24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4da,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 50dca038c230… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 50dca038c230…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 12/26 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/50dca038c2306d0d7cc9833216461f979be25421cb67c7b033c30e33ba4b432a","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","50dca038c2306d0d7cc9833216461f979be25421cb67c7b033c30e33ba4b432a"],"about":{"@type":"SoftwareApplication","name":"Sample_5a549695ed9ecc0f9ba445a9.bin","applicationCategory":["peexe","executable"],"identifier":"50dca038c2306d0d7cc9833216461f979be25421cb67c7b033c30e33ba4b432a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":12,"total":26},"behavioralIndicators":{"malicious":4,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T647,"" created file "C:\Users\%OSUSER%\AppData\Local\Temp\afolder\bg.mp3" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\afolder\cmdc.exe" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\afolder\death.bat" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\afolder\deathnote.bat" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\afolder\mp3play.exe" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\afolder\note.vbs" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\afolder\Rar.exe" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\afolder\timemon.bat" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\afolder\WARNING.vbs" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\afolder\wget.exe" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\afolder\WIFI-CONNECT.bat" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\afolder\windows defender.bat" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\afolder\WIFI.lnk" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\afolder\WINDEFEND.lnk" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\afolder\death.lnk" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\afolder\deathnote.lnk" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\ytmp\tmp4292.bat" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\ytmp\tmp6266.exe"26:T579,"/c if not exist "%TEMP%\afolder" mkdir "%TEMP%\afolder"" on 2018-1-18.04:25:28.331 "/c if not exist "%TEMP%\ytmp" mkdir "%TEMP%\ytmp"" on 2018-1-18.04:25:28.632 "/c attrib +h %TEMP%\ytmp" on 2018-1-18.04:25:28.712 "/c if exist "%TEMP%\afolder\bg.mp3" del "%TEMP%\afolder\bg.mp3"" on 2018-1-18.04:25:29.073 "/c cls" on 2018-1-18.04:25:31.105 "/c if exist "%TEMP%\afolder\cmdc.exe" del "%TEMP%\afolder\cmdc.exe"" on 2018-1-18.04:25:31.206 "/c cls" on 2018-1-18.04:25:31.316 "/c if exist "%TEMP%\afolder\death.bat" del "%TEMP%\afolder\death.bat"" on 2018-1-18.04:25:31.456 "/c cls" on 2018-1-18.04:25:31.576 "/c if exist "%TEMP%\afolder\deathnote.bat" del "%TEMP%\afolder\deathnote.bat"" on 2018-1-18.04:25:31.656 "/c cls" on 2018-1-18.04:25:31.776 "/c if exist "%TEMP%\afolder\mp3play.exe" del "%TEMP%\afolder\mp3play.exe"" on 2018-1-18.04:25:31.867 "/c cls" on 2018-1-18.04:25:32.037 "/c if exist "%TEMP%\afolder\note.vbs" del "%TEMP%\afolder\note.vbs"" on 2018-1-18.04:25:32.127 "/c cls" on 2018-1-18.04:25:32.377 "/c if exist "%TEMP%\afolder\Rar.exe" del "%TEMP%\afolder\Rar.exe"" on 2018-1-18.04:25:32.808 "/c cls" on 2018-1-18.04:25:33.148 "/c if exist "%TEMP%\afolder\timemon.bat" del "%TEMP%\afolder\timemon.bat"" on 2018-1-18.04:25:33.329 "/c cls" on 2018-1-18.04:25:33.569 "/c if exist "%TEMP%\afolder\WARNING.vbs" del "%TEMP%\afolder\WARNING.vbs"" on 2018-1-18.04:25:33.73927:T891,Spawned process "cmd.exe" with commandline "/c if not exist "%TEMP%\afolder" mkdir "%TEMP%\afolder"" (UID: 00029471-00003356) Spawned process "cmd.exe" with commandline "/c if not exist "%TEMP%\ytmp" mkdir "%TEMP%\ytmp"" (UID: 00029486-00003364) Spawned process "cmd.exe" with commandline "/c attrib +h %TEMP%\ytmp" (UID: 00029513-00003304) Spawned process "attrib.exe" with commandline "attrib +h %TEMP%\ytmp" (UID: 00029528-00003336) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\afolder\bg.mp3" del "%TEMP%\afolder\bg.mp3"" (UID: 00029547-00003296) Spawned process "cmd.exe" with commandline "/c cls" (UID: 00029751-00001880) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\afolder\cmdc.exe" del "%TEMP%\afolder\cmdc.exe"" (UID: 00029762-00003328) Spawned process "cmd.exe" with commandline "/c cls" (UID: 00029773-00003200) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\afolder\death.bat" del "%TEMP%\afolder\death.bat"" (UID: 00029787-00002492) Spawned process "cmd.exe" with commandline "/c cls" (UID: 00029798-00002524) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\afolder\deathnote.bat" del "%TEMP%\afolder\deathnote.bat"" (UID: 00029807-00002596) Spawned process "cmd.exe" with commandline "/c cls" (UID: 00029819-00002552) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\afolder\mp3play.exe" del "%TEMP%\afolder\mp3play.exe"" (UID: 00029828-00002396) Spawned process "cmd.exe" with commandline "/c cls" (UID: 00029840-00002556) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\afolder\note.vbs" del "%TEMP%\afolder\note.vbs"" (UID: 00029854-00003280) Spawned process "cmd.exe" with commandline "/c cls" (UID: 00029877-00003264) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\afolder\Rar.exe" del "%TEMP%\afolder\Rar.exe"" (UID: 00029888-00003284) Spawned process "cmd.exe" with commandline "/c cls" (UID: 00029954-00002748) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\afolder\timemon.bat" del "%TEMP%\afolder\timemon.bat"" (UID: 00029972-00002348) Spawned process "cmd.exe" with commandline "/c cls" (UID: 00029991-00002528)28:T8c5,"WIFI-CONNECT.bat" has type "DOS batch file ASCII text with CRLF line terminators" "Rar.exe" has type "PE32 executable (console) Intel 80386 for MS Windows" "WINDEFEND.