26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T474,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 5426627fe34c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5426627fe34c…. Malware family: Malware. Threat score 100/100. 20/27 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5426627fe34cbd7f01fac778d68efb4b08e49e5d70e35217ae6f42d1eb607cda","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","5426627fe34cbd7f01fac778d68efb4b08e49e5d70e35217ae6f42d1eb607cda"],"about":{"@type":"SoftwareApplication","name":"enbild.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"5426627fe34cbd7f01fac778d68efb4b08e49e5d70e35217ae6f42d1eb607cda","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":20,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T7e9,"" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")28:T745,"" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")29:T65b,"" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\51e2934144ba15628ba5a31be2dae7dc\mscorlib.ni.dll.aux" "" touched file "C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\d1265d6159ea876f9d63ea4c1361b587\mscorlib.ni.dll.aux" "" touched file "C:\Windows\assembly\pubpol47.dat" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System\250e8e6af918e7ca66787117bc8633e3\System.ni.dll.aux" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\75790ba48ebfa82fae7da9a114bc9886\System.Core.ni.dll.aux" "" touched file "C:\Windows\System32\tzres.dll"2a:T1028,Pattern match: "https://pastebin.com/api/api_post.php" Pattern match: "https://whoer.net" Heuristic match: "pulpy@cock.li" Heuristic match: "pulpy2@cock.li" Heuristic match: "mail.cock.li" Heuristic match: "whoer.net" Pattern match: "https://secure.comodo.com/CPS0" Pattern match: "crl.comodoca4.com/COMODORSADomainValidationSecureServerCA2.crl0" Pattern match: "crt.comodoca4.com/COMODORSADomainValidationSecureServerCA2.crt0%" Pattern match: "http://ocsp.comodoca4.com0" Heuristic match: "ssl380087.cloudflaressl.com" Heuristic match: "*.alwaysgiftbaskets.net" Heuristic match: "*.cakesforspecialoccasions.co.uk" Heuristic match: "*.chessmoney.com" Heuristic match: "*.club4x4.com.au" Heuristic match: "*.dlieberlaw.com" Heuristic match: "*.gooool.org" Heuristic match: "*.heritagefamilyfarmsllc.com" Heuristic match: "*.hopebridgefoundation.com" Heuristic match: "*.inovemoveis.com" Heuristic match: "*.jeffreylsmall.com" Heuristic match: "*.latitude-sul.com" Heuristic match: "*.marqueehireessex.co.uk" Heuristic match: "*.oliveridgespaniels.com" Heuristic match: "*.peerdistro.ca" Heuristic match: "*.peerlabs.ca" Heuristic match: "*.peterharringtonbooks.com" Heuristic match: "*.qa1wamicv7v43kupo3.co" Heuristic match: "*.richmondimagery.com" Heuristic match: "*.rosalbafontanez.com" Heuristic match: "*.servantsheartgc.com" Heuristic match: "*.steppingstonesbaytown.com" Heuristic match: "*.thebrandbank.com" Heuristic match: "*.thornberryridgebacks.com" Heuristic match: "*.tonycaves.com" Heuristic match: "*.westlancsmvt.com" Heuristic match: "*.whoer.net" Heuristic match: "alwaysgiftbaskets.net" Heuristic match: "cakesforspecialoccasions.co.uk" Heuristic match: "chessmoney.com" Heuristic match: "club4x4.com.au" Heuristic match: "dlieberlaw.com" Heuristic match: "gooool.org" Heuristic match: "heritagefamilyfarmsllc.com" Heuristic match: "hopebridgefoundation.com" Heuristic match: "inovemoveis.com" Heuristic match: "jeffreylsmall.com" Heuristic match: "jepso.com" Heuristic match: "latitude-sul.com" Heuristic match: "marqueehireessex.co.uk" Heuristic match: "oliveridgespaniels.com" Heuristic match: "peerdistro.ca" Heuristic match: "peerlabs.ca" Heuristic match: "peterharringtonbooks.com" Heuristic match: "qa1wamicv7v43kupo3.co" Heuristic match: "richmondimagery.com" Heuristic match: "rosalbafontanez.com" Heuristic match: "servantsheartgc.com" Heuristic match: "steppingstonesbaytown.com" Heuristic match: "thebrandbank.com" Heuristic match: "thornberryridgebacks.com" Heuristic match: "tonycaves.com" Heuristic match: "westlancsmvt.com" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0r" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0%" Pattern match: "crl.usertrust.com/AddTrustExternalCARoot.crl05" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://ocsp.int-x3.letsencrypt.org0/" Pattern match: "http://cert.int-x3.letsencrypt.org/0" Heuristic match: "mail.420blaze.it" Heuristic match: "mail.8chan.co" Heuristic match: "mail.aaathats3as.com" Heuristic match: "mail.airmail.cc" Heuristic match: "mail.cock.lu" Heuristic match: "mail.cumallover.me" Heuristic match: "mail.dicksinhisan.us" Heuristic match: "mail.dicksinmyan.us" Heuristic match: "mail.firemail.cc" Heuristic match: "mail.goat.si" Heuristic match: "mail.horsefucker.org" Heuristic match: "mail.loves.dicksinhisan.us" Heuristic match: "mail.loves.dicksinmyan.us" Heuristic match: "mail.memeware.net" Heuristic