21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T47f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 7852b47e7a9e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7852b47e7a9e…. Malware family: Trojan.Generic. Threat score 100/100. 23/29 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":23,"total":29},"behavioralIndicators":{"malicious":7,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T951,"pchgdage6182.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}") "pchgdage6182.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "pchgdage6182.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "pchgdage6182.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "pchgdage6182.exe" touched "Library Folder" (Path: "HKCU\WOW6432NODE\CLSID\{A5A3563A-5755-4A6F-854E-AFA3230B199F}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "pchgdage6182.exe" touched "CLSID_DBFolder" (Path: "HKCR\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B2952B16-0E07-4E5A-B993-58C52CB94CAE}") "pchgdage6182.exe" touched "CLSID_KindDescriptionFactory" (Path: "HKCU\WOW6432NODE\CLSID\{1C1800C1-3258-44C2-BE80-3DEADB6C5E39}\TREATAS") "pchgdage6182.exe" touched "CLSID_ScopeFactory" (Path: "HKCU\WOW6432NODE\CLSID\{6746C347-576B-4F73-9012-CDFEEA251BC4}\TREATAS") "pchgdage6182.exe" touched "CLSID_SearchIDListFactory" (Path: "HKCU\WOW6432NODE\CLSID\{6E682784-1ECA-4CF2-988D-96B6E89E9A4D}\TREATAS") "pchgdage6182.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "pchgdage6182.exe" touched "Property System" (Path: "HKCU\WOW6432NODE\CLSID\{B8967F85-58AE-4F46-9FB2-5D7904798F4B}\TREATAS") "pchgdage6182.exe" touched "Progress Dialog" (Path: "HKCU\WOW6432NODE\CLSID\{F8383852-FCD3-11D1-A6B9-006097DF5BD4}\TREATAS") "pchgdage6182.exe" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "pchgdage6182.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "pchgdage6182.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "pchgdage6182.exe" touched "Search Gatherer Notification" (Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\TREATAS") "DismHost.exe" touched "PSDispatch" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{00020420-0000-0000-C000-000000000046}") "DismHost.exe" touched "PSSupportErrorInfo" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{DF0B3D60-548F-101B-8E65-08002B2BD119}\TREATAS")23:T714,".exe" touched file "C:\Windows\SysWOW64\rsaenh.dll" ".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "pchgdage6182.exe" touched file "C:\Windows\SysWOW64\rsaenh.dll" "pchgdage6182.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "pchgdage6182.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\Database1.lnk" "pchgdage6182.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "pchgdage6182.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "pchgdage6182.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000019.db" "pchgdage6182.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini" "pchgdage6182.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Libraries" "pchgdage6182.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms" "pchgdage6182.exe" touched file "C:\Windows\SysWOW64\en-US\shell32.dll.mui" "pchgdage6182.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\fastfuzzer.lnk" "pchgdage6182.exe" touched file "C:\Windows\Fonts\StaticCache.dat" "pchgdage6182.exe" touched file "C:\Windows\SysWOW64\en-US\msctf.dll.mui" "pchgdage6182.exe" touched file "C:\Windows\Resources\Themes\Aero\Shell\NormalColor\shellstyle.dll" "pchgdage6182.exe" touched file "C:\Windows\SysWOW64\en-US\user32.dll.mui" "pchgdage6182.exe" touched file "C:\Windows\SysWOW64\oleaccrc.dll" "pchgdage6182.exe" touched file "C:\Windows\SysWOW64\en-US\oleaccrc.dll.mui"24:T416,Heuristic match: "RomanchukEyla@protonmail.com CouwetIzotofo@o2.pl" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "https://sectigo.com/CPS0C" Pattern match: "crl.sectigo.com/SectigoRSACodeSigningCA.crl0s" Pattern match: "crt.sectigo.com/SectigoRSACodeSigningCA.crt0#" Pattern match: "http://ocsp.sectigo.com0" Pattern match: "crl.usertrust.com/AddTrustExternalCARoot.crl05" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" Heuristic match: "crl.sectigo.com" Heuristic match: "ocsp.sectigo.com" Heuristic match: "Greetings! There was a significant flaw in the security system of your company. You should be thankful that the flaw was exploited by serious people and not some rookies. They would have damaged all of your data by mistake or for fun. Your files ar" Heuristic match: "RomanchukEyla@protonmail.com" Heuristic match: "CouwetIzotofo@o2.pl"25:T284b,"vboxvideo.inf" (Indicator: "vbox") "2019-03-21 13:20:00, Error DISM DISM Driver Manager: PID=3932 Failed opening driver package for x86: INF Name='C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_ad82ab6f57da5f72\vboxguest.inf' - CDriverPackage::OpenDm" (Indicator: "vbox") "2019-03-21 13:20:00, Error DISM DISM Driver Manager: PID=3932 Failed opening driver package for x86: INF Name='C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_ad82ab6f57da5f72\vboxguest.inf' - CDriverPackage::OpenDm" (Indicator: "vboxguest") "2017-12-11 20:24:00, Info DISM API: PID=2796 TID=2828 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_amd64_neutral_282ccc1684d6e163\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2017-12-11 20:24:00, Info DISM DISM Driver Manager: PID=1172 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2017-12-11 20:24:00, Info DISM DISM Driver Manager: PID=1172 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2017-12-11 20:24:00, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\VBoxGuest.cat]" (Indicator: "vbox") "2017-12-11 20:24:00, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\VBoxGuest.cat]" (Indicator: "vboxguest") "2017-12-11 20:24:00, Info DISM DISM Driver Manager: PID=1172 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2017-12-11 20:24:00, Info DISM DISM Driver Manager: PID=1172 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest") "2017-12-11 20:24:00, Info DISM API: PID=2796 TID=2828 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2017-12-11 20:24:00, Info DISM API: PID=2796 TID=2828 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest") "2018-02-20 09:38:55, Info DISM API: PID=1720 TID=1964 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_amd64_neutral_bc42bb1917d1bc65\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2018-02-20 09:38:55, Info DISM DISM Driver Manager: PID=3012 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2018-02-20 09:38:55, Info DISM DISM Driver Manager: PID=3012 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2018-02-20 09:38:55, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\VBoxGuest.cat]" (Indicator: "vbox") "2018-02-20 09:38:55, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\VBoxGuest.cat]" (Indicator: "vboxguest") "2018-02-20 09:38:55, Info DISM DISM Driver Manager: PID=3012 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2018-02-20 09:38:55, Info DISM DISM Driver Manager: PID=3012 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest") "2018-02-20 09:38:55, Info DISM API: PID=1720 TID=1964 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2018-02-20 09:38:55, Info DISM API: PID=1720 TID=1964 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest") "2019-01-03 17:11:42, Info DISM API: PID=2008 TID=2408 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_amd64_neutral_e9f3789e40cc2499\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2019-01-03 17:11:42, Info DISM DISM Driver Manager: PID=1456 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2019-01-03 17:11:42, Info DISM DISM Driver Manager: PID=1456 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2019-01-03 17:11:42, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\VBoxGuest.cat]" (Indicator: "vbox") "2019-01-03 17:11:42, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\VBoxGuest.cat]" (Indicator: "vboxguest") "2019-01-03 17:11:42, Info DISM DISM Driver Manager: PID=1456 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2019-01-03 17:11:42, Info DISM DISM Driver Manager: PID=1456 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest") "2019-01-03 17:11:43, Info DISM API: PID=2008 TID=2408 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2019-01-03 17:11:43, Info DISM API: PID=2008 TID=2408 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest") "2019-01-03 17:11:43, Info DISM DISM Driver Manager: PID=1456 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2019-01-03 17:11:43, Info DISM DISM Driver Manager: PID=1456 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2019-01-03 17:11:43, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\VBoxGuest.cat]" (Indicator: "vbox") "2019-01-03 17:11:43, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\VBoxGuest.cat]" (Indicator: "vboxguest") "2019-01-03 17:11:43, Info DISM DISM Driver Manager: PID=1456 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2019-01-03 17:11:43, Info DISM DISM Driver Manager: PID=1456 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest")26:T645,"Greetings! There was a significant flaw in the security system of your company. You should be thankful that the flaw was