885e7abf9805c4c46f25212269794cf9ba65db1e67a430c07e9d6f56b22a44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"AUDIOSEARCHSAPIFE.DLL","sha256":"77318591e69e2912755385ece4f73b677a35538f1d4730713146810ac52c9516","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"dfsvc.ni.exe","sha256":"b21220d6df46eb489fb62eb00a5ccd2d006c9bab0b1545170f1442d940674844","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"acpikd.dll","sha256":"e0a0838ad112268d9ca79827c0c2eb64bea6402e09fb7e26e981bd3777e96042","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"betest.exe","sha256":"f8f76a7ae020375d4d19b57797002be27cceb840825e8d283058aa23cb0242f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"fontmanager.dll","sha256":"a64eadeacbe9e571cc8bb9b29241979f3ba89650a0e39bd9181b3ee790a48daa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Action Center.lnk","sha256":"a705d8304b20943b83cc8c4e0ae7d0eba395b702298b614d489493cc69f3874a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"GetNetworkAdapterConfig.Vbs","sha256":"76686a6eeb158a290f5babf74ebfcad667bf3e109ec6020cb62e3afad9b87d56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ACEODEXL.DLL","sha256":"2c1c8847f4a171bb49caf8315451619cff31cb6b1b6ffe5f11cb345c9a55a18e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"FreeCell.exe","sha256":"07cfa09aaaf6982b47e723ba29f9ba29a8a469b3ad902eda372b7aac8a5e7e61","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"filtdump.exe","sha256":"7d8bd1b7fc7e3e9257b3018a5a72c69e17b84f5907e8c8b003f1ae323daf22c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"AUDIOSEARCHLTS.DLL","sha256":"de95eb51e12ac2bec2d089670d90d179cf22bad096b595537a60e79006a7523c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ehiWUapi.ni.dll","sha256":"6d21ffcc14afe844d76ee2dfa8304f2f6e3643f5b6cdefefd2f052687a746fb1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"AutoIt Window Info.lnk","sha256":"13d5c171bc8bc6304d6d779d7424b9a425834619aa3a7ef7bc0c04fb035dcfbf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"contextp.dll","sha256":"4cb92e2cb136f5296b7c3c6ede8657ea206ce39930bee034fb87d3ccf6c27054","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Ease of Access.lnk","sha256":"b81ec3952bccc7b83a8392f27e4ce15f2ec16d861c3b80cec0fa5bbd57c8deb6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"browsercomps.dll","sha256":"f580e7b02f2596bee27c34c5389bce15766ea26603c6b5fa8bccf25db7a4ab77","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"0zIG0D.doc","sha256":"a4d9da0f4dfc40aff2cd7fb997257e253ac6ab8b1dafb9e386c50e1981d544f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"charsets.jar","sha256":"bb218fdd704db3896155d0daf13358a859436a72d535a8ad61b4185f8beff0f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Event.dll","sha256":"7e52d73c4d824ae70cba23185c4a5f3b5b7c2ecd8f7679a6a4be021cb7606aa3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"genmanifest.exe","sha256":"50a70b7c8e98e0a50b66b61a30ff6b3c4165a8ee8c3939fc925a47d3486bd5a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Cert2Spc.exe","sha256":"b0a7a4a0c70b56ca8a1da9eb8d1b3d84f90e3c066256299946e189d8005fafbb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"CsiSoap.dll","sha256":"206126b0eb7c7e21214a2e72c140d2426459a145b123d3c9c89135d8db38d39c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Configure Java.lnk","sha256":"c88ba5b2f032a455026d3144397a8ea26e18ea93218b0cbca95f05e4c19efc86","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"awt.dll","sha256":"80a030fc162ec96e3102b6e8ebf882a230c96fb4538e62f52a930c4ec27b4585","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ACETXT.DLL","sha256":"61ab262dc1f64b2418b0dd76e8cb28d169fd649290b80aa856447de88f142048","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"AutoItX Help File.lnk","sha256":"b86d93249f4bd752cb085e277b1c27be034dd16f1afb942b3306c1398c443432","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Calculator.lnk","sha256":"97a989f6d8a42a09b15e817553c689049f89821c4cfb63c95e92ffa6347df831","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"eula.dll","sha256":"22714b6a6d6a7d6ddfb410166bcf5167734b9a7f408ba7c107ea15840f47f458","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Get Help.lnk","sha256":"04138e8d5505be64ed06fcc03c5fd024a997698089ab431932df9f9eeb8d899e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Digital Certificate for VBA