match: "mail.nigge.rs" Heuristic match: "mail.redchan.it" Heuristic match: "mail.tfwno.gf" Heuristic match: "mail.wants.dicksinhisan.us" Heuristic match: "mail.wants.dicksinmyan.us" Pattern match: "http://cps.letsencrypt.or" Pattern match: "https://letsencrypt.org/repository/0" Pattern match: "http://isrg.trustid.ocsp.identrust.com0" Pattern match: "http://apps.identrust.com/roots/dstrootcax3.p7c0" Pattern match: "http://cps.root-x1.letsencrypt.org0" Pattern match: "http://crl.identrust.com/DSTROOTCAX3CRL.crl0" Heuristic match: "ulpy@cock.li" Heuristic match: "lpy2@cock.li"2b:T901,"" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")2c:T5fc,"" wrote bytes "4053087758580977186a0977653c0a770000000000bfe4760000000056cce476000000007ccae47600000000376842756a2c0a77d62d0a7700000000206942750000000029a6e47600000000a48d427500000000f70ee47600000000" to virtual address "0x771A1000" (part of module "NSI.DLL") "" wrote bytes "7739067779a80a77be720a77d62d0a771de2057705a20a77c868097757d11077bee30577616f0a77684108770050087700000000ad377d768b2d7d76b6417d7600000000" to virtual address "0x74BD1000" (part of module "WSHIP6.DLL") "" wrote bytes "92e6057779a80a77be720a77d62d0a771de2057705a20a77bee30577616f0a77684108770050087700000000ad377d768b2d7d76b6417d7600000000" to virtual address "0x746A1000" (part of module "WSHTCPIP.DLL") "" wrote bytes "db4d7b6f00000000" to virtual address "0x002E2000" (part of module "5426627FE34CBD7F01FAC778D68EFB4B08E49E5D70E35217AE6F42D1EB607CDA.EXE") "" wrote bytes "6f4660e2" to virtual address "0x6A852024" (part of module "CLR.DLL") "net.exe" wrote bytes "4053087758580977186a0977653c0a770000000000bfe4760000000056cce476000000007ccae47600000000376842756a2c0a77d62d0a7700000000206942750000000029a6e47600000000a48d427500000000f70ee47600000000" to virtual address "0x771A1000" (part of module "NSI.DLL") "choice.exe" wrote bytes "4053087758580977186a0977653c0a770000000000bfe4760000000056cce476000000007ccae47600000000376842756a2c0a77d62d0a7700000000206942750000000029a6e47600000000a48d427500000000f70ee47600000000" to virtual address "0x771A1000" (part of module "NSI.DLL")2d:T771,Found malicious artifacts related to "104.25.39.26": ... URL: http://gooool.org/fnu (AV positives: 1/64 scanned on 04/09/2017 06:47:09) URL: http://files.mykoleso.com/431f30824ef734dcd8d2dbbcddbbeb80.jpg.exe (AV positives: 2/67 scanned on 02/25/2016 07:34:03) File SHA256: 4b60c2b813297afcef8345bce98ebdfa803e4d7f94859c87f6ffb793248a794a (AV positives: 8/65 scanned on 08/01/2017 13:00:48) File SHA256: e979ee2757082ddad568f1e9a5f3690081e6aa2917e4c45256d1a146e1ac0d09 (AV positives: 7/64 scanned on 07/20/2017 14:48:19) File SHA256: ef065f77b505e82ca321c39ebbfffb9cfc02b09d142706ef68342661c39632ab (Date: 07/19/2017 15:13:54) File SHA256: fe7c80df10e51b50a280281f41a4c646615863411a60685aa7151ab03175ebe8 (AV positives: 4/61 scanned on 04/07/2017 20:02:39) File SHA256: 13af3162f794c94c898f934413f7a76249f9392d6253480eedbe1637c85d14ef (Date: 04/03/2017 03:26:05) File SHA256: 8ac51de748bf26640bc65c10ec35c300e0c0bdb164622bced3edfdd747da6fd3 (Date: 04/02/2017 08:43:37) File SHA256: 73e2b0c82c6d3cdd213784a21941cd57a3408d3b3a6b23cf0a846d40cda562e8 (Date: 04/02/2017 07:58:37) File SHA256: d76b8261343881839760677dbca90c7bf987d7e895d367a8c16729f5712e53b0 (AV positives: 4/62 scanned on 03/31/2017 17:08:53) File SHA256: 8c85248f0db9376e823f1dc37e126ab8b2bb3222bfd80c5009df5a801439b81a (AV positives: 3/60 scanned on 03/31/2017 16:54:43) Found malicious artifacts related to "185.100.85.212": ... URL: http://airmail.cc/ (AV positives: 2/66 scanned on 12/12/2017 09:42:52) URL: http://firemail.cc/ (AV positives: 1/64 scanned on 11/05/2017 20:21:49) URL: http://mail.firemail.cc/ (AV positives: 1/64 scanned on 05/12/2017 20:57:05) File SHA256: 7286e3c52b537915b3aaa41bb02b886f42844f1b7039dce3fc661bca00ded995 (AV positives: 9/64 scanned on 07/20/2017 00:28:38) File SHA256: d57e686e63a6ea54ccf5653de267d16680a10871f74671c3d4129f32e09230ce (AV positives: 35/62 scanned on 04/03/2017 00:50:45)2e:T771,Found malicious artifacts related to "104.25.39.26": ... URL: http://gooool.org/fnu (AV positives: 1/64 scanned on 04/09/2017 06:47:09) URL: http://files.mykoleso.com/431f30824ef734dcd8d2dbbcddbbeb80.jpg.exe (AV positives: 2/67 scanned on 02/25/2016 07:34:03) File SHA256: 4b60c2b813297afcef8345bce98ebdfa803e4d7f94859c87f6ffb793248a794a (AV positives: 8/65 scanned on 08/01/2017 13:00:48) File SHA256: e979ee2757082ddad568f1e9a5f3690081e6aa2917e4c45256d1a146e1ac0d09 (AV positives: 7/64 scanned on 07/20/2017 14:48:19) File SHA256: ef065f77b505e82ca321c39ebbfffb9cfc02b09d142706ef68342661c39632ab (Date: 07/19/2017 15:13:54) File SHA256: fe7c80df10e51b50a280281f41a4c646615863411a60685aa7151ab03175ebe8 (AV positives: 4/61 scanned on 04/07/2017 20:02:39) File SHA256: 13af3162f794c94c898f934413f7a76249f9392d6253480eedbe1637c85d14ef (Date: 04/03/2017 03:26:05) File