exploited by serious people and not some rookies. They would have damaged all of your data by mistake or for fun. Your files are encrypted with the strongest military algorithms RSA4096 and AES-256. Without our special decoder it is impossible to restore the data. Attempts to restore your data with third party software as Photorec, RannohDecryptor etc. will lead to irreversible destruction of your data. To confirm our honest intentions. Send us 2-3 different random files and you will get them decrypted. It can be from different computers on your network to be sure that our decoder decrypts everything. Sample files we unlock for free (files should not be related to any kind of backups). We exclusively have decryption software for your situation DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME the encrypted files. DO NOT MOVE the encrypted files. This may lead to the impossibility of recovery of the certain files. The payment has to be made in Bitcoins. The final price depends on how fast you contact us. As soon as we receive the payment you will get the decryption tool and instructions on how to improve your systems security To get information on the price of the decoder contact us at: RomanchukEyla@protonmail.com CouwetIzotofo@o2.pl" (Source: READ-ME-NOW.txt, Indicator: "files are encrypted") "Your files are encrypted with the strongest military algorithms RSA4096 and AES-256." (Source: READ-ME-NOW.txt, Indicator: "files are encrypted")27:T2118,Spawned process ".exe" (UID: 00010187-00004152) Spawned process "pchgdage8080.exe" with commandline "-w" (UID: 00010328-00002132) Spawned process "pchgdage8080.exe" with commandline "-w Z:\7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125.exe" (UID: 00013568-00003944) Spawned process "pchgdage8080.exe" with commandline "-w "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi"" (UID: 00013568-00003516) Spawned process "pchgdage8080.exe" with commandline "-w "%PROGRAMFILES%\7-Zip\7-zip.chm"" (UID: 00013907-00002404) Spawned process "pchgdage8080.exe" with commandline "-w "C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab"" (UID: 00013909-00003064) Spawned process "pchgdage8080.exe" with commandline "-w "%PROGRAMFILES%\Adobe\Acrobat Reader DC\Reader\plug_ins3d\2d.x3d"" (UID: 00014240-00003184) Spawned process "pchgdage8080.exe" with commandline "-w "%PROGRAMFILES%\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\ui-strings.js"" (UID: 00014243-00003156) Spawned process "pchgdage8080.exe" with commandline "-w "%PROGRAMFILES%\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\ui-strings.js"" (UID: 00014578-00004416) Spawned process "pchgdage8080.exe" with commandline "-w "%PROGRAMFILES%\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\ui-strings.js"" (UID: 00014579-00000756) Spawned process "pchgdage8080.exe" with commandline "-w "%PROGRAMFILES%\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\ui-strings.js"" (UID: 00014912-00003792) Spawned process "pchgdage8080.exe" with commandline "-w "%COMMONPROGRAMFILES%\microsoft shared\ink\sv-SE\tipresx.dll.mui"" (UID: 00014916-00003984) Spawned process "pchgdage8080.exe" with commandline "-w "%PROGRAMFILES%\HNC\Shared80\Clipart\CommonClipart\TR_Road\madang.ini"" (UID: 00015131-00003264) Spawned process "pchgdage8080.exe" with commandline "-w "%PROGRAMFILES%\HNC\Shared80\Clipart\CommonClipart\TR_Rest\madang.ini"" (UID: 00015250-00003268) Spawned process "pchgdage8080.exe" with commandline "-w "%PROGRAMFILES%\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll"" (UID: 00015259-00003232) Spawned process "pchgdage8080.exe" with commandline "-w "%PROGRAMFILES%\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl"" (UID: 00015466-00003004) Spawned process "pchgdage8080.exe" with commandline "-w %LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\ms\FileSync.LocalizedResources.dll.mui" (UID: 00015583-00004296) Spawned process "pchgdage8080.exe" with commandline "-w "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\1F2HR9E2\--10365204[1].gif"" (UID: 00015597-00002656) Spawned process "pchgdage8080.exe" with commandline "-w "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\0QPGGJBR\11738[1].js"" (UID: 00015798-00004048) Spawned process "pchgdage8080.exe" with commandline "-w "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\JKW6IVR1\1.2.0.min[1].js"" (UID: 00015915-00003364) Spawned process "pchgdage8080.exe" with commandline "-w "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\FX20RZHB\-torba-yasa-resmi-gazete-de-yayimlandi-10367987[1].jpg"" (UID: 00015937-00004052) Spawned process "pchgdage8080.exe" with