Projects.lnk","sha256":"b137ae7117a2f6d68887fb2ca9c80500baa96d8d6cab085fd4da87fb672ec46b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ecmangen.exe","sha256":"b3ce8f3130b8e422876b8958044662f4db2169ca1ff3de62b786b119ef082b41","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"debugoff.reg","sha256":"6597a3db79bab5b8469173f5d5871c40996569ffee1e8286d176895e3461ef80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"apatch.exe","sha256":"94141e576086139863a8f6b8b1009f29b4876242f0bdfdc565a27e70c6042f56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"dumpexam.exe","sha256":"db7098e04a295afbba16ec4699c0f3700717908c3dc591611f9f2bcae64f40d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ACEODBC.DLL","sha256":"527c313975fe51e62ab7cf2e18d50ef8fb46caf52f2ae54ba993adfec049f639","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"chrome.exe","sha256":"8ea0c91d4453f309172d930b6eee770a37ad93471c498836480904bfe4a326f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"eventlog.reg","sha256":"09eb25d9f3a45cd0f46af17bad3d49ce40fabe6279c9d67e5ef406939fc4586d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"bazisvirtualcdbus.cat","sha256":"e3d11ffeb653ce7dd8e5dd418b6dc0096439cfcf00799a2b692fa7acc5d1af08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ACERECR.DLL","sha256":"c9267d39c989e72eddf8bf81b53742830479f102618c48910ecf28d69e4bb5cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"DEEPBLUE.INF","sha256":"b9ee043ad1323c89a80320724f7dea2a3855b3e57e9f8aace3044736db3de761","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Au3Record.exe","sha256":"2e3b4657a3498d679db98ea354c40662d0921e21ed0645f27041db7813bc8ee1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ACEXBE.DLL","sha256":"74a14ef31fa226456c14979a822c672f4eb82a944ed120e24b29ecb351064bd7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"CDLMSO.DLL","sha256":"410b980dcf09d07853360268106b64f9ca281f0000c6940a3f9d1172ab28096c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"FPSRVUTL.DLL","sha256":"7c0df3f67f2882903d41f5baedd3ab8c26e092e7dbaf95ae749ea12136d04fce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"access-bridge.jar","sha256":"70c7b4cfb084df90bf0d65099a70610c12c3189dc81a387aede6a6bd136182d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Adobe Reader XI.lnk","sha256":"b4132a0bbeeeed49494ba500cc4cc82483954a656451f5ccf4c211f3a49bc2bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ACER3X.DLL","sha256":"7fb630ef62b004c30a191d1bf3a5ea92255a225050040235f11aa2228fefadc4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"AxImp.exe","sha256":"3f06d2dfdb19f20af2a92c30fe4717806df22f84225b680a322aa8b9ff259a74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"alarms.reg","sha256":"426f44de68792ef633880c7f1934f6890b8c4661c6bea09018e3761d8a7ba404","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"D3DCompiler_43.dll","sha256":"493fc38c87c5eddb44b95a956fec68dee098723dc5b9174bd99546a72040d680","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"F3hzum1.doc","sha256":"8c5a645ae301c7ed21bd2ebf45af9a5d72c8a12f0e4f4b15cbd84a8e4cf8fe55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"CERTINTL.DLL","sha256":"35a400333c36805e1aa1dfc17e431f56ca5829570c660344df65b2ca1ce9f25b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"dexplmnu.dll","sha256":"6028ba87509f9f6b5909f229d142dfb1061b4e6614805de35284f328efe62ad3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"bckg.dll","sha256":"c414624f59df4576208efc7edb646da2567f2902459bc7a2862c849ebcbc8f1d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"533dac70579b446b35272e89901c1a279024a2d4178f2e423cc3dcdd7a88f14d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"EXP_PDF.DLL","sha256":"3b78476490122e666787c2a5d19fa9b191e31b7a0974c6ac2f3fe6e0d33c7b6c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Chkr.dll","sha256":"62ac1fb3d3d7711d86365b7f6001c452dae6166311e2f2510db6c7b370403df6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"CorFlags.exe","sha256":"cecded155bcb32e7070464101f5a68de72a4fef31eb60280a686da35c8dedcba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"evrprop.dll","sha256":"3a97dd3dbf5418ea69233b27c00509f1333c5e97533fe1c115dee4aa8b5a3f40","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"DisableDHCP.Vbs","sha256":"eaebdcbec121621e57ab24d0bfdc067f99427514a4b348d3bab0522196ef7274","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"CONTAB32.DLL","sha256":"ad61b8516a9cdc6da18d2602b99a2d3e90efbaf64a1e1c3e6960aa62d3e7927a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ehiiTv.ni.dll","sha256":"0061e2b739e66f5938b0c62b8cd21c8104808dfd18b8d15e8ae0a95c604f8343","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"CONCRETE.INF","sha256":"49f776e0907dc4a780e0028d877ef91ceddf34ee73fc672798add85bbda31c13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"FSTOCK.DLL","sha256":"9706d07b022c32a35bfc1154cc86bb23c36e61db4e6c02efa3a40cc17a6127b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"GameExplorer.lnk","sha256":"680e71e480700223b6c800bfca4e20e1521465fdb61758bd4e8fd2712b2bdf7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"FPERSON.DLL","sha256":"54a8ccb1e2b416d2186f580c49e662c437787b985cf88ea66c0bacacc54da3f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"envdte90.dll","sha256":"fdd45bab5fa4eeaadfdf7009bfbf8e3495569cdea5897c99ac5d24dbaae78491","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ACEODTXT.DLL","sha256":"5b72d72ddf1fa73f968a5f30d2fb3f133464e2ef71cb9b18ca2e81311afe7f31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"disco.exe","sha256":"7f3cafb32960943cb3a9ad2b8a0f64df9ba055eafc4e0fa09a234a87a5d49680","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"FreeCellMCE.lnk","sha256":"fb9a95d66baaff2a50f5a5b1cecf633cde826f11a6c777b1be7a3c17d3af4762","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Check