SHA256: 8ac51de748bf26640bc65c10ec35c300e0c0bdb164622bced3edfdd747da6fd3 (Date: 04/02/2017 08:43:37) File SHA256: 73e2b0c82c6d3cdd213784a21941cd57a3408d3b3a6b23cf0a846d40cda562e8 (Date: 04/02/2017 07:58:37) File SHA256: d76b8261343881839760677dbca90c7bf987d7e895d367a8c16729f5712e53b0 (AV positives: 4/62 scanned on 03/31/2017 17:08:53) File SHA256: 8c85248f0db9376e823f1dc37e126ab8b2bb3222bfd80c5009df5a801439b81a (AV positives: 3/60 scanned on 03/31/2017 16:54:43) Found malicious artifacts related to "185.100.85.212": ... URL: http://airmail.cc/ (AV positives: 2/66 scanned on 12/12/2017 09:42:52) URL: http://firemail.cc/ (AV positives: 1/64 scanned on 11/05/2017 20:21:49) URL: http://mail.firemail.cc/ (AV positives: 1/64 scanned on 05/12/2017 20:57:05) File SHA256: 7286e3c52b537915b3aaa41bb02b886f42844f1b7039dce3fc661bca00ded995 (AV positives: 9/64 scanned on 07/20/2017 00:28:38) File SHA256: d57e686e63a6ea54ccf5653de267d16680a10871f74671c3d4129f32e09230ce (AV positives: 35/62 scanned on 04/03/2017 00:50:45)2f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A/////////////////////////////wAAD//////wAP///////wAAAAAA///wAAD//////wAAD/8AAAAAAAAAD////wAAD/////AAAAAP8A///wAAAP///////wAAAPAA//AAAP//AAAAAP///wD/APAAAP8AAAAAAAD///8AAAAAAPAAAAAAAP//////AAAAAAAAAAD/8AAAD///AAAA/wAAAA/////wAAAAAAAA//8AAP//8AD///AAAAAA////////AAAAAAD/////////////8ABmZmYAD///////////8ABmZmZmZgD///////////AGZmZmZmZgD/////////8AZmZmBmZmZgD/////////BmZmQABGZmYA////////8AZmZmZmQGZmYP////////AGZmZmZmBmZmAP///////wBmZmZmYAZmZgD///////8EZmZmAAZmZmYA////////AGZmYGZmZmZmAP///////wBmZmBmZmZmZgD///////8AZmZgBERmZmYP////////8AZmZmAGZmZgD/////////AGZmZkZmZmAP//////////AGZmZmZmZAD///////////AAZmZmZgAP////////////AABGYAAA//////////////8AAAAA////////////////////////////////////////B/4//AD4P/BwAB/B/gGfA//Ajg8A/MgwAPwAgA/8AAOB8DAf4ADw+PgD/8AP//+AB//+AAP//gAB//wAAP/8AAD/+AAA//gAAH/4AAB/+AAAf/gAAH/4AAB/+AAA//wAAP/8AAH//gAB//8AA///gAf//+Af///////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"5426627fe34cbd7f01fac778d68efb4b08e49e5d70e35217ae6f42d1eb607cda","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790440943955,"unified_at":"2026-09-26T16:42:23.955Z","metadata":{"hashes":{"sha256":"5426627fe34cbd7f01fac778d68efb4b08e49e5d70e35217ae6f42d1eb607cda","sha1":"57e3cd5f224cfcbb17975045816d71ba28977bf4","md5":"408a97ac8fb82398187ffe6d4c5937d7","sha512":"fe488aac524894ed2d9a29b48d7006e072259e3a53f78ce26aca530adf247a9905a4e2f1a85a209cce01e48239616d20a63bfb3dbc5327ab807edb7db9b1a549","ssdeep":"384:154iM8DS5t27GLQXc6invI0AIqsf6kEvdhROXuiyeefX91fK8dF1OQ1VceGp:kiMUS5t2CsXox01/99K8hO2d","ssdeep_chunks":["384:154iM8D","384:54iM8DS","384:4iM8DS5","384:iM8DS5t","384:M8DS5t2","384:8DS5t27","384:DS5t27G","384:S5t27GL","384:5t27GLQ","384:t27GLQX","384:27GLQXc","384:7GLQXc6","384:GLQXc6i","384:LQXc6in","384:QXc6inv","384:Xc6invI","384:c6invI0","384:6invI0A","384:invI0AI","384:nvI0AIq","384:vI0AIqs","384:I0AIqsf","384:0AIqsf6","384:AIqsf6k","384:Iqsf6kE","384:qsf6kEv","384:sf6kEvd","384:f6kEvdh","384:6kEvdhR","384:kEvdhRO","384:EvdhROX","384:vdhROXu","384:dhROXui","384:hROXuiy","384:ROXuiye","384:OXuiyee","384:Xuiyeef","384:uiyeefX","384:iyeefX9","384:yeefX91","384:eefX91f","384:efX91fK","384:fX91fK8","384:X91fK8d","384:91fK8dF","384:1fK8dF1","384:fK8dF1O","384:K8dF1OQ","384:8dF1OQ1","384:dF1OQ1V","384:F1OQ1Vc","384:1OQ1Vce","384:OQ1VceG","384:Q1VceGp","768:154iM8D","768:54iM8DS","768:4iM8DS5","768:iM8DS5t","768:M8DS5t2","768:8DS5t27","768:DS5t27G","768:S5t27GL","768:5t27GLQ","768:t27GLQX","768:27GLQXc","768:7GLQXc6","768:GLQXc6i","768:LQXc6in","768:QXc6inv","768:Xc6invI","768:c6invI0","768:6invI0A","768:invI0AI","768:nvI0AIq","768:vI0AIqs","768:I0AIqsf","768:0AIqsf6","768:AIqsf6k","768:Iqsf6kE","768:qsf6kEv","768:sf6kEvd","768:f6kEvdh","768:6kEvdhR","768:kEvdhRO","768:EvdhROX","768:vdhROXu","768:dhROXui","768:hROXuiy","768:ROXuiye","768:OXuiyee","768:Xuiyeef","768:uiyeefX","768:iyeefX9","768:yeefX91","768:eefX91f","768:efX91fK","768:fX91fK8","768:X91fK8d","768:91fK8dF","768:1fK8dF1","768:fK8dF1O","768:K8dF1OQ","768:8dF1OQ1","768:dF1OQ1V","768:F1OQ1Vc","768:1OQ1Vce","768:OQ1VceG","768:Q1VceGp","384:kiMUS5t","384:iMUS5t2","384:MUS5t2C","384:US5t2Cs","384:S5t2CsX","384:5t2CsXo","384:t2CsXox","384:2CsXox0","384:CsXox01","384:sXox01/","384:Xox01/9","384:ox01/99","384:x01/99K","384:01/99K8","384:1/99K8h","384:/99K8hO","384:99K8hO2","384:9K8hO2d"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"enbild.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":29184,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1514570963000,"last_seen":1690009539000,"last_multi_scan":1690009539000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":17,"suspicious_count":18,"malicious_count":8,"total":43},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/MSIL.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Rasoon.mwfxa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Pulpy.02C56544","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Pulpy.02C56544 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Filecoder.JB trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/MSIL.Filecoder.s","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 700000121 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.MSIL.Agent.gpo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXDS-LY!408A97AC8FB8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Ransom.ewoddb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_95","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Ramsil-N","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_Rasoon.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_Rasoon.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win32.7174","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 00014487-00003156-0000010C-40678370\n \"\" queries volume information of \"C:\\5426627fe34cbd7f01fac778d68efb4b08e49e5d70e35217ae6f42d1eb607cda.exe\" at 00014487-00003156-0000010C-40687894","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\NOTEPAD.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\NOTEPAD.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$27","origin":"Registry Access","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$28","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"whoer.net\"\n \"mail.cock.li\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.25.39.26:443\"\n \"185.100.85.212:587\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\ErrorLogAes.bin\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 699E0000\n \"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll\" at 68E80000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"\"cmd\" /C net view\" on 2017-12-29.18:57:53.702\n \"/C choice /C Y /N /D Y /T 3 & Del \"5426627fe34cbd7f01fac778d68efb4b08e49e5d70e35217ae6f42d1eb607cda.exe\"\" on 2017-12-29.18:59:51.286","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"\"cmd\" /C net view\" (UID: 00014775-00003856)\n Spawned process \"net.exe\" with commandline \"net view\" (UID: 00014781-00003784)\n Spawned process \"notepad.exe\" with commandline \"%USERPROFILE%\\Desktop\\Instruction.txt\" (UID: 00017931-00002240)\n Spawned process \"cmd.exe\" with commandline \"/C choice /C Y /N /D Y /T 3 & Del \"5426627fe34cbd7f01fac778d68efb4b08e49e5d70e35217ae6f42d1eb607cda.exe\"\" (UID: 00018527-00003536)\n Spawned process \"choice.exe\" with commandline \"choice /C Y /N /D Y /T 3\" (UID: 00018533-00003584)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"F3hzum1.doc\" has type \"data\"\n \"0gakl8ixtWMkw.doc\" has type \"data\"\n \"msvcr90.dll\" has type \"data\"\n \"EKeaJO.doc\" has type \"data\"\n \"Proof.msi\" has type \"data\"\n \"iLLOga.exe\" has type \"data\"\n \"setup.exe\" has type \"data\"\n \"mtgFs8Za.doc\" has type \"data\"\n \"PidGenX.dll\" has type \"data\"\n \"Office64WW.msi\" has type \"data\"\n \"PowerPointMUI.msi\" has type \"data\"\n \"6WMjwc1zqk3IB.exe\" has type \"data\"\n \"hlchPBL.exe\" has type \"data\"\n \"dwdcw20.dll\" has type \"data\"\n \"w5JaoO.doc\" has type \"data\"\n \"setup.chm\" has type \"data\"\n \"0pYWspjURe8aqA.exe\" has type \"data\"\n \"DW20.EXE\" has type \"data\"\n \"javaw.exe\" has type \"data\"\n \"ErrorLogAes.bin\" has type \"ASCII text with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$29","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2a","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found reference to Diagnosis CAB file","description":"\".diagcab\" (Indicator: \".diagcab\")","origin":"File/Memory","relevance":7,"id":"string-47","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"5426627fe34cbd7f01fac778d68efb4b08e49e5d70e35217ae6f42d1eb607cda.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00014487-00003156-00000105-40851811","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"PSPUBWS.contact\" containing the Windows username \"PSPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"net.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to display shared resources","description":"Process \"net.exe\" with commandline \"net view\" (UID: 00014781-00003784)","origin":"Monitored Target","relevance":10,"id":"target-41","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ENUMERATE_SERVICE\" (0x4)\n \"\" called \"OpenSCManager\" requesting access rights \"0X0\"\n \"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"net.