commandline "-w %LOCALAPPDATA%\Programs\Python\Python36-32\tcl\tcl8\8.6\http-2.8.9.tm" (UID: 00016131-00003836) Spawned process "pchgdage8080.exe" with commandline "-w %LOCALAPPDATA%\Programs\Python\Python36-32\tcl\tcl8.6\opt0.4\optparse.tcl" (UID: 00016247-00003608) Spawned process "pchgdage8080.exe" with commandline "-w "%PUBLIC%\Videos\Sample Videos\Wildlife.wmv"" (UID: 00016269-00004424) Spawned process "pchgdage8080.exe" with commandline "-w "%PUBLIC%\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv"" (UID: 00016464-00001000) Spawned process "pchgdage8080.exe" with commandline "-w "%PUBLIC%\Pictures\Sample Pictures\Chrysanthemum.jpg"" (UID: 00016577-00004700) Spawned process "pchgdage8080.exe" with commandline "-w "%PUBLIC%\Music\Sample Music\AlbumArtSmall.jpg"" (UID: 00016605-00004768) Spawned process "pchgdage8080.exe" with commandline "-w %PUBLIC%\Libraries\RecordedTV.library-ms" (UID: 00016798-00004876) Spawned process "pchgdage8080.exe" with commandline "-w %USERPROFILE%\ntuser.dat.LOG1" (UID: 00016911-00004864) Spawned process "pchgdage8080.exe" with commandline "-w "%USERPROFILE%\Searches\Indexed Locations.search-ms"" (UID: 00016966-00004832) Spawned process "pchgdage8080.exe" with commandline "-w "%USERPROFILE%\Favorites\Windows Live\Get Windows Live.url"" (UID: 00017132-00004868) Spawned process "pchgdage8080.exe" with commandline "-w "%USERPROFILE%\Favorites\MSN Websites\MSN Autos.url"" (UID: 00017242-00004740) Spawned process "pchgdage8080.exe" with commandline "-w "%USERPROFILE%\Favorites\Microsoft Websites\IE Add-on site.url"" (UID: 00017309-00004924) Spawned process "pchgdage8080.exe" with commandline "-w "%USERPROFILE%\Favorites\Links for United States\GobiernoUSA.gov.url"" (UID: 00017466-00005020) Spawned process "pchgdage8080.exe" with commandline "-w "%USERPROFILE%\Favorites\Links\Suggested Sites.url"" (UID: 00017577-00005028) Spawned process "pchgdage8080.exe" with commandline "-w %USERPROFILE%\Downloads\0dZxapFIdAxD.exe" (UID: 00017644-00005164) Spawned process "pchgdage8080.exe" with commandline "-w %LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\mr\FileSync.LocalizedResources.dll.mui" (UID: 00017801-00005016) Spawned process "pchgdage8080.exe" with commandline "-w %USERPROFILE%\Documents\Database1.accdb" (UID: 00017909-00005040) Spawned process "pchgdage8080.exe" with commandline "-w "%USERPROFILE%\Documents\Outlook Files\Outlook.pst"" (UID: 00017977-00005268) Spawned process "pchgdage8080.exe" with commandline "-w "%USERPROFILE%\Documents\hancom\Hancom Office 2010 SE (English Edition) - 3PC-1User (Download) Keys.html"" (UID: 00018137-00005388) Spawned process "pchgdage8080.exe" with commandline "-w "%USERPROFILE%\Documents\Amazon Downloader Logs\Amazon_Downloader_Log_20171206-225712_1810e9e0-1a8d-457c-be3a-737de50dc6bb.txt"" (UID: 00018243-00005564) Spawned process "pchgdage8080.exe" with commandline "-w %USERPROFILE%\Contacts\%OSUSER%.contact" (UID: 00018310-00005556) Spawned process "pchgdage8080.exe" with commandline "%APPDATA%\Wireshark\recent" (UID: 00018470-00005604) Spawned process "pchgdage8080.exe" with commandline "%APPDATA%\Mozilla\Firefox\profiles.ini" (UID: 00018589-00005240) Spawned process "pchgdage8080.exe" with commandline "%APPDATA%\Mozilla\Firefox\Profiles\g4h7miqt.default\addonStartup.json.lz4" (UID: 00018645-00005124) Spawned process "pchgdage8080.exe" with commandline "%APPDATA%\Mozilla\Firefox\Profiles\g4h7miqt.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite" (UID: 00018802-00005808) Spawned process "pchgdage8080.exe" with commandline "%APPDATA%\Mozilla\Firefox\Profiles\g4h7miqt.default\storage\default\https+++my.visualstudio.com\.metadata-v2" (UID: 00018921-00005776) Spawned process "pchgdage8080.exe" with commandline "%APPDATA%\Mozilla\Firefox\Profiles\g4h7miqt.default\storage\default\https+++my.visualstudio.com\idb\301792106ttes.sqlite" (UID: 00018984-00005084) Spawned process "pchgdage8080.exe" with commandline "%APPDATA%\Mozilla\Firefox\Profiles\g4h7miqt.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.sqlite" (UID: 00019135-00005192) Spawned process "pchgdage8080.exe" with commandline "%APPDATA%\Mozilla\Firefox\Profiles\g4h7miqt.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\2" (UID: 00019253-00005144) Spawned process "pchgdage8080.exe" with commandline "%APPDATA%\Mozilla\Firefox\Profiles\g4h7miqt.default\sessionstore-backups\previous.jsonlz4" (UID: 00019316-00005228) Spawned process "pchgdage8080.exe" with commandline "%APPDATA%\Mozilla\Firefox\Profiles\g4h7miqt.default\gmp-widevinecdm\1.4.8.1008\LICENSE.txt" (UID: 00019486-00002732) Spