26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T487,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 66cda295ce93… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 66cda295ce93…. Malware family: Trojan.Generic. Threat score 100/100. 24/26 AV engines flagged this file. 7 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/66cda295ce93aaf708569eb0d9a5417bb9f98f63152b4b4b92fde8a2cb5f1d6b","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","66cda295ce93aaf708569eb0d9a5417bb9f98f63152b4b4b92fde8a2cb5f1d6b"],"about":{"@type":"SoftwareApplication","name":"_yosKa4_.exe","applicationCategory":["peexe","executable"],"identifier":"66cda295ce93aaf708569eb0d9a5417bb9f98f63152b4b4b92fde8a2cb5f1d6b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":24,"total":26},"behavioralIndicators":{"malicious":7,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Te39,"

Your documents, photos, databases and other important files have been encrypted cryptographically strong, without the original key recovery is impossible! To decrypt your files you need to buy the special software - "YOSHIKADA DECRYPTOR" Using another tools could corrupt your files, in case of using third party software we dont give guarantees that full recovery is possible so use it on your own risk.
If you want to restore files, write us to the e-mail: yoshikada@cock.lu In subject line write "encryption" and attach your personal ID in body of your message also attach to email 3 crypted files. (files have to be less than 10 MB)
It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.

Your personal ID

9C 67 8C 49 05 C4 3E 40 A1 71 16 F7 85 70 32 5DD0 16 45 05 48 82 98 7A 47 CE 32 3E F0 F9 E4 7C14 3C E1 DB C8 03 B5 06 70 A4 F9 36 12 0F D6 B544 5A 16 68 42 A1 27 3D 6A 7E 8C 0D 08 68 BC A576 6A CF D2 6A 6E AA D3 21 5E E0 84 61 73 67 870E 0D 06 6F 20 D0 91 5B 94 AC C7 0B 01 14 E7 0CBA AC B7 6D 8C C3 77 7D 12 A9 6B FF 4F 82 EB 2D9A EC DC 26 3C 13 38 A7 32 AF 48 77 1A 59 17 126C 85 9E 88 9C 59 61 05 19 53 A0 A2 A8 A2 20 74B5 DB B7 E6 08 71 BA 25 8E 88 76 A0 EE D5 DD F71C 58 AC 1B 8C 0B DF EE 4D 4F 2B C1 3C 5B 95 4DC9 EA AC AB C7 68 7A 6F 2B 82 A3 7E 8F 1B A5 A0C1 40 7C 00 E4 E1 A2 A7 76 B7 C7 E6 05 E2 7F 0AEC 0D 33 2E F1 C4 72 FC 91 79 B7 27 A8 54 3D 9F6E 8E 90 92 5B CB 4C 7B 11 F3 5D 74 D8 B6 41 B5C1 AA C9 F6 34 14 C2 E8 F3 6A F4 C7 9F 15 CB 54

" (Source: how_to_back_files.html, Indicator: "decrypt your files") "" (Source: how_to_back_files.html, Indicator: "files are encrypted") "

Your documents, photos, databases and other important files have been encrypted cryptographically strong, without the original key recovery is impossible! To decrypt your files you need to buy the special software -" (Source: how_to_back_files.html, Indicator: "decrypt your files")28:T729,"" opened "C:\autoexec.bat" with delete access "" opened "C:\config.sys" with delete access "" opened "C:\Users\Public\desktop.ini" with delete access "" opened "C:\Users\Public\Videos\desktop.ini" with delete access "" opened "C:\Users\Public\Videos\Sample Videos\desktop.ini" with delete access "" opened "C:\Users\Public\Videos\Sample Videos\Wildlife.wmv" with delete access "" opened "C:\Users\Public\Recorded TV\desktop.ini" with delete access "" opened "C:\Users\Public\Recorded TV\Sample Media\desktop.ini" with delete access "" opened "C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv" with delete access "" opened "C:\Users\Public\Pictures\desktop.ini" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\Desert.jpg" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\desktop.ini" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\Koala.jpg" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg" with delete access "" opened "C:\Users\Public\Music\desktop.ini" with delete access29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"66cda295ce93aaf708569eb0d9a5417bb9f98f63152b4b4b92fde8a2cb5f1d6b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790720242373,"unified_at":"2026-09-29T22:17:22.373Z","metadata":{"hashes":{"sha256":"66cda295ce93aaf708569eb0d9a5417bb9f98f63152b4b4b92fde8a2cb5f1d6b","sha1":"2d6b2b024b33a5c1b9f577ff4e1a887c07079dd2","md5":"1ca34b2d26a1e14efbaf88c23ba77ff0","sha512":"6bc283762632267b9596543c3d108f7062ea5b4ecf91b3832ca3b60845831014b0da4ec4c310e011df021ac2645135994f5f61b5dd1c82274936ebf27d78bc59","ssdeep":"1536:KIbgutzZi79QlgTHf4tq6KhxXwr3+wX8:xtz479QlOWWXKLX8","ssdeep_chunks":["1536:KIbgutz","1536:IbgutzZ","1536:bgutzZi","1536:gutzZi7","1536:utzZi79","1536:tzZi79Q","1536:zZi79Ql","1536:Zi79Qlg","1536:i79QlgT","1536:79QlgTH","1536:9QlgTHf","1536:QlgTHf4","1536:lgTHf4t","1536:gTHf4tq","1536:THf4tq6","1536:Hf4tq6K","1536:f4tq6Kh","1536:4tq6Khx","1536:tq6KhxX","1536:q6KhxXw","1536:6KhxXwr","1536:KhxXwr3","1536:hxXwr3+","1536:xXwr3+w","1536:Xwr3+wX","1536:wr3+wX8","3072:KIbgutz","3072:IbgutzZ","3072:bgutzZi","3072:gutzZi7","3072:utzZi79","3072:tzZi79Q","3072:zZi79Ql","3072:Zi79Qlg","3072:i79QlgT","3072:79QlgTH","3072:9QlgTHf","3072:QlgTHf4","3072:lgTHf4t","3072:gTHf4tq","3072:THf4tq6","3072:Hf4tq6K","3072:f4tq6Kh","3072:4tq6Khx","3072:tq6KhxX","3072:q6KhxXw","3072:6KhxXwr","3072:KhxXwr3","3072:hxXwr3+","3072:xXwr3+w","3072:Xwr3+wX","3072:wr3+wX8","1536:xtz479Q","1536:tz479Ql","1536:z479QlO","1536:479QlOW","1536:79QlOWW","1536:9QlOWWX","1536:QlOWWXK","1536:lOWWXKL","1536:OWWXKLX","1536:WWXKLX8"],"imphash":"8b7c7b5a664c1bcfdab545b5ffcdae40"},"file_info":{"file_name":"_yosKa4_.