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ENUMERATE_SERVICE\" (0x4)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"\" called \"OpenService\" to access the \"gpsvc\" service\n \"\" called \"OpenService\" to access the \"LanmanWorkstation\" service\n \"\" called \"OpenService\" to access the \"RASMAN\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"\" called \"OpenService\" to access the \"rasman\" service\n \"\" called \"OpenService\" to access the \"RASMAN\" service\n \"\" called \"OpenService\" to access the \"WinHttpAutoProxySvc\" service\n \"net.exe\" called \"OpenService\" to access the \"LanmanWorkstation\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"\" called \"ControlService\" and sent control code \"0X24\" to the service \"gpsvc\"\n \"\" called \"ControlService\" and sent control code \"0XFC\" to the service \"gpsvc\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 472)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"Hi, all your files have been encrypted. You can decipher if you write to me on the mail:pulpy2@cock.li Otherwise, all your files will be deleted within 2 days without any problems!\" (Source: 5426627fe34cbd7f01fac778d68efb4b08e49e5d70e35217ae6f42d1eb607cda.exe.bin, Indicator: \"files have been encrypted\")\n \"Hi, all your files have been encrypted. You can decipher if you write to me on the mail:pulpy2@cock.li Otherwise, all your files will be deleted within 2 days without any problems!\" (Source: 600001f-cctor, Indicator: \"files have been encrypted\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 635 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"Z:\\1514570261190$MAPFAILURE\" with delete access\n \"\" opened \"C:\\1514570261190$MAPFAILURE\" with delete access\n \"\" opened \"C:\\1514570261190$OK\" with delete access\n \"\" opened \"C:\\5426627fe34cbd7f01fac778d68efb4b08e49e5d70e35217ae6f42d1eb607cda.exe\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$2b","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2c","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"net.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"notepad.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","origin":"Registry Access","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"19/67 Antivirus vendors marked sample as malicious (28% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"19/67 Antivirus vendors marked sample as malicious (28% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2d","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$2e","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"malicious","category":"Network Related","name":"Sends network traffic on a typical mail related ports","description":"\"Mail traffic to 185.100.85.212 on port 587 (SMTP)","origin":"Network Traffic","relevance":6,"id":"network-10","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"Instruction.txt\" which has been seen in the context of ransomware (Indicator: instruction.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00014487-00003156)\n Spawned process \"cmd.exe\" with commandline \"\"cmd\" /C net view\" (UID: 00014775-00003856)\n Spawned process \"net.exe\" with commandline \"net view\" (UID: 00014781-00003784)\n Spawned process \"notepad.exe\" with commandline \"%USERPROFILE%\\Desktop\\Instruction.txt\" (UID: 00017931-00002240)\n Spawned process \"cmd.exe\" with commandline \"/C choice /C Y /N /D Y /T 3 & Del \"5426627fe34cbd7f01fac778d68efb4b08e49e5d70e35217ae6f42d1eb607cda.exe\"\" (UID: 00018527-00003536)\n Spawned process \"choice.exe\" with commandline \"choice /C Y /N /D Y /T 3\" (UID: 00018533-00003584)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]}],"incidents":[{"name":"Ransomware","details_count":2,"details":[{"detail":"The analysis extracted a known ransomware file"},{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"},{"detail":"Tries to display shared resources"}],"sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":5,"imported_dlls_count":93,"dropped_files_count":0,"extracted_files_count":61,"files_written_count":70,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5a4681cd7ca3e170ef0d3ad7","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Razy","contacted_countries":["ROU","USA"],"submit_name":"enbild.exe","analysis_start_time":"2017-12-29T18:57:19+00:00","indicators_count":{"informative":17,"suspicious":19,"malicious":9},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.25.39.26","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"address":"185.100.85.212","port":587,"protocol":"TCP","country":"Romania","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]}],"dns_resolutions":[{"domain":"whoer.net","address":"104.25.39.26","country":"United States","registrar_name":"ENOM, INC.","registrar_name_servers":"AMIT.NS.CLOUDFLARE.COM","registrar_creation_date":"2008-11-28T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"domain":"mail.cock.li","country":"-","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}],"processes":[{"pid":3156,"ppid":0,"name":"5426627fe34cbd7f01fac778d68efb4b08e49e5d70e35217ae6f42d1eb607cda.exe","command_line":"","sha256":"5426627fe34cbd7f01fac778d68efb4b08e49e5d70e35217ae6f42d1eb607cda","normalized_path":"C:\\5426627fe34cbd7f01fac778d68efb4b08e49e5d70e35217ae6f42d1eb607cda.exe","uid":"00014487-00003156","icon":"$2f"},{"pid":3856,"ppid":3156,"name":"cmd.exe","command_line":"\"cmd\" /C net view","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014487-00003156","uid":"00014775-00003856"},{"pid":3784,"ppid":3856,"name":"net.exe","command_line":"net view","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00014775-00003856","uid":"00014781-00003784"},{"pid":2240,"ppid":3156,"name":"notepad.exe","command_line":"%USERPROFILE%\\Desktop\\Instruction.