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Working directory Has command line arguments Archive ctime=Tue Jan 9 05:23:42 2018 mtime=Tue Jan 9 05:23:42 2018 atime=Fri Sep 29 21:31:42 2017 length=13824 window=hide" "note.vbs" has type "ASCII text with no line terminators" "deathnote.bat" has type "DOS batch file ASCII text with CRLF line terminators" "wget.exe" has type "PE32 executable (console) Intel 80386 for MS Windows UPX compressed" "WARNING.vbs" has type "ASCII text with no line terminators" "tmp4292.bat" has type "DOS batch file ASCII text with CRLF line terminators" "timemon.bat" has type "DOS batch file ASCII text with CRLF line terminators" "cmdc.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "tmp6266.exe" has type "PE32 executable (console) Intel 80386 for MS Windows" "death.bat" has type "DOS batch file ASCII text with CRLF line terminators" "WIFI.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Working directory Has command line arguments Archive ctime=Tue Jan 9 05:23:42 2018 mtime=Tue Jan 9 05:23:42 2018 atime=Fri Sep 29 21:31:42 2017 length=13824 window=hide" "deathnote.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Working directory Has command line arguments Archive ctime=Tue Jan 9 05:36:56 2018 mtime=Tue Jan 9 05:36:56 2018 atime=Fri Sep 29 21:31:42 2017 length=13824 window=hide" "windows defender.bat" has type "DOS batch file ASCII text with CRLF line terminators" "mp3play.exe" has type "PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows" "death.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Working directory Has command line arguments Archive ctime=Tue Jan 9 05:23:42 2018 mtime=Tue Jan 9 05:23:42 2018 atime=Fri Sep 29 21:31:42 2017 length=13824 window=hide" "bg.mp3" has type "Audio file with ID3 version 2.4.0 contains: MPEG ADTS layer III v1 192 kbps 44.1 kHz Stereo"29:Tab5,Heuristic match: "command.com" Heuristic match: "HEAD /v11/2/windowsupdate/redir/v6-win7sp1-wuredir.cab?1801181224 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-AgentHost: ds.download.windowsupdate.com" Heuristic match: "GET /v11/2/windowsupdate/redir/v6-win7sp1-wuredir.cab?1801181224 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-AgentHost: ds.download.windowsupdate.com" Pattern match: "crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X" Pattern match: "http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T" Pattern match: "www.microsoft.com/pki/certs/MicrosoftRootCert.crt0" Pattern match: "www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%201.1.crl0m" Pattern match: "www.microsoft.com/pkiops/certs/Microsoft%20Update%20Signing%20CA%201.1.crt0" Pattern match: "http://update.microsoft.com" Pattern match: "www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl0m" Pattern match: "www.microsoft.com/pkiops/certs/Microsoft%20Update%20Signing%20CA%202.2.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/Mi" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0" Pattern match: "www.microsoft.com/PKI/docs/CPS/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0" Pattern match: "www.microsoft.com" Pattern match: "www.microsoft.com/pkiops/crl/Microsoft%20Update%20Secure%20Server%20CA%202.1.crl0u" Pattern match: "www.microsoft.com/pkiops/certs/Microsoft%20Update%20Secure%20Server%20CA%202.1.crt0" Heuristic match: "HEAD /v11/3/windowsupdate/selfupdate/WSUS3/x86/Win7SP1/wsus3setup.cab?1801181224 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-AgentHost: ds.download.windowsupdate.com" Heuristic match: "GET /v11/3/windowsupdate/selfupdate/WSUS3/x86/Win7SP1/wsus3setup.cab?1801181224 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-AgentHost: ds.download.windowsupdate.com" Pattern match: "https://www.update.microsoft.com/" Pattern match: "www.microsoft.com/pkiops/certs/Microsoft%20Update%20Signing%20CA%" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Heuristic match: "YCmDRG.bG" Pattern match: "files.000webhost.com/public_html/hitler.exe" Pattern match: "https://www.stephan-brenner.com" Pattern match: "http://upx.tsx.org"2a:T176b,Spawned process "" (UID: 00028932-00002368) Spawned process "cmd.exe" with commandline "/c if not exist "%TEMP%\afolder" mkdir "%TEMP%\afolder"" (UID: 00029471-00003356) Spawned process "cmd.exe" with commandline "/c if not exist "%TEMP%\ytmp" mkdir "%TEMP%\ytmp"" (UID: 00029486-00003364) Spawned process "cmd.exe" with commandline "/c attrib +h %TEMP%\ytmp" (UID: 00029513-00003304) Spawned process "attrib.exe" with commandline "attrib +h %TEMP%\ytmp" (UID: 00029528-00003336) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\afolder\bg.mp3" del "%TEMP%\afolder\bg.mp3"" (UID: 00029547-00003296) Spawned process "cmd.exe" with commandline "/c cls" (UID: 00029751-00001880) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\afolder\cmdc.exe" del "%TEMP%\afolder\cmdc.exe"" (UID: 00029762-00003328) Spawned process "cmd.exe" with commandline "/c cls" (UID: 00029773-00003200) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\afolder\death.bat" del "%TEMP%\afolder\death.bat"" (UID: 00029787-00002492) Spawned process "cmd.exe" with commandline "/c cls" (UID: 00029798-00002524) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\afolder\deathnote.bat" del "%TEMP%\afolder\deathnote.bat"" (UID: 00029807-00002596) Spawned process "cmd.exe" with commandline "/c cls" (UID: 00029819-00002552) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\afolder\mp3play.exe" del "%TEMP%\afolder\mp3play.exe"" (UID: 00029828-00002396) Spawned process "cmd.exe" with commandline "/c cls" (UID: 00029840-00002556) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\afolder\note.vbs" del "%TEMP%\afolder\note.vbs"" (UID: 00029854-00003280) Spawned process "cmd.exe" with commandline "/c cls" (UID: 00029877-00003264) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\afolder\Rar.exe" del "%TEMP%\afolder\Rar.exe"" (UID: 