For Updates.lnk","sha256":"384779e34a6847c4b3c955e72c2f620fa3fab30ac5606b0323622297d650192a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"chrome_watcher.dll","sha256":"767ece27b1d7986f43155cf226b5d0acb1a119aae18d02aaacb7b01b4d774e01","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Command Prompt.lnk","sha256":"5108bd9d26f4146347e1b19739b8f346ee5de61449aa0b86d8e7deea4fd067a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ContactPickerIntl.dll","sha256":"000adc12a0492989b1d3ffacb8e0a43f910afb9b5b50c3cecfda7aa4ea509197","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Expense.vbs","sha256":"14753a785c46141f0cf350eedabe2061c4e29b9a2ea869c547737fb8dc7f808b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ACEEXCL.DLL","sha256":"6cb4ad12483176242142d0831414d0cd16d6265dc04e412c6f5d98b40a5394db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"dfrgui.lnk","sha256":"7513f658b2dac7f217ca2a065a5801fcf7a9c36ce99187afb9e7e39a4d9d4436","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"EAWFINTL.DLL","sha256":"ab6d2b48d951edb8dd94048452b5d1e1d6b94ce72f60c808e446821c84c80b54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"gc.exe","sha256":"10c38453288b13e9f43349a5196f440c517b6bfe9d038449e12c6544517060f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"AspNetMMCExt.ni.dll","sha256":"0e8d4a8449f160fedc85be080d943fad0467518de0b3012058e400bae5d962be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"exts.dll","sha256":"9444dcf90de8c9e19374ac2ada7ddb36361b506223b5b959033fa3d013032091","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"AdobeHunspellPlugin.dll","sha256":"79e84ede6d88e3c4fc38e451cc935912d8fa55bccc105a86e8273c088d4b5500","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"envdte80.dll","sha256":"95f697c6523cd4bc903b416e0c030cb57acb5ab5d1f548a9559732a285b245f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"EXPSRV.DLL","sha256":"2fae8fe90c3f1705c7aa538eead8d4bb7713014babbff5e478bead86a5c3293d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Accessible Event Watcher.lnk","sha256":"5fec9dceab5cb4423096ab87589e5d1996cc24f4f2175ec2cb063c3794d5f311","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"FxCopSetup.exe","sha256":"c2a508e56b6af6745f8472d8aebae57d5fa7a413d268671d16ede0eb2d1c1850","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"getnetworkadapterconfig.pl","sha256":"73b63de1eff36ade26aa9add3f230c09d28051aab6c98ab8089a9a8dab43b231","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ApothecaryMergeLetter.dotx","sha256":"4f0347284c06a27361aad113d7bafcbbe06ad5ac72bc8cc2138009246acf8cc8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"getappboost.pl","sha256":"823db10f33059ac3c892c7faf55e693d89d5e0bcdef310bf59607a817247fd8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"AdjacencyLetter.dotx","sha256":"751c62f02779f69c66d23574822f7dd8f5908cd9e300999f45efd52a770985f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ExecutiveNewsletter.dotx","sha256":"eaf89e850d04d949dfbbcd11a41646d2440df2c5702015c3aedf87238805ccf0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"domainname.pl","sha256":"2d70d15eeb0f2d8f8092484175e26e479418285ec37c1e2b765c573d15355b43","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ExecutiveLetter.dotx","sha256":"b2d55a418cf1574df6663ba74cb344dc96bc0160958a4f109911913b4b530889","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"FUNCRES.XLAM","sha256":"b700040e4daa41741483d03a2849557d8e87994586dd9c9c9a87363d30e9cb57","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"AdjacencyMergeLetter.dotx","sha256":"d632a806e453cd4b3024ca92eac0266d0ec8c4a80455dcb0f4edeb4f98bd8fb0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Fancy.dotx","sha256":"ed0aab95685b02a8b55be5e0da1ce2fa61b7ce0b54a1d1f3b494982666a05fa1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"BloodPressureTracker.xltx","sha256":"9b9274dd9b671622b189d450fd406485eca3d84fd8a063f8e9c392ffd2def405","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ContemporaryPhotoAlbum.potx","sha256":"4f44db11b7b99d68b768353cf8af9086620272366a604d90e9eaa5b8b698b399","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"binding.pl","sha256":"5d9335eb43398e440f44365ed3724baaadff63fa23a9aa7e6708070d6da471dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ApothecaryNewsletter.dotx","sha256":"dbf95c4a306cb350f73e0618643119e91252b3b182720ba3d4efac7faebc04aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ExpenseReport.xltx","sha256":"4581ebba7420cd90ddc415582afbe9b0800f59f5d63ec611ce45a5100a8c3979","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"ExecutiveMergeLetter.dotx","sha256":"ccf93c265dc60085d228321859dd858feb093ca44fff05c1c1a9ed5736c50e99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"EquityResume.Dotx","sha256":"774cdca1c5ff129311cd23fcb599a2c98c721b8ed06b4cd5c89bca7d53fc1449","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"deleteservice.pl","sha256":"e4106c81a97167254becfd055c8e4c7bfd4ac1e5e27498a287dc0458b047beee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"AdjacencyResume.dotx","sha256":"321fff09ca5ecce0310e1c2b6141b8f41388ab3c6d41c37e7c9b55e52ce167c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"cleareventlog.pl","sha256":"7406ab822b91854f80c11d13871fb8bb4e1f8635832ec07478314475256ecf29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"EssentialMergeLetter.dotx","sha256":"286a37c00286a37d04307d3ee6a596783985eee149a470d2f618bf9a22d4b9b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Building Blocks.dotx","sha256":"09bbdea3661e55ed3db8b15f859d60a4581f6de54d03224c859eb1d28537e7c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"enabledhcp.pl","sha256":"4ec0b48af46845f4688210bf3c747d8d3e964fd7bbdab4d96e9fb4217cfbc116","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"EquityMergeFax.Dotx","sha256":"7442bc8bf10a648c955f07fff98b940180d8e69a2229a49442200b122795e4a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Classic.dotx","sha256":"5c3a1b899b21652d7002878545c8eecfc0c7a8162dc1d0e75734e5198054d72d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"cimomid.pl","sha256":"c55e111ba9cd420cd5daed07577bf5dfa942079de63e2c947a2fadbf19e7842b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"name":"Formal.dotx","sha256":"f6f01bbf865ad5adbcf2d26dfa62a0c3894a161a0bce6b5cb0170a3a9dd3c7b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]}],"files_written":[{"path":"%WINDIR%\\explorer.exe","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"C:\\worker.exe","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%TEMP%\\02130ye0T5GMhu3.exe","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"C:\\worker.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%TEMP%\\02130ye0T5GMhu3.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-4162757579-3804539371-4239455898-1000\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"C:\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Esl\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\locales\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AIR\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Browser\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\DEU\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\ENU\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Javascripts\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\DEU\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\ENU\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm\\PMP\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins3d\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins3d\\prc\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\PFM\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\SaslPrep\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\ICU\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\Application Verifier\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoIt3.exe","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\C++\\AutoItX\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\C++\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\VBScript\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\Images\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Simple\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\....PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_YOU_HAVE_ONLY_1_SINGLE_CHANCE_YOU_NEED_TO_PURCHASE_THE_DECRYPTOR_FROM_US_FAST_AND_URGENT\\","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\GZEIZJTHTUXIBXE\\","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\GZEIZJTHTUXIBXE\\DEFAULTICON\\","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\GZEIZJTHTUXIBXE\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\GZEIZJTHTUXIBXE\\SHELL\\","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\GZEIZJTHTUXIBXE\\SHELL\\OPEN\\","sources":[{"report_type":"sandbox","report_id":"5b20d4c77ca3e17c480faeb6"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5b20d4c77ca3e17c480faeb6"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 4b190a407bca… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4b190a407bca…. Malware family: Trojan.Generic. Threat score 100/100. 24/29 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 4b190a407bca… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4b190a407bca…. Malware family: Trojan.Generic. Threat score 100/100. 24/29 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4b190a407bca89dd4778afa551bdc58dddff26fc5fe7622453e836ecdfaf565f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 4b190a407bca… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4b190a407bca…. Malware family: Trojan.Generic. Threat score 100/100. 24/29 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]