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00014487-00003156","uid":"00017931-00002240"},{"pid":3536,"ppid":3156,"name":"cmd.exe","command_line":"/C choice /C Y /N /D Y /T 3 & Del \"5426627fe34cbd7f01fac778d68efb4b08e49e5d70e35217ae6f42d1eb607cda.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014487-00003156","uid":"00018527-00003536"},{"pid":3584,"ppid":3536,"name":"choice.exe","command_line":"choice /C Y /N /D Y /T 3","sha256":"4108605207ef00fcbbfe7ed7c3f96300601fb79f913d0e290538e8e02082cacc","normalized_path":"%WINDIR%\\System32\\choice.exe","parent_uid":"00018527-00003536","uid":"00018533-00003584"}],"all_imported_dlls":["mpr.dll","KernelBase.dll","clrjit.dll","netapi32.dll","rasadhlp.dll","lpk.dll","ole32.dll","cfgmgr32.dll","rtutils.dll","ncrypt.dll","ntdll.dll","tzres.dll","propsys.dll","System.Configuration.ni.dll","nsi.dll","msasn1.dll","cryptbase.dll","FWPUCLNT.DLL","version.dll","mscoree.dll","advapi32.dll","imm32.dll","browcli.dll","credssp.dll","psapi.dll","oleaccrc.dll","winbrand.dll","gdi32.dll","mscorlib.dll","mscorlib.ni.dll","apphelp.dll","rasapi32.dll","webio.dll","sspicli.dll","IPHLPAPI.DLL","clbcatq.dll","dhcpcsvc6.dll","dhcpcsvc.dll","crypt32.dll","wininet.dll","msctf.dll","clr.dll","WSHTCPIP.DLL","comdlg32.dll","rpcss.dll","System.Core.ni.dll","uxtheme.dll","System.Xml.ni.dll","bcryptprimitives.dll","gpapi.dll","rsaenh.dll","comctl32.dll","dwmapi.dll","wkscli.dll","cryptsp.dll","winnsi.dll","iertutil.dll","kernel32.dll","msvcrt.dll","rpcrt4.dll","msvcr120_clr0400.dll","ws2_32.dll","mswsock.dll","netmsg.dll","sechost.dll","System.ni.dll","netutils.dll","srvcli.dll","dnsapi.dll","secur32.dll","userenv.dll","oleacc.dll","shlwapi.dll","user32.dll","usp10.dll","nlssorting.dll","shell32.dll","Wldap32.dll","rasman.dll","wship6.dll","oleaut32.dll","ntmarta.dll","devobj.dll","winhttp.dll","profapi.dll","schannel.dll","urlmon.dll","mscoreei.dll","cscapi.dll","setupapi.dll","bcrypt.dll","ieframe.dll","samcli.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Instruction.txt","sha256":"3aed81e2cd868eec94d53ef374e7de3c245f18fd921ffb7b287a0432163641ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"ErrorLogAes.bin","sha256":"19fb1760d4b2d745dd006026dae7ae482c1b7669bdf70af36261887c9ea9e100","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"1514570261190$OK","sha256":"3ee68ca65c966a84e1d2af817a582840e56d1639ebf0f56b63878c38c79a6b9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"1514570261190$MAPFAILURE","sha256":"7794d908aff6cc65310dac52346057ce4c06c27b798d439ff384c5000b1bebbe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"F3hzum1.doc","sha256":"a6d74988207618163e54b564863ab7f0c5b6f2450a97afc624053b8053445553","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"0gakl8ixtWMkw.doc","sha256":"dd6f108e8510e9c117242d8a43fc4104536398c1f6cbcb94a3868d01d3551ed8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"msvcr90.dll","sha256":"f337f0348b9118e856ac53de67de120e5c3227532bf2f4faf43b5cd957660a8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"EKeaJO.doc","sha256":"8700afb0e139ad7aa4f5a2bf8d4becbc14b55b498b12b69bdc741281fd24ad0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"Proof.msi","sha256":"6a642dbb4ee4a57181504c279dcf17ccc64f9910218251064d578e069ce77696","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"iLLOga.exe","sha256":"bd2545d827af43d0c8d5b6709ebc133f77bba2fa28d5cd6657140672cf78a630","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"setup.exe","sha256":"b968e9bf610793725d746176481bedf1ccbdf91b3caa6ada9cae18f382434a19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"mtgFs8Za.doc","sha256":"071b0a8b5c3736bc53207a4ab0c3c49111b130f31314340b8cda8cfa893d4d9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"PidGenX.dll","sha256":"0de4746ee858523aebdf555f1f9160a9eab672c1eff22449547170ff3e4d3b34","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"Office64WW.msi","sha256":"8ee3b0f6477837208d9df4e2bac8c0e37f5df4a846e77fafc2f578e0988f1c1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"PowerPointMUI.msi","sha256":"c65627be2335de48ed40c8cd88775a166262513f0467cb55a26d09dd9f1bd734","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"6WMjwc1zqk3IB.exe","sha256":"6bfdab8724357b783549e149a2eaf691e7d9ac397a0503da542af8286c3ebcb3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"hlchPBL.exe","sha256":"32fbb56fb11