00029888-00003284) Spawned process "cmd.exe" with commandline "/c cls" (UID: 00029954-00002748) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\afolder\timemon.bat" del "%TEMP%\afolder\timemon.bat"" (UID: 00029972-00002348) Spawned process "cmd.exe" with commandline "/c cls" (UID: 00029991-00002528) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\afolder\WARNING.vbs" del "%TEMP%\afolder\WARNING.vbs"" (UID: 00030013-00002408) Spawned process "cmd.exe" with commandline "/c cls" (UID: 00030086-00002452) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\afolder\wget.exe" del "%TEMP%\afolder\wget.exe"" (UID: 00030097-00002400) Spawned process "cmd.exe" with commandline "/c cls" (UID: 00030117-00001700) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\afolder\WIFI-CONNECT.bat" del "%TEMP%\afolder\WIFI-CONNECT.bat"" (UID: 00030133-00002484) Spawned process "cmd.exe" with commandline "/c cls" (UID: 00030145-00002720) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\afolder\windows defender.bat" del "%TEMP%\afolder\windows defender.bat"" (UID: 00030155-00002660) Spawned process "cmd.exe" with commandline "/c cls" (UID: 00030171-00002684) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\afolder\WIFI.lnk" del "%TEMP%\afolder\WIFI.lnk"" (UID: 00030216-00002640) Spawned process "cmd.exe" with commandline "/c cls" (UID: 00030226-00002424) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\afolder\WINDEFEND.lnk" del "%TEMP%\afolder\WINDEFEND.lnk"" (UID: 00030236-00002764) Spawned process "cmd.exe" with commandline "/c cls" (UID: 00030253-00002436) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\afolder\death.lnk" del "%TEMP%\afolder\death.lnk"" (UID: 00030266-00003396) Spawned process "cmd.exe" with commandline "/c cls" (UID: 00030283-00003400) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\afolder\deathnote.lnk" del "%TEMP%\afolder\deathnote.lnk"" (UID: 00030294-00003436) Spawned process "cmd.exe" with commandline "/c cls" (UID: 00030304-00000576) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\ytmp\tmp4292.bat" del "%TEMP%\ytmp\tmp4292.bat"" (UID: 00030352-00002104) Spawned process "cmd.exe" with commandline "/c if exist "%TEMP%\ytmp\tmp6266.exe" del "%TEMP%\ytmp\tmp6266.exe"" (UID: 00030369-00002096) Spawned process "cmd.exe" with commandline "/c %TEMP%\ytmp\tmp4292.bat "C:\50dca038c2306d0d7cc9833216461f979be25421cb67c7b033c30e33ba4b432a.exe"" (UID: 00030387-00003384) Spawned process "tmp6266.exe" with commandline "g7Nfx03d43" (UID: 00030403-00003564) Spawned process "xcopy.exe" with commandline "xcopy %APPDATA%\batches\" /y" (UID: 00031267-00003508), Spawned process "xcopy.exe" with commandline "xcopy %APPDATA%\batches\" /y" (UID: 00031342-00000968) Spawned process "xcopy.exe" with commandline "xcopy %APPDATA%\hitler\ /y" (UID: 00031364-00003440) Spawned process "xcopy.exe" with commandline "xcopy %APPDATA%\batches\" /y" (UID: 00031389-00001288), Spawned process "xcopy.exe" with commandline "xcopy %APPDATA%\batches\" /y" (UID: 00031428-00003428) Spawned process "xcopy.exe" with commandline "xcopy %APPDATA%\hitler\ /y" (UID: 00031446-00003544) Spawned process "xcopy.exe" with commandline "xcopy %APPDATA%\hitler\ /y" (UID: 00031481-00003600) Spawned process "xcopy.exe" with commandline "xcopy %APPDATA%\hitler\ /y" (UID: 00031526-00003540) Spawned process "xcopy.exe" with commandline "xcopy %APPDATA%\hitler\ /y" (UID: 00031565-00001820) Spawned process "xcopy.exe" with commandline "xcopy "C:\50dca038c2306d0d7cc9833216461f979be25421cb67c7b033c30e33ba4b432a.exe" %APPDATA%\hitler\regen\ /y" (UID: 00031594-00002800) Spawned process "xcopy.exe" with commandline "xcopy %APPDATA%\batches\" /y" (UID: 00031645-00001440), Spawned process "xcopy.exe" with commandline "xcopy %APPDATA%\hitler\ /y" (UID: 00031668-00000368), Spawned process "xcopy.exe" with commandline "xcopy %APPDATA%\hitler\ /y" (UID: 00031689-00000568)2b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"50dca038c2306d0d7cc9833216461f979be25421cb67c7b033c30e33ba4b432a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791357491589,"unified_at":"2026-10-07T07:18:11.589Z","metadata":{"hashes":{"sha256":"50dca038c2306d0d7cc9833216461f979be25421cb67c7b033c30e33ba4b432a","sha1":"26d869f8d4c6532aa52ca38d5c707bf3d443329a","md5":"2b02d485faf03c7abaa2cac243000f60","sha512":"9c13a300b647502045cb1e5d373549d6ece4fbfa48e30025fbebc3b404a39f347a7959d658e8244a4762bdd6b5ee11790eb12a044433d8bbeadb919fc385d206","ssdeep":"196608:lh2IJCW5mcHtwtwqs3U2EncGc1SHTNLO33BXfaJfxAn:lhxJCs5qqEnbc1SzJI3hfaQ","ssdeep_chunks":["196608:lh2IJCW","196608:h2IJCW5","196608:2IJCW5m","196608:IJCW5mc","196608:JCW5mcH","196608:CW5mcHt","196608:W5mcHtw","196608:5mcHtwt","196608:mcHtwtw","196608:cHtwtwq","196608:Htwtwqs","196608:twtwqs3","196608:wtwqs3U","196608:twqs3U2","196608:wqs3U2E","196608:qs3U2En","196608:s3U2Enc","196608:3U2EncG","196608:U2EncGc","196608:2EncGc1","196608:EncGc1S","196608:ncGc1SH","196608:cGc1SHT","196608:Gc1SHTN","196608:c1SHTNL","196608:1SHTNLO","196608:SHTNLO3","196608:HTNLO33","196608:TNLO33B","196608:NLO33BX","196608:LO33BXf","196608:O33BXfa","196608:33BXfaJ","196608:3BXfaJf","196608:BXfaJfx","196608:XfaJfxA","196608:faJfxAn","393216:lh2IJCW","393216:h2IJCW5","393216:2IJCW5m","393216:IJCW5mc","393216:JCW5mcH","393216:CW5mcHt","393216:W5mcHtw","393216:5mcHtwt","393216:mcHtwtw","393216:cHtwtwq","393216:Htwtwqs","393216:twtwqs3","393216:wtwqs3U","393216:twqs3U2","393216:wqs3U2E","393216:qs3U2En","393216:s3U2Enc","393216:3U2EncG","393216:U2EncGc","393216:2EncGc1","393216:EncGc1S","393216:ncGc1SH","393216:cGc1SHT","393216:Gc1SHTN","393216:c1SHTNL","393216:1SHTNLO","393216:SHTNLO3","393216:HTNLO33","393216:TNLO33B","393216:NLO33BX","393216:LO33BXf","393216:O33BXfa","393216:33BXfaJ","393216:3BXfaJf","393216:BXfaJfx","393216:XfaJfxA","393216:faJfxAn","196608:lhxJCs5","196608:hxJCs5q","196608:xJCs5qq","196608:JCs5qqE","196608:Cs5qqEn","196608:s5qqEnb","196608:5qqEnbc","196608:qqEnbc1","196608:qEnbc1S","196608:Enbc1Sz","196608:nbc1SzJ","196608:bc1SzJI","196608:c1SzJI3","196608:1SzJI3h","196608:SzJI3hf","196608:zJI3hfa","196608:JI3hfaQ"],"imphash":"d247a55625cd61e3f91a266bce0cd371"},"file_info":{"file_name":"Sample_5a549695ed9ecc0f9ba445a9.bin","file_type":["peexe","executable"],"file_type_id":"exe","file_size":6960762,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1516278759000,"last_seen":1663416477000,"last_multi_scan":1663416477000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":14,"suspicious_count":13,"malicious_count":4,"total":31},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.FileCoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"BAT/FileCoder.ajxld","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.22808000","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.22808000 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Hitler","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0052358c1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.FileCoder.ewyyag","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Agent.6960762","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_DETNOTE.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_DETNOTE.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"UPX0\" is zero\n Raw size of \".bss\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00028932-00002368-26950-1-00406444\n GetVersion@KERNEL32.DLL at 00030403-00003564-32970-1-0040812E","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\src\\SilentCMD\\Brenner.SilentCmd\\obj\\Release\\SilentCMD.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"$25","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"Rar.exe\" as clean (type is \"PE32 executable (console) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"tmp6266.exe\" as clean (type is \"PE32 executable (console) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"mp3play.exe\" as clean (type is \"PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"tmp6266.exe\" (UID: 00030403-00003564) was launched with new environment variables: \"ztmp=\"%TEMP%\\ytmp\", MYFILES=\"%TEMP%\\afolder\", bfcec=\"tmp6266.exe\"\"\n Process \"cmd.exe\" (UID: 00031867-00003580) was launched with missing environment variables: \"ztmp, MYFILES, bfcec\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"$26","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"tmp6266.exe\" searching for window \"3912789/3564\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$27","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"50dca038c2306d0d7cc9833216461f979be25421cb67c7b033c30e33ba4b432a.exe.bin\" (Offset: 3492701)","origin":"Binary File","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$28","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"cmd.exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"cmd.exe\" touched file \"%WINDIR%\\System32\\attrib.exe\"\n \"cmd.exe\" touched file \"%WINDIR%\\System32\\xcopy.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$29","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"50dca038c2306d0d7cc9833216461f979be25421cb67c7b033c30e33ba4b432a.exe.bin\" was detected as \"Microsoft visual C++ 5.0\"\n \"Rar.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"wget.exe\" was detected as \"Netopsystems FEAD Optimizer 1\"\n \"cmdc.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"tmp6266.exe\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"UPX1 with unusual entropies 7.92589816563","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"wget.exe\" has a section named \"UPX0\"\n \"wget.exe\" has a section named \"UPX1\"\n \"wget.exe\" has a section named \"UPX2\"","origin":"Static Parser","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 41730-42-004016E0\n cpuid at 44434-468-004439F0\n cpuid at 39012-597-004A4EAE","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"s@ph.lp\"\n Pattern match: \"y@cmd.exe\"\n Pattern match: \"neverhack1@files.000webhost.com\"\n Pattern match: \"cocbkup@gmail.com\"","origin":"File/Memory","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"C:\\50dca038c2306d0d7cc9833216461f979be25421cb67c7b033c30e33ba4b432a.exe\", Handle: 68)\n \"\" is creating a new process (Name: \"%TEMP%\\ytmp\\tmp6266.exe\", Handle: 76)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"Rar.exe\" has type \"PE32 executable (console) Intel 80386 for MS Windows\"\n \"wget.exe\" has type \"PE32 executable (console) Intel 80386 for MS Windows UPX compressed\"\n \"cmdc.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"tmp6266.exe\" has type \"PE32 executable (console) Intel 80386 for MS Windows\"\n \"mp3play.exe\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.3.0.0\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"tmp6266.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"Rar.exe\" claimed CRC 626754 while the actual is CRC 6995784\n \"mp3play.exe\" claimed CRC 83876 while the actual is CRC 130067","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"wget.exe\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetFileAttributesA\n GetModuleFileNameA\n LoadLibraryA\n UnhandledExceptionFilter\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n GetModuleHandleA\n WriteFile\n GetStartupInfoA\n TerminateProcess\n CreateProcessA\n Sleep\n CreateFileA\n GetTickCount\n VirtualAlloc\n RegCloseKey\n OpenProcessToken\n RegOpenKeyExW\n GetDriveTypeW\n FindFirstFileW\n GetFileAttributesW\n DeviceIoControl\n GetModuleFileNameW\n IsDebuggerPresent\n LoadLibraryExW\n CreateThread\n GetModuleHandleExW\n LoadLibraryW\n GetVersionExW\n GetStartupInfoW\n CreateDirectoryW\n DeleteFileW\n FindFirstFileExA\n FindNextFileW\n FindNextFileA\n CreateFileW\n GetCommandLineW\n GetModuleHandleW\n listen\n FindWindowA\n VirtualProtect","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"attrib.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"xcopy.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"mp3play.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"27/68 Antivirus vendors marked sample as malicious (39% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"27/68 Antivirus vendors marked sample as malicious (39% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"2/73 Antivirus vendors marked dropped file \"wget.exe\" as malicious (classified as \"Unsafe\" with 2% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2a","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]}]},"activity":{"stats":{"process_count":77,"spawned_processes_count":77,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":27,"dropped_files_count":0,"extracted_files_count":18,"files_written_count":36,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"5a6066a57ca3e13ab24d408c","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.RansomKD","submit_name":"Sample_5a549695ed9ecc0f9ba445a9.bin","analysis_start_time":"2018-01-18T13:21:33+00:00","indicators_count":{"informative":14,"suspicious":15,"malicious":5},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}],"processes":[{"pid":2368,"ppid":0,"name":"50dca038c2306d0d7cc9833216461f979be25421cb67c7b033c30e33ba4b432a.exe","command_line":"","sha256":"50dca038c2306d0d7cc9833216461f979be25421cb67c7b033c30e33ba4b432a","normalized_path":"C:\\50dca038c2306d0d7cc9833216461f979be25421cb67c7b033c30e33ba4b432a.exe","uid":"00028932-00002368","icon":"$2b"},{"pid":3356,"ppid":2368,"name":"cmd.exe","command_line":"/c if not exist \"%TEMP%\\afolder\" mkdir \"%TEMP%\\afolder\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00029471-00003356"},{"pid":3364,"ppid":2368,"name":"cmd.exe","command_line":"/c if not exist \"%TEMP%\\ytmp\" mkdir \"%TEMP%\\ytmp\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00029486-00003364"},{"pid":3304,"ppid":2368,"name":"cmd.exe","command_line":"/c attrib +h %TEMP%\\ytmp","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00029513-00003304"},{"pid":3336,"ppid":3304,"name":"attrib.exe","command_line":"attrib +h %TEMP%\\ytmp","sha256":"db24550c3183fc38f9440134322f124447dfe0a3564490180418305d7899d159","normalized_path":"%WINDIR%\\System32\\attrib.exe","parent_uid":"00029513-00003304","uid":"00029528-00003336"},{"pid":3296,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\bg.mp3\" del \"%TEMP%\\afolder\\bg.mp3\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00029547-00003296"},{"pid":1880,"ppid":2368,"name":"cmd.exe","command_line":"/c cls","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00029751-00001880"},{"pid":3328,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\cmdc.exe\" del \"%TEMP%\\afolder\\cmdc.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00029762-00003328"},{"pid":3200,"ppid":2368,"name":"cmd.exe","command_line":"/c cls","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00029773-00003200"},{"pid":2492,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\death.bat\" del \"%TEMP%\\afolder\\death.bat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00029787-00002492"},{"pid":2524,"ppid":2368,"name":"cmd.exe","command_line":"/c cls","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00029798-00002524"},{"pid":2596,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\deathnote.bat\" del \"%TEMP%\\afolder\\deathnote.bat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00029807-00002596"},{"pid":2552,"ppid":2368,"name":"cmd.exe","command_line":"/c cls","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00029819-00002552"},{"pid":2396,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\mp3play.exe\" del \"%TEMP%\\afolder\\mp3play.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00029828-00002396"},{"pid":2556,"ppid":2368,"name":"cmd.exe","command_line":"/c cls","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00029840-00002556"},{"pid":3280,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\note.vbs\" del \"%TEMP%\\afolder\\note.vbs\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00029854-00003280"},{"pid":3264,"ppid":2368,"name":"cmd.exe","command_line":"/c cls","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00029877-00003264"},{"pid":3284,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\Rar.exe\" del \"%TEMP%\\afolder\\Rar.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00029888-00003284"},{"pid":2748,"ppid":2368,"name":"cmd.exe","command_line":"/c cls","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00029954-00002748"},{"pid":2348,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\timemon.bat\" del \"%TEMP%\\afolder\\timemon.bat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00029972-00002348"},{"pid":2528,"ppid":2368,"name":"cmd.exe","command_line":"/c cls","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00029991-00002528"},{"pid":2408,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\WARNING.vbs\" del \"%TEMP%\\afolder\\WARNING.vbs\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00030013-00002408"},{"pid":2452,"ppid":2368,"name":"cmd.exe","command_line":"/c cls","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00030086-00002452"},{"pid":2400,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\wget.exe\" del \"%TEMP%\\afolder\\wget.