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":54272,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1514499538000,"last_seen":1643749953000,"last_multi_scan":1643749953000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["globeimposter","ransomware","a1lock","globe imposter"]},"stats":{"av":{"malicious_count":24,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":7},"sandbox_signatures":{"informative_count":4,"suspicious_count":11,"malicious_count":7,"total":22},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Purgen.tqIp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Globeimposter","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.SGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1117723","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.GlobeImposter.678DEF2B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Heur.c","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Ransom.HL.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.GlobeImposter.678DEF2B (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.FV trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/Ergop.c","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Ergop","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00551b351 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Purgen.aho","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXDE-MK!1CA34B2D26A1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Purgen.euymdd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Trojan.Mauvaise.SL1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_99","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-EVE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Mal_FakeGlobe","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Mal_FakeGlobe","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.RBV","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.TrojanRansom.Purgen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1063","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1063","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]}],"sandbox_signatures":[{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"F3hzum1.doc\" has type \"data\"\n \"0gakl8ixtWMkw.doc\" has type \"data\"\n \"EKeaJO.doc\" has type \"data\"\n \"iLLOga.exe\" has type \"data\"\n \"RecentPlaces.lnk\" has type \"data\"\n \"Calculator.lnk\" has type \"data\"\n \"mtgFs8Za.doc\" has type \"DOS executable (COM)\"\n \"Paint.lnk\" has type \"data\"\n \"securitypack.jar\" has type \"data\"\n \"6WMjwc1zqk3IB.exe\" has type \"data\"\n \"hlchPBL.exe\" has type \"data\"\n \"w5JaoO.doc\" has type \"data\"\n \"0pYWspjURe8aqA.exe\" has type \"data\"\n \"Desktop.lnk\" has type \"data\"\n \"rRgk91Ih5n.doc\" has type \"data\"\n \"Adobe Reader XI.lnk\" has type \"data\"\n \"bvYkKJ33N9A.exe\" has type \"data\"\n \"dskCEJ.exe\" has type \"data\"\n \"5F1yaAIKfUGQcmmt.doc\" has type \"data\"\n \"6SZfLTu9z.doc\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"Microsoft.NET\"\n Heuristic match: \"yoshikada@cock.lu\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"PSPUBWS.contact\" containing the Windows username \"PSPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\Users\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Videos\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Videos\\Sample Videos\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Recorded TV\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Recorded TV\\Sample Media\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Pictures\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Pictures\\Sample Pictures\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"mtgFs8Za.doc\" has type \"DOS executable (COM)\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"BROWSERUPDATECHECK\"; Value: \"%APPDATA%\\66cda295ce93aaf708569eb0d9a5417bb9f98f63152b4b4b92fde8a2cb5f1d6b.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$27","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 935 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$28","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"66cda295ce93aaf708569eb0d9a5417bb9f98f63152b4b4b92fde8a2cb5f1d6b.exe.bin\" has an entrypoint in section \".rdata\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegCloseKey\n RegOpenKeyExW\n CreateToolhelp32Snapshot\n CopyFileW\n GetModuleFileNameW\n GetDriveTypeA\n GetFileAttributesW\n Process32NextW\n Process32FirstW\n GetTempFileNameW\n GetFileSizeEx\n CreateThread\n FindNextFileW\n WriteFile\n FindFirstFileW\n CreateProcessA\n CreateFileW\n CreateProcessW\n Sleep\n ShellExecuteExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%APPDATA%\\66cda295ce93aaf708569eb0d9a5417bb9f98f63152b4b4b92fde8a2cb5f1d6b.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"50/67 Antivirus vendors marked sample as malicious (74% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"50/67 Antivirus vendors marked sample as malicious (74% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\\66cda295ce93aaf708569eb0d9a5417bb9f98f63152b4b4b92fde8a2cb5f1d6b.exe:Zone.Identifier\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References BIOS/BOOT related strings","description":"\"ntldr\"","origin":"File/Memory","relevance":9,"id":"string-0","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"71112b027a3b2a02ab8b02007f950200fc8c0200729602006cc805001ecd27027d262702\" to virtual address \"0x750207E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"56/67 Antivirus vendors marked dropped file \"_yosKa4_.exe\" as malicious (classified as \"Generic.Ransom.GlobeImposter\" with 83% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"Internal YARA signature matched on file \"all.bstring\"","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":22,"dropped_files_count":0,"extracted_files_count":139,"files_written_count":109,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["globeimposter","ransomware","a1lock","globe imposter"],"sample_flags":["Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"5db0fed2028838c43044124d","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.Ransom.GlobeImposter","submit_name":"_yosKa4_.exe","analysis_start_time":"2019-10-24T01:31:11+00:00","indicators_count":{"informative":4,"suspicious":16,"malicious":8},"tags":["Extracted Files","TOR analysis"],"is_in_unified_schema":true},{"id":"5a456a187ca3e12b844c15d5","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.Ransom.GlobeImposter","submit_name":"_yosKa4_.exe","analysis_start_time":"2017-12-28T23:03:36+00:00","indicators_count":{"informative":4,"suspicious":15,"malicious":6},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}],"processes":[{"pid":2312,"ppid":0,"name":"66cda295ce93aaf708569eb0d9a5417bb9f98f63152b4b4b92fde8a2cb5f1d6b.exe","command_line":"","sha256":"66cda295ce93aaf708569eb0d9a5417bb9f98f63152b4b4b92fde8a2cb5f1d6b","normalized_path":"C:\\66cda295ce93aaf708569eb0d9a5417bb9f98f63152b4b4b92fde8a2cb5f1d6b.exe","uid":"00047187-00002312","icon":"$29"}],"all_imported_dlls":["gdi32.dll","lpk.dll","rpcrt4.dll","cryptsp.dll","rsaenh.dll","msvcrt.dll","advapi32.dll","sechost.dll","shlwapi.dll","imm32.dll","msctf.dll","kernel32.dll","usp10.dll","shell32.dll","cryptbase.dll","ntdll.dll","KernelBase.dll","user32.dll","wow64cpu.dll","wow64.dll","sspicli.dll","wow64win.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"how_to_back_files.html","sha256":"f8d809aaa74b7c82bacb30a38763a2279bd4c153f526eb0432d7526368c4b5e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"GlobData","sha256":"c14c9a594a75629057c389f21cf2572d686cdf44f485ffae56be29b594c1dbad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"GlobSettings","sha256":"da912634496bb02056c53de4d2e7b41105c8558b988bac710bfa0475ac89f145","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"48B76449F3D5FEFA1133AA805E420F0FCA643651.crl","sha256":"e8655677d061a247524676ba5a684869619b34d96be86ee1fc9bd16b606f8907","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"A9B8213768ADC68AF64FCC6409E8BE414726687F.crl","sha256":"622e561273269d74170c5d805d659ac67f09ba1001411424347a69b128991a3c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"addressbook.acrodata","sha256":"e77365a7e40db9f285503d936f7233b07b93b5a96cee4024caa6f9d280c8f3dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"directories.acrodata","sha256":"c3280dde3ef31f2606609d2d1ee3f610760a3edcece67d20eaa6665864812745","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"services_rdr.dat","sha256":"19131174881c3ec99c1e2692f9d72cdff89e2a45e07aeb386afb5761b5230322","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"services_rdri.dat","sha256":"6f913feb990837c172084e51d184cf2b6af1e552c36bece580718ae37ae2dfac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"services_rdrk.dat","sha256":"0bd08936bfa4ae0ceb6bd18be3cfd027238f0ce9d06fc2bb74ad216b5863961f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"InstallTime20150122214805","sha256":"a1430b0df010c247f4cba4d268ae8d7991daeed50bd4b2123f45aa8b4ad64879","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"SiteSecurityServiceState.txt","sha256":"db035d5e5b8e6bf328c68036cc1dca4449f5de2d6f480eb7f1c06a9997593642","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"Telemetry.FailedProfileLocks.txt","sha256":"f37178e1830b4f2b89bf2f00aa6b56233325334ff65a93d6a916a1bd49741bae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"addons.json","sha256":"199aa0e108c224a2309458ea1e627e6ca0b003809cbe07b94b3fcb413b95cd0f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"blocklist.xml","sha256":"d4d8d05072469352abc3881bafb8624f1a84b6aa3a49fa40c4aacde8eb175153","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"cert8.db","sha256":"82e8f3d769335b1e0527fe832d0a199592e90babc67ca96c5f2bd6c813657236","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"compatibility.ini","sha256":"23a1b4555c345aa2323b073b04c762516974ee5112a18a00c2a9c646a1689011","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"content-prefs.sqlite","sha256":"a76434fb6b80bef328d5a764e40ff322b3ee6f81174a7bf0d39d5e2d4667a8e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"cookies.sqlite","sha256":"34b41bdf11c462459269cd35505a0d9ab634bd3707396060cecdffe3860d9b67","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"store.json.mozlz4","sha256":"2141ef3e90ed1f8924f267d89f4a34bb89db410d0cc7417f7a6f60342ddfb5ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"Adobe Reader XI.lnk","sha256":"baa9b312c2ad9bb21d55d1edea4366599d18cd974f5962a4ef7cce90f1899e29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"Google Chrome.lnk","sha256":"14152097ef80da42484e487412b2cd795594042136938556d292694eafa97bdd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"Mozilla Firefox.lnk","sha256":"21d4b249eb909befbb21461eb6a0b8767a2464af33c3d70a22ac8b15c3fa9470","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"0gakl8ixtWMkw.doc","sha256":"4f0663c9c244c4a913f06dbedc9363640ade25b0411f8c2d0d7e5efdea4943b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"0pYWspjURe8aqA.exe","sha256":"abf29c27a7e6f2d22c99d9e736020c0d0dfb33dfdfc8ac3f2e237eca850664c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"0zIG0D.doc","sha256":"58954dbd1bd433a75bce11943d2ac2ce7ac58eb8b0deb1aeeb416720655204ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"06fffcec3ce8a8662465fb0e56609f99b65d7efa8886f94e580bdf3c3daa56cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"63sDzrkUoHoRT.exe","sha256":"82f44d25f12ac7965765b92730c4205472c87f7863cb1d633b15ee155e901120","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"6SZfLTu9z.doc","sha256":"ebcf18164658ccb9a932226049b54a89fbd0dd04458c8278876cdfa45335bda4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"6WMjwc1zqk3IB.exe","sha256":"0ccbbcd7a1abbefa53f503182c78000255a9a3cdfe6a0d1111939e1f13132e2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"9rNtWnjTq9RGbU.exe","sha256":"69c7db1c0a9dfb67b3a49b1d2bb80ee03833825ed079b7d7e044247cd93ae002","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"C04T72pR0Bcl.doc","sha256":"4a3558b95748aa7be9bc9e1b073d0c1b03eede4633f7753d7ed90c8dcea4d2f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"EKeaJO.doc","sha256":"874342e4b362bbf8e772facb1192a3d64130afd45bdc8032e28de03185fef9e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"F3hzum1.doc","sha256":"1f370b5510c58538257e139853a0d6110bc2ae0e73e50bbed69bc5b7fd406900","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"Tmg2wsFHYf9ioO.doc","sha256":"4c55a5a0728b97de8dbc7e892caba8ff75ba4632e1b19cbe70b219da417166a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"a3Ntx.exe","sha256":"a92d9d1a09b2f2590e1b2858c4ab62306135dff25e8ab37effe37d325242d107","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"bg3oTe.doc","sha256":"ec3a9907075d08399751e2f380fcf0d4f026d3e073739dc6a0e941db3c7a40e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"bvYkKJ33N9A.exe","sha256":"8ee849726d6d8368e3985ad887663afc34687bff1df0b485dcbae15d4b2500cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"dH1rDN9f9.doc","sha256":"70b2bcbbaf2f8005085668d6760ecdd394d010c4d0e2ce2eb62ca7fb18d92ae0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"dgQJde60mPXhI.exe","sha256":"a63db0c839e26de4d9cd1e8624cae7f5b8dbaaa023f28372f8226e5e2b0096a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"dskCEJ.exe","sha256":"0c542d4a8c4f03afa53b45408d8a5f9017aaadfa1097cdbd8da2b37564373e44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"hKY8.doc","sha256":"43824e551eed7caff65ad643eaf05fb99e8749aa12d2760f75eab24f3bf07ead","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"hlchPBL.exe","sha256":"b400560f7fe7413e59f3b1e55ceb8234fe48c4ce1ea32ad6d37e6f141a0e034c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"iLLOga.exe","sha256":"929c188f342f9ff55a3d0fc579b014a06d2ef603b86d023d95d0561bcbebcb48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"kY01UeAiy5.exe","sha256":"e1cdf9ecc72445066e67f4382e02e90e556bf160e929ce2f04c730e69f0ca840","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"kdo6iAicsoicvHg.exe","sha256":"23228f647f5abb8b1d7d1df409ee51406e42e80d02d5f9b8ef96b8dbb0a4262c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"klmqz.doc","sha256":"d6840936541e3a7c3922f8332d3dd025f00051f534d52ae500ea135d487ee0cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"c9641a1ae6b6c3012ab5f8582810193810f2b0f8e4bc10ac83f9eeee5f436ec2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"mtgFs8Za.doc","sha256":"7f8162db8d7dfc121746f828aa97e49d99613a160e0a4a98682e603512ac5fbf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"rRgk91Ih5n.doc","sha256":"35d0863b2f99e880ee3d261bee79ea67648b287b800bb4f3c956dab5508741a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"tDUzYwYK5f.exe","sha256":"d7966ee0c6fa17efb9ce0178f432b2254a0f9a5773b8f0d46b11212321c16c2f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"w5JaoO.doc","sha256":"3fc772ae564cb10203262b211c779f950a025968e1