b65201c6978010774081570422c1fc5a3f5c832c0fce72bf7f353","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"dwdcw20.dll","sha256":"2009a625c0dd6a8fc86e9aa16381263021afea4ac39ed2854b863d9223596b54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"w5JaoO.doc","sha256":"bbe4c760563fc2996de9ec56f113990c10c7c9fc1f7b9681f0518bf11175f4e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"setup.chm","sha256":"89ddc4b998d64470b3a35c708a6b6e6c3ebdc659435c4ea7de7309dd7fb53b70","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"0pYWspjURe8aqA.exe","sha256":"05bac35bfbfa28ecd96b5730f6080664d326af9999719373e307d25428fd4a6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"DW20.EXE","sha256":"7e0c195790290156b8985645c1426f49810e2d9e7bb5b61df5da45db036c7028","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"javaw.exe","sha256":"3cb2e6d8f5f3ffa88e478feec5a32a50fc8b575b634c65cc41816ac0ab2ebf33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"dwtrig20.exe","sha256":"605d991b5a33bf686946fa4e3cd9e21806000bb45bfc1addd29612c059d4fd69","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"rRgk91Ih5n.doc","sha256":"583c91e6c479bf5cd514fd0680d8e76e77e2d61a8af2e273eb97ccd1c2f8a1c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"bvYkKJ33N9A.exe","sha256":"84e7a188f6fef683f4d6ebebb031000ebdb3ae8d62a3358d72b2c1c5cf8552f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"OutlookMUI.msi","sha256":"90d6434ac230f02701a7073580b5328bf42dbc3af09ac63d0870970cff6c5fd8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"dskCEJ.exe","sha256":"3be1d239315ab5a33a6f68cfae21c482a5483f74c5cecebd43c6954e09fab761","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"145799a669267bb1de5ed0bffbc8983e49b9b586a42f745d89969b60da47fae8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"6SZfLTu9z.doc","sha256":"326c3ccbeb5339044e0e161e8b7a618515d99da537f8303771b656551fe9a7a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"tDUzYwYK5f.exe","sha256":"cc13592ce1c108135871fcc955e210c75a5fd813ea9570517b2d4a6c22b153af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"yZw6snqBQ28DAzu.exe","sha256":"20ea28309e32460533b1928f508784ce41d35d32c656e668b5751a685aa5dd4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"AcroRead.msi","sha256":"b1ca34fe1d2a817c9484f28c8f9d319d640e2b69ccd79e46d7692125d703c70f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"Proofing.msi","sha256":"9e977742c11e6e4ae66b843b68e6c59f9e38a8f7854b2b4c3567cf5fe069b952","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"kdo6iAicsoicvHg.exe","sha256":"1e5fa206aaf0fe050c9dcf9a2fd41563bc53923735caf63f93da78e2bca6d954","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"dgQJde60mPXhI.exe","sha256":"387d543a2063b6885853ff1d2030bf29c69cfd5dc32717a9f4f1beecbf68ec4a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"WordMUI.msi","sha256":"c89a533cb24bb2b4e3c44c6af1e67b7628bac3abb7ea09e7b393999cf31977af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"kY01UeAiy5.exe","sha256":"c2ba6dd6953977ef189c432ec34398983aa10b5034b7a3381abacabf9acc30a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"javaws.exe","sha256":"a8d9239a145296105452adde57404a07148774fd9592a266a87fb8fc45cb0f59","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"dH1rDN9f9.doc","sha256":"f4e47b7080db3921e4826d5397862af608d5d57bad3e26a6a394041ba482521d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"2e73ea6f930b6516a517251e9e738e20b8581ea9d4cf3e400d87e35b6ba31eea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"OneNoteMUI.msi","sha256":"b8d43fd18d9a577e98f698d64408ee0ad066a5c3912a657c4593da4691efa90f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"bg3oTe.doc","sha256":"788046850b60f5b8ddaf65963f481876d8c9c115e7c78a6860d2bb05933e41e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"OfficeMUI.msi","sha256":"3e15151278f24d486fc68e65504f118eaed781c29266125244c5cf5bd0d7c6dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"PublisherMUI.msi","sha256":"4f575355aeb2df04cb3c4ad4b717570700bc09ee3c6221d16707f598a237e7a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"osetupui.dll","sha256":"804619b9b7349ff1b94306540bf26e8cd9f21517d43f220adda6347c5c71a6d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"hKY8.doc","sha256":"038083ddaffb89f97f4f5e28a8ef17129437f135a25b307d5732e8dbd2a9f6e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"9rNtWnjTq9RGbU.exe","sha256":"7edeb29836e3ecdd0964d15e25784126e65623d89b24dc920863c762dbf62071","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"a3Ntx.exe","sha256":"1301f400990c642ba7e700fa891a7ef6eac6a1bdbb45507f414c4550661ae494","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"0zIG0D.doc","sha256":"303b9cb51addf71e107f188f7d6e08f18675f637714bf64ec76ec90f7832c4af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"klmqz.doc","sha256":"851957b05196a1fd820bb72364d103965f3dc9a4167ba57f2de9b2353fe5c86f