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00030097-00002400"},{"pid":1700,"ppid":2368,"name":"cmd.exe","command_line":"/c cls","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00030117-00001700"},{"pid":2484,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\WIFI-CONNECT.bat\" del \"%TEMP%\\afolder\\WIFI-CONNECT.bat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00030133-00002484"},{"pid":2720,"ppid":2368,"name":"cmd.exe","command_line":"/c cls","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00030145-00002720"},{"pid":2660,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\windows defender.bat\" del \"%TEMP%\\afolder\\windows defender.bat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00030155-00002660"},{"pid":2684,"ppid":2368,"name":"cmd.exe","command_line":"/c cls","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00030171-00002684"},{"pid":2640,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\WIFI.lnk\" del \"%TEMP%\\afolder\\WIFI.lnk\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00030216-00002640"},{"pid":2424,"ppid":2368,"name":"cmd.exe","command_line":"/c cls","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00030226-00002424"},{"pid":2764,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\WINDEFEND.lnk\" del \"%TEMP%\\afolder\\WINDEFEND.lnk\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00030236-00002764"},{"pid":2436,"ppid":2368,"name":"cmd.exe","command_line":"/c cls","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00030253-00002436"},{"pid":3396,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\death.lnk\" del \"%TEMP%\\afolder\\death.lnk\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00030266-00003396"},{"pid":3400,"ppid":2368,"name":"cmd.exe","command_line":"/c cls","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00030283-00003400"},{"pid":3436,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\deathnote.lnk\" del \"%TEMP%\\afolder\\deathnote.lnk\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00030294-00003436"},{"pid":576,"ppid":2368,"name":"cmd.exe","command_line":"/c cls","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00030304-00000576"},{"pid":2104,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\ytmp\\tmp4292.bat\" del \"%TEMP%\\ytmp\\tmp4292.bat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00030352-00002104"},{"pid":2096,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\ytmp\\tmp6266.exe\" del \"%TEMP%\\ytmp\\tmp6266.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00030369-00002096"},{"pid":3384,"ppid":2368,"name":"cmd.exe","command_line":"/c %TEMP%\\ytmp\\tmp4292.bat \"C:\\50dca038c2306d0d7cc9833216461f979be25421cb67c7b033c30e33ba4b432a.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00030387-00003384"},{"pid":3564,"ppid":3384,"name":"tmp6266.exe","command_line":"g7Nfx03d43","sha256":"c69b39ad2739dab03dbee316bb9b921883aa8880a4e4e9bdde7723e75a178b21","normalized_path":"%TEMP%\\ytmp\\tmp6266.exe","parent_uid":"00030387-00003384","uid":"00030403-00003564"},{"pid":3508,"ppid":3384,"name":"xcopy.exe","command_line":"xcopy %APPDATA%\\batches\\\" /y","sha256":"8222485cbd869043e994a97326311dbdc5e53318e738cf5cf1691a9809f77cf6","normalized_path":"%WINDIR%\\System32\\xcopy.exe","parent_uid":"00030387-00003384","uid":"00031267-00003508"},{"pid":968,"ppid":3384,"name":"xcopy.exe","command_line":"xcopy %APPDATA%\\batches\\\" /y","sha256":"8222485cbd869043e994a97326311dbdc5e53318e738cf5cf1691a9809f77cf6","normalized_path":"%WINDIR%\\System32\\xcopy.exe","parent_uid":"00030387-00003384","uid":"00031342-00000968"},{"pid":3440,"ppid":3384,"name":"xcopy.exe","command_line":"xcopy %APPDATA%\\hitler\\ /y","sha256":"8222485cbd869043e994a97326311dbdc5e53318e738cf5cf1691a9809f77cf6","normalized_path":"%WINDIR%\\System32\\xcopy.exe","parent_uid":"00030387-00003384","uid":"00031364-00003440"},{"pid":1288,"ppid":3384,"name":"xcopy.exe","command_line":"xcopy %APPDATA%\\batches\\\" /y","sha256":"8222485cbd869043e994a97326311dbdc5e53318e738cf5cf1691a9809f77cf6","normalized_path":"%WINDIR%\\System32\\xcopy.exe","parent_uid":"00030387-00003384","uid":"00031389-00001288"},{"pid":3428,"ppid":3384,"name":"xcopy.exe","command_line":"xcopy %APPDATA%\\batches\\\" /y","sha256":"8222485cbd869043e994a97326311dbdc5e53318e738cf5cf1691a9809f77cf6","normalized_path":"%WINDIR%\\System32\\xcopy.exe","parent_uid":"00030387-00003384","uid":"00031428-00003428"},{"pid":3544,"ppid":3384,"name":"xcopy.exe","command_line":"xcopy %APPDATA%\\hitler\\ /y","sha256":"8222485cbd869043e994a97326311dbdc5e53318e738cf5cf1691a9809f77cf6","normalized_path":"%WINDIR%\\System32\\xcopy.exe","parent_uid":"00030387-00003384","uid":"00031446-00003544"},{"pid":3600,"ppid":3384,"name":"xcopy.exe","command_line":"xcopy %APPDATA%\\hitler\\ /y","sha256":"8222485cbd869043e994a97326311dbdc5e53318e738cf5cf1691a9809f77cf6","normalized_path":"%WINDIR%\\System32\\xcopy.exe","parent_uid":"00030387-00003384","uid":"00031481-00003600"},{"pid":3540,"ppid":3384,"name":"xcopy.exe","command_line":"xcopy %APPDATA%\\hitler\\ /y","sha256":"8222485cbd869043e994a97326311dbdc5e53318e738cf5cf1691a9809f77cf6","normalized_path":"%WINDIR%\\System32\\xcopy.exe","parent_uid":"00030387-00003384","uid":"00031526-00003540"},{"pid":1820,"ppid":3384,"name":"xcopy.exe","command_line":"xcopy %APPDATA%\\hitler\\ /y","sha256":"8222485cbd869043e994a97326311dbdc5e53318e738cf5cf1691a9809f77cf6","normalized_path":"%WINDIR%\\System32\\xcopy.exe","parent_uid":"00030387-00003384","uid":"00031565-00001820"},{"pid":2800,"ppid":3384,"name":"xcopy.exe","command_line":"xcopy \"C:\\50dca038c2306d0d7cc9833216461f979be25421cb67c7b033c30e33ba4b432a.exe\" %APPDATA%\\hitler\\regen\\ /y","sha256":"8222485cbd869043e994a97326311dbdc5e53318e738cf5cf1691a9809f77cf6","normalized_path":"%WINDIR%\\System32\\xcopy.exe","parent_uid":"00030387-00003384","uid":"00031594-00002800"},{"pid":1440,"ppid":3384,"name":"xcopy.exe","command_line":"xcopy %APPDATA%\\batches\\\" /y","sha256":"8222485cbd869043e994a97326311dbdc5e53318e738cf5cf1691a9809f77cf6","normalized_path":"%WINDIR%\\System32\\xcopy.exe","parent_uid":"00030387-00003384","uid":"00031645-00001440"},{"pid":368,"ppid":3384,"name":"xcopy.exe","command_line":"xcopy %APPDATA%\\hitler\\ /y","sha256":"8222485cbd869043e994a97326311dbdc5e53318e738cf5cf1691a9809f77cf6","normalized_path":"%WINDIR%\\System32\\xcopy.exe","parent_uid":"00030387-00003384","uid":"00031668-00000368"},{"pid":568,"ppid":3384,"name":"xcopy.exe","command_line":"xcopy %APPDATA%\\hitler\\ /y","sha256":"8222485cbd869043e994a97326311dbdc5e53318e738cf5cf1691a9809f77cf6","normalized_path":"%WINDIR%\\System32\\xcopy.exe","parent_uid":"00030387-00003384","uid":"00031689-00000568"},{"pid":2704,"ppid":3384,"name":"xcopy.exe","command_line":"xcopy %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\\" /y","sha256":"8222485cbd869043e994a97326311dbdc5e53318e738cf5cf1691a9809f77cf6","normalized_path":"%WINDIR%\\System32\\xcopy.exe","parent_uid":"00030387-00003384","uid":"00031704-00002704"},{"pid":2648,"ppid":3384,"name":"xcopy.exe","command_line":"xcopy %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\\" /y","sha256":"8222485cbd869043e994a97326311dbdc5e53318e738cf5cf1691a9809f77cf6","normalized_path":"%WINDIR%\\System32\\xcopy.exe","parent_uid":"00030387-00003384","uid":"00031733-00002648"},{"pid":3456,"ppid":3384,"name":"xcopy.exe","command_line":"xcopy %APPDATA%\\hitler\\\" /y","sha256":"8222485cbd869043e994a97326311dbdc5e53318e738cf5cf1691a9809f77cf6","normalized_path":"%WINDIR%\\System32\\xcopy.exe","parent_uid":"00030387-00003384","uid":"00031787-00003456"},{"pid":3512,"ppid":3384,"name":"xcopy.exe","command_line":"xcopy %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\\" /y","sha256":"8222485cbd869043e994a97326311dbdc5e53318e738cf5cf1691a9809f77cf6","normalized_path":"%WINDIR%\\System32\\xcopy.exe","parent_uid":"00030387-00003384","uid":"00031812-00003512"},{"pid":3500,"ppid":3384,"name":"attrib.exe","command_line":"attrib +h %APPDATA%\\hitler","sha256":"db24550c3183fc38f9440134322f124447dfe0a3564490180418305d7899d159","normalized_path":"%WINDIR%\\System32\\attrib.exe","parent_uid":"00030387-00003384","uid":"00031847-00003500"},{"pid":3580,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\bg.mp3\" del \"%TEMP%\\afolder\\bg.mp3\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00031867-00003580"},{"pid":1376,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\cmdc.exe\" del \"%TEMP%\\afolder\\cmdc.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00031907-00001376"},{"pid":840,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\death.bat\" del \"%TEMP%\\afolder\\death.bat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00031923-00000840"},{"pid":3676,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\deathnote.bat\" del \"%TEMP%\\afolder\\deathnote.bat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00031933-00003676"},{"pid":3708,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\mp3play.exe\" del \"%TEMP%\\afolder\\mp3play.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00031944-00003708"},{"pid":3756,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\note.vbs\" del \"%TEMP%\\afolder\\note.vbs\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00031971-00003756"},{"pid":3860,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\Rar.exe\" del \"%TEMP%\\afolder\\Rar.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00031982-00003860"},{"pid":3752,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\timemon.bat\" del \"%TEMP%\\afolder\\timemon.bat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00031993-00003752"},{"pid":3788,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\WARNING.vbs\" del \"%TEMP%\\afolder\\WARNING.vbs\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00032004-00003788"},{"pid":3772,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\wget.exe\" del \"%TEMP%\\afolder\\wget.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00032059-00003772"},{"pid":1184,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\WIFI-CONNECT.bat\" del \"%TEMP%\\afolder\\WIFI-CONNECT.bat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00032078-00001184"},{"pid":1520,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\windows defender.bat\" del \"%TEMP%\\afolder\\windows defender.bat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00032089-00001520"},{"pid":432,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\WIFI.lnk\" del \"%TEMP%\\afolder\\WIFI.lnk\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00032110-00000432"},{"pid":3816,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\WINDEFEND.lnk\" del \"%TEMP%\\afolder\\WINDEFEND.lnk\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00032131-00003816"},{"pid":1100,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\death.lnk\" del \"%TEMP%\\afolder\\death.lnk\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00032196-00001100"},{"pid":1112,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\afolder\\deathnote.lnk\" del \"%TEMP%\\afolder\\deathnote.lnk\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00032216-00001112"},{"pid":1080,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\ytmp\\tmp4292.bat\" del \"%TEMP%\\ytmp\\tmp4292.bat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00032227-00001080"},{"pid":896,"ppid":2368,"name":"cmd.exe","command_line":"/c if exist \"%TEMP%\\ytmp\\tmp6266.exe\" del \"%TEMP%\\ytmp\\tmp6266.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028932-00002368","uid":"00032240-00000896"}],"all_imported_dlls":["apphelp.dll","winbrand.dll","ntdll.dll","winmm.dll","msvcrt.dll","user32.dll","lpk.dll","usp10.dll","imm32.dll","ulib.dll","advapi32.dll","shlwapi.dll","ole32.dll","oleaut32.dll","cfgmgr32.dll","kernel32.dll","msctf.dll","comdlg32.dll","comctl32.dll","shell32.dll","ifsutil.dll","setupapi.dll","KernelBase.dll","gdi32.dll","sechost.dll","rpcrt4.dll","devobj.