792464bc68719fffc49b76","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"yZw6snqBQ28DAzu.exe","sha256":"dffa78e92017098a0189a998daecab22b4b9b8d728c3e35e58d9481fee2f43e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"Desktop.lnk","sha256":"f82569de99d32d669334f6dfdb2980bb12d52a663a4d254eb243a8d222d531f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"Downloads.lnk","sha256":"d5b1e56de0e0d195d44beb726e804f3b18eef143da27d942de189f9d89011831","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"RecentPlaces.lnk","sha256":"ff6a97f945bc57521dc30fd80b06a3e7f29b6dc814b04cccb138a88ae025c2e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"autoexec.bat","sha256":"d64e5f582da55d99df31f4beee109a063bd3fb551654ede932ab9602c0b13d09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"name":"securitypack.jar","sha256":"03ed073b9f487e92761428590012ede400094d15faf9b318556ecdf3f84192c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"_yosKa4_.exe","sha256":"66cda295ce93aaf708569eb0d9a5417bb9f98f63152b4b4b92fde8a2cb5f1d6b","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"settings.sol","sha256":"6226244bcfb19e1d6501c0248f2903554d4ca5109c5c6fbfab33ebffc8ad6e42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"RevocationCacheFile.dat","sha256":"cbffc7cc4affd13aa232e2c5fc3b7cf75ea3911a62c97c61152a9783c1fb0478","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"airappinstaller.exe","sha256":"91a83ed67c4a46f394a559be7f730c52d83b78e2b3539fe2e9d317326c4fdce7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"digest.s","sha256":"cbfe6d590476a503d35847acf5a5afc6bfe4f9fdb4b816c6ad58d039ae3225f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"InstallTime20171128222554","sha256":"56ea3c64ffabcd42fadb611ce3ecaec34f4a794167ea183704c0b4b406659426","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"AlternateServices.txt","sha256":"ae19ffb813a0b50fd5b9b34d324b6ea19f77b34dc249bc8ddfd4fbca0cdd6041","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"SecurityPreloadState.txt","sha256":"ab5ed32c44db77c0955b541f9726dd8b4f6f415b8801736c34dc3c78b5955122","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"addonStartup.json.lz4","sha256":"d9ffd0663314ea6757d14926a14a72d9fc3f7728d538a46d6c81762963f2a858","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"plugins.json","sha256":"5a66e05b4d0c02b07bc18db4b0a7b982ae4afea39db5025503200b43222199de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"containers.json","sha256":"e3458cfebc89bb2d256cb0ab63d1c54c6a7bfcc68f588ff569d254be5b5ded75","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"1553180765779.c28bc477-40f8-4aeb-a971-f79ebbfade97.main.jsonlz4","sha256":"a8b4375fd3273bbe963d61f6a61144aaf399cea5e544e32ed8c38e91f198718e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"widevinecdm.dll","sha256":"ce205a970502a4aca06f246e2408c9aa28e7d6c26b5b207c076cf8a0a92350cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"07c4.exe","sha256":"47b7dfc4c1725adfe8562a20f632e9650e4bcb3e0480081c9a816efddb1ca092","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"2VEV49vrsTLgZa.doc","sha256":"d5e4f0281baa5846fd0b961f9aed63649c76a00b14c765188da63d0231b9fcce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"2f07Jm4brrx.exe","sha256":"61bb3278118d8fa93b9a5b565a0828f9354a39606eba3255434336ca9301a6de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"3LnBJn.doc","sha256":"db5a6328707238e9b96ef171cc73dd2bb528dd05831e53b8bb0c64e802c9da6a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"4RHcGmkB.exe","sha256":"71770712086365245d385b2f92a6c5bb11367121de025c3a7319479475c60daf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"5F7TBCLUxJG.doc","sha256":"93947b5b72418d17b1598e43cea004056238de61293d4e404f8b565e0f4d8877","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"603jOLdO.exe","sha256":"e07c6aae228415fe9a854f0d7362917d6966ef5047e71075b7e783fb83f62603","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"7mOyQqezSRsEQhHm.exe","sha256":"328b35ca4d9c8b01bdd7e2ddf58e6d0363ce73aba8b24ac486ca954d6371aad0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"8L418Npib.exe","sha256":"ff27566bd3c51eed1ca8d4d5b3c17e9af843c5d4297235aa7be99e5ca8d24225","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"Ae5I9Tp.doc","sha256":"410b01fcffb086e2e316d05606e1c7c7c72ad377b3608d97203a88586b076893","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"CZspj.doc","sha256":"80dd58673bf1dcb9edb12073807e28f103ece8e77d0992863933cb319fef3795","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"Czkv.exe","sha256":"3139a95aec19ea8d1c6d16c1b4dc094f94e2294810ef7e1da2b575faaef9bc74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"DKwpgw.doc","sha256":"e77ff03c5431b68042c8e3028cb037d44d099e8124851535d918b4fa355a5c12","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"F42upSs.exe","sha256":"afb431f5a1947ea691cc27ce2a4f7299df220d5b82bd3013ab22997040fb5c89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"GgHlzQR.doc","sha256":"5064a5bad12fe22dc862b217a23b24ce3433fa543ffaf2665b471b4519939344","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"GmpsrAn.exe","sha256":"672553f6c60243a8d4e56c04c7a13ef5aa4a69ac020431800f9a6d6339c7bf9e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"HoJQ.doc","sha256":"483b213aa617e5b7a34df7952f3438e261f262f2499e2d0cfcb2653857897658","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"JtmJWBb0bwcS.exe","sha256":"a052318619b93705c74e0703bce49050e46996ecf1b4275aee2b8ccd5de1a482","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"MXf3Y8G12MNbrM.doc","sha256":"fe9f2a65c70768c8704066a635f2cdda469c7d0bff282edd7716353f846c9401","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"OpKgf.doc","sha256":"c5422244e4a88374220887eaf47f53be14542cd523845e759f0128606c0b9579","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"TXnZ8wd3RZI.exe","sha256":"4ba92db7a3a3eb0d98b14e78757cffa5f91776f669be2fa2976935602227177f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"Z2WBj58d55LDmYTY.exe","sha256":"7a0f0c4371d4939b4ce42322db17e82d19e54fdc22e4778dec9f4f2e2dd5d707","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"bMTL7.doc","sha256":"60c118b3ec662cf17c2751cadacf57756c51324edead16660bdc8267c0db3e03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"cQTUR.exe","sha256":"ebd5eb639fcbb92237438e79b8f10cbde21109e15fef1f27ccfc96041da50ae5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"eVGu5yCg91A9.exe","sha256":"2356777b6224482dfb9daf7dccdf5358f420ff05bfbb0a7f1150eb738bbe8cb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"gtcmotdmF.doc","sha256":"b74fa326252b7d1ecac5ec405cfcd3eba00f93b40a5988eb77d7ab497bac3f55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"iynDCtAWKrZqk.exe","sha256":"0c0804ddf4f347cd80165d1bf0eca4c5188190fbe0a61354780eb2b65feacf6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"j8Sa.doc","sha256":"dcd740eee116ca65ca9be5f673e19cc4e69f8742edca74b23195536c7ffc3e70","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"m3I6.doc","sha256":"e390c400fe7aeb2e537cc1affe42dbadd24e45586d69da7b7598012ca0779f07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"naK1.exe","sha256":"25f02d5b59046fef4f57ec76db3bb0c080d2bc96e02e5b3f1f924351ede7af78","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"netyeHD3z7v.exe","sha256":"33faec5851696a9efffcd21a11a81189689dbd636b1cc1cb2478a6bc3b2c1153","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"oJIkHjK96.exe","sha256":"355c98a4728efe8b74673ae8e0004a58d8849f43d770cc1ddc38fe8d9df2ae55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"pJ5LdT.doc","sha256":"6cc7cce2272acc03b742f036ea85d9abb1898bc2f6b06080b955edd1029283c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"piLMujsJtKhePpUk.doc","sha256":"09f3b854ec8c67c3135d6b8532bac461193db0050095ea1f3d5b549a0c03a511","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"qtaV9p.exe","sha256":"a3a833056c62ca510f95a4f89abcaed449e619b86bfe76891060370bf0626b76","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"sFbzgHs1K3qLZF41.doc","sha256":"0eb2f3ecd1a512ca5c6579d201e1f1a57e4ce85d0400518113ebd675bc9964cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"tpnUorm2s9.doc","sha256":"70ad27055124e1a7bf7e9516882b04108b037b5f3b6c47a2b15fd09c5abc9f4c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"uVLcWdEsjtuv46e.exe","sha256":"a9b1eb800fbe7f7d89d3297783f5416e52c202f2e5d27cd4971ca13d738cfcd8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"xHkhUwrp.doc","sha256":"e72458ee9eec8fa78010542757f26b4daee0b03e5637da9a6a167523c9dcb501","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"OneDrive.lnk","sha256":"5be592f94ca17f7c709f178251998d8057f140c9faa96d4b215389523499174e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"WdfCoInstaller01009.dll","sha256":"d947e3cc2f360849b09eebdb7ea2d9af2fcdea6b7f7a757927e2de9638999fbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"javaws.exe","sha256":"ed66b82266de9935dbc105bfca666d6cfc918e2a32f950ce61a2dbe19e870918","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"urlCache-current.bin","sha256":"5989556b5a78f5d5ec29a74df428ce76436c51f39b3c7be1ac0cda5e439f3960","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"OSETUPUI.DLL","sha256":"a225aacd6a8463977e5f90125407beeebdaf06804a353d864ca9a174cbc4366a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"WinDivert.dll","sha256":"80c3c6695f800195f9786cc7f3d0a887572886e87c063c0c2385685edc83f120","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"ose00000.exe","sha256":"ab59f196ee728d2d054c0712c47955d175e97ac6da161ddc06ada0bd30d5ea30","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"javaw.exe","sha256":"63168e5088905c7e2ffa656f7ff2b9d4231bb232f666d8c7f6132a26bd23bb5d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"KMSSS.exe","sha256":"c1e8267bf755e5c8f9d7f1172df7fff89dcf53a0ad40a9ab506fc118bbdab0b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"WinDivert.inf","sha256":"6af5e657685b4a5667443ce979632d585a14bb117800f41c4cf0ecc7d7a6dd5d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"scriptCache-current.bin","sha256":"d2529550ef35a3935c776f841392f18aac5b79416738c4f7a42ce1291b28f5a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"TunMirror2.exe","sha256