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"C04T72pR0Bcl.doc","sha256":"2ac13b4813b5d236ab4aa182fdb4d4bc02263ed16a3d1aab7f201c9e2a76bffa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"pss10r.chm","sha256":"b8e9d0880e18de49e29a65412039c9a3a15331c1b8a0236ab44d0b9b5e58892f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"dwintl20.dll","sha256":"f6c4dc40f9bc2c9905d5f17cbad99a4205a7645792d523ddd102c0a707cc4408","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"ShellUI.MST","sha256":"2120dceef32e0a103ae0ec3e6098aa2852b324566e7986b7709419ed36fc8f99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"ose.exe","sha256":"1d7ad3dcb6c5763ec7f5f0e42df02f2792748ef6183b3d1f5bbb103c915729b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"java.exe","sha256":"a451241168cfda40b8e5622375aded324c1afebd9425aeec44d3d5bde2a3cf8e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"63sDzrkUoHoRT.exe","sha256":"5dd76c1609f2f3cae3139965aff429808e218b397a25ccc01dfb3692b6a20dbe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"ExcelMUI.msi","sha256":"b78b68746cd38040310adeeb142e7107673b4ab6a7a8b4a269f0a89025d2dae2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"Tmg2wsFHYf9ioO.doc","sha256":"dd0891b2b4a77ee4fc830472072aa401771a2cc66042f97bb4302c39c0f012a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"OfficeMUISet.msi","sha256":"e4ca205857bbfdf9565309659191898fb74eb8680552b4c6cd9d5cb1e14cc12c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\5426627fe34cbd7f01fac778d68efb4b08e49e5d70e35217ae6f42d1eb607cda.exe.config","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\250e8e6af918e7ca66787117bc8633e3\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\75790ba48ebfa82fae7da9a114bc9886\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\System32\\en-US\\netmsg.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\share\\1514570261190$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\whTK0Dl2z2REp.TTn","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\$Recycle.Bin\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-4162757579-3804539371-4239455898-1000\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\MSOCache\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\MSOCache\\All Users\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\PerfLogs\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\PerfLogs\\Admin\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\Recovery\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\Recovery\\72d3f4c2-b53f-11e4-b6d9-9157ca704b30\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"C:\\Users\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%ALLUSERSPROFILE%\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Acrobat\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Acrobat\\11.0\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Acrobat\\11.0\\Replicate\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Acrobat\\11.0\\Replicate\\Security\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1031-7B44-AB0000000001}\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%ALLUSERSPROFILE%\\Mozilla\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%ALLUSERSPROFILE%\\Mozilla\\logs\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\installcache\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%ALLUSERSPROFILE%\\Sun\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%ALLUSERSPROFILE%\\Sun\\Java\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%ALLUSERSPROFILE%\\Sun\\Java\\Java Update\\Instruction.txt","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%TEMP%\\ErrorLogAes.bin","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\System32\\en-US\\notepad.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\System32\\choice.exe","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\System32\\en-US\\choice.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5a4681cd7ca3e170ef0d3ad7"}]}]}},"report_ids":{"sandbox_job_ids":["5a4681cd7ca3e170ef0d3ad7"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Malware Sample 5426627fe34c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 5426627fe34c…. Malware family: Malware. Threat score 100/100. 20/27 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/5426627fe34cbd7f01fac778d68efb4b08e49e5d70e35217ae6f42d1eb607cda"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample 5426627fe34c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 5426627fe34c…. Malware family: Malware. Threat score 100/100. 20/27 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/5426627fe34cbd7f01fac778d68efb4b08e49e5d70e35217ae6f42d1eb607cda"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample 5426627fe34c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 5426627fe34c…. Malware family: Malware. Threat score 100/100. 20/27 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]