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"wget.exe","sha256":"a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"name":"Rar.exe","sha256":"6bc4497b86df521b413e4574f4cd4289c986348d2a69da1945ff1a1784db05db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"name":"mp3play.exe","sha256":"a469a94a478617d3cf5ee64d34ac01715f4478ab194d99f5b4a65b00b133c9bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"name":"tmp6266.exe","sha256":"c69b39ad2739dab03dbee316bb9b921883aa8880a4e4e9bdde7723e75a178b21","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"name":"WIFI.lnk","sha256":"940765bdf004a4e56b4943075597e1268bd6268a0887de0865576f6caae2f4ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"name":"WINDEFEND.lnk","sha256":"c5d1fcf941051504507d3bd73d4393822c348fb26468e0d75f8ce44f733ac758","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"name":"deathnote.lnk","sha256":"4a18137a45c7aaea13d0a9c2127c1528d11b3683e68bf3c86558a4cc2c049719","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"name":"WIFI-CONNECT.bat","sha256":"0fa6ef74622af0cec04d9e6ab5414f34c1954a81e143cef7cb1846b080ca89f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"name":"death.bat","sha256":"a70fd63dc1d40139024580eda69036932cc55ce80760a156e05290a4f935a752","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"name":"deathnote.bat","sha256":"7326464a9d456c9d15274e83489bcbe02cb09f598909e82f8b827c4196be14f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"name":"windows defender.bat","sha256":"3e3c2b4a5bb5de1861abcf0c3b112bdc9608d61e1f1d987e8dc6d3baff11cf93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"name":"WARNING.vbs","sha256":"44a5e95e356a088c870b3ee397408e06f4a2c552ed82299e93b0146d26869d94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"name":"bg.mp3","sha256":"b729b8f8fd3fd3e4412885af66d4dd794137b662eb9206b42fa89776ada90cb8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"name":"cmdc.exe","sha256":"289cbd2adb100dc848ce9e544a9dd9169a77d70d91a1e6a120caa57a9136f5fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"name":"death.lnk","sha256":"0007fdc8d8c3558f45a23bc1a0087529fa1ff8b610ad512cc6b216a6f9728cb1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"name":"note.vbs","sha256":"f799eb9438b93c5fb1ada7f4838b19509e8599aeb8d3fe4ebbc323a4c0e9e4c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"name":"timemon.bat","sha256":"5bd34961a997c9d0946bc51c30baa6c7a4f5eb952dea3d79a6d22998e4ad0a02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"name":"tmp4292.bat","sha256":"aa98bfd191be93b70e1367105a961b98c6b38068d9712f2f82397f18c50d7d3f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]}],"files_written":[{"path":"%TEMP%\\afolder","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%WINDIR%\\System32\\attrib.exe","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%TEMP%\\afolder\\timemon.bat","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%TEMP%\\ytmp\\tmp4292.bat","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%TEMP%\\ytmp","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%TEMP%\\ytmp\\tmp6266.exe","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%WINDIR%\\System32\\xcopy.exe","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%TEMP%\\afolder\\deathnote.bat","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%TEMP%\\afolder\\Rar.exe","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%TEMP%\\afolder\\windows defender.bat","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%TEMP%\\afolder\\death.bat","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%TEMP%\\afolder\\WARNING.vbs","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%TEMP%\\afolder\\note.vbs","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%TEMP%\\afolder\\mp3play.exe","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%TEMP%\\afolder\\bg.mp3","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"C:\\50dca038c2306d0d7cc9833216461f979be25421cb67c7b033c30e33ba4b432a.exe","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"C:\\50dca038c2306d0d7cc9833216461f979be25421cb67c7b033c30e33ba4b432a.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%APPDATA%\\hitler\\regen\\50dca038c2306d0d7cc9833216461f979be25421cb67c7b033c30e33ba4b432a.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%TEMP%\\afolder\\WIFI-CONNECT.bat","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%TEMP%\\afolder\\wget.exe","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%TEMP%\\afolder\\cmdc.exe","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%TEMP%\\afolder\\WIFI.lnk","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%TEMP%\\afolder\\WINDEFEND.lnk","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%TEMP%\\afolder\\death.lnk","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%TEMP%\\afolder\\deathnote.lnk","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%WINDIR%\\System32\\en-US\\ulib.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%WINDIR%\\System32\\en-US\\attrib.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a6066a57ca3e13ab24d408c"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5a6066a57ca3e13ab24d408c"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 50dca038c230… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 50dca038c230…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 12/26 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/50dca038c2306d0d7cc9833216461f979be25421cb67c7b033c30e33ba4b432a"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 50dca038c230… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 50dca038c230…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 12/26 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/50dca038c2306d0d7cc9833216461f979be25421cb67c7b033c30e33ba4b432a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 50dca038c230… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 50dca038c230…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 12/26 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]