":"7e0964bb051bdec566054068326044b5839b47704f9ffb48a6e35963f5236760","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"java.exe","sha256":"63c208b1d7c021ab87fb87090fa8fedcc24a546ca5f22880c5f7537dcba99b61","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"tap0901.cer","sha256":"dc3ad9f81aa0665c8e04772518073d645fba3472631438864f03c2fe58dfefb3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"TunMirror.exe","sha256":"17bcc9c61bdeb54ec9718311948928d2abbb2b6839b49b1b03fd57224ce3d587","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"SETUP.CHM","sha256":"7e79cbbe3192ef9bf7fd859b38e8dae327f793a4aea2b123838adcd022e2f193","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"vc_runtimeMinimum_x64.msi","sha256":"24291ddecb8c9d09af9c80d48da3a656c536af49ea259fdcb35153ab4655bf3c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"tapoas.cat","sha256":"0193a6acd4451f82ce7a34f3aa1111bca2f18db89bdc290210cab77b8bc566f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"VC_redist.x64.exe","sha256":"4c3618dd480a724828b82536e09ff4d71e7a9d3d4a1969c83ceab46411c78582","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"OemVista.inf","sha256":"add34f04fb9d6fe2dd6b01de9b9c2a9b2aa0d39004f91a5fb41ddc62c46a366e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"FakeClient.exe","sha256":"b81ded9044601d38c51e2cc2eefb8e5f1c310ecf5ca13aa61d33b600718fc961","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"tapoas.inf","sha256":"acf8d987a2d03726abc492d4d3888cedc92bf4e75fb6333709385f44eaba5603","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"ptun0901.cat","sha256":"53d11f7576e732d2e60721fa0ac4aa7520b9ae6f44bcc9ce5dd91ce00da60e17","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"vc_runtimeAdditional_x64.msi","sha256":"ee99590db690ceb03b6b44f174b574b5ad99d4c26296ca9658140867b4aa1e80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"devcon.exe","sha256":"0c29d649c97a888d4be9d3d84385fe562f01caa8e60a200148945d4c4be0a658","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"scriptCache-child-current.bin","sha256":"76f73db74984a1c588ea93271da29e1e7ce054ccebdb4ef12a1dce0909601a45","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"oas_sert.cer","sha256":"83ad696f8402e123ec719cbd9958c0a93792b34d03fff7bf4d4cdaf9116193cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"urlCache.bin","sha256":"7f41a2e72d7a482028fffe0652fa53ed0c0e3a42f37f0e9f5fe3983c92c78b9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"name":"Acrobat Reader DC.lnk","sha256":"6b5dffa893062f6a0d908595a9c39df177cdf3c9ef22a0be84e107e6ca3fbe4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"C:\\66cda295ce93aaf708569eb0d9a5417bb9f98f63152b4b4b92fde8a2cb5f1d6b.exe","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%APPDATA%\\66cda295ce93aaf708569eb0d9a5417bb9f98f63152b4b4b92fde8a2cb5f1d6b.exe","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"C:\\66cda295ce93aaf708569eb0d9a5417bb9f98f63152b4b4b92fde8a2cb5f1d6b.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%APPDATA%\\66cda295ce93aaf708569eb0d9a5417bb9f98f63152b4b4b92fde8a2cb5f1d6b.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%PUBLIC%\\6A0915B00C8C0586A4D66A7DC1A8C6E418A74FDD14B46BF2BAF9B9BB67D8302F","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"C:\\share\\1514498645900$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"C:\\share\\1514498645900$OK","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"C:\\1514498645900$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"C:\\1514498645900$OK","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"C:\\EnW.5VV","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"C:\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"C:\\Bt1eTWllrK9Dd.00I","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"C:\\w3uu4sR39PLwKXZTaz7H.t4M","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"C:\\SdHC3y3xLNQXdIMbk6C7Ait0.hmV","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"C:\\xpMV35e0Y.P7l","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"C:\\M0UPsm5mk.MDO","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"C:\\Users\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%PUBLIC%\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%PUBLIC%\\Videos\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%PUBLIC%\\Recorded TV\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%PUBLIC%\\Recorded TV\\Sample Media\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%PUBLIC%\\Pictures\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%PUBLIC%\\Music\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%PUBLIC%\\Libraries\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%PUBLIC%\\Downloads\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%PUBLIC%\\Documents\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%PUBLIC%\\Desktop\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%USERPROFILE%\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\NTUSER.DAT","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG1","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG2","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%USERPROFILE%\\Videos\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\Searches\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\Saved Games\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\Saved Games\\Microsoft Games\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%USERPROFILE%\\Pictures\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\Music\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\Links\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\Favorites\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\Downloads\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\Documents\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\Desktop\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\Contacts\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Wireshark\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\parent.lock","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\webapps\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\storage\\persistent\\moz-safe-about+home\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\storage\\persistent\\moz-safe-about+home\\idb\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\sessionstore-backups\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\healthreport\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\gmp-gmpopenh264\\1.3\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\datareporting\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\crashes\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Crash Reports\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\CRLCache\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\JSCache\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"}]},{"path":"C:\\_yosKa4_.exe","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\_yosKa4_.exe","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"C:\\share\\1571880684278$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"C:\\share\\1571880684278$OK","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"C:\\_yosKa4_.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\_yosKa4_.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\Searches\\Indexed Locations.search-ms","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\OneDrive\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\gmp-gmpopenh264\\1.7.1\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\bookmarkbackups\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\blocklists\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\openssl\\cache\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#www.xinhuanet.com\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#www.toshiba.com\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#www.sprint.com\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#www.mlbstatic.com\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\AlternateServices.txt","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\parent.lock","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\SecurityPreloadState.txt","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\storage\\default\\about+newtab\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\storage\\default\\about+newtab\\idb\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\storage\\default\\about+newtab\\idb\\3312185054sbndi_pspte.files\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\sessionstore-backups\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\gmp-widevinecdm\\1.4.8.1008\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\datareporting\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\datareporting\\archived\\2019-03\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\crashes\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\airappinstaller\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"5a456a187ca3e12b844c15d5"},{"report_type":"sandbox","report_id":"5db0fed2028838c43044124d"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5db0fed2028838c43044124d","5a456a187ca3e12b844c15d5"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 66cda295ce93… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 66cda295ce93…. Malware family: Trojan.Generic. Threat score 100/100. 24/26 AV engines flagged this file. 7 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/66cda295ce93aaf708569eb0d9a5417bb9f98f63152b4b4b92fde8a2cb5f1d6b"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 66cda295ce93… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 66cda295ce93…. Malware family: Trojan.Generic. Threat score 100/100. 24/26 AV engines flagged this file. 7 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/66cda295ce93aaf708569eb0d9a5417bb9f98f63152b4b4b92fde8a2cb5f1d6b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 66cda295ce93… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 66cda295ce93…. Malware family: Trojan.Generic. Threat score 100/100. 24/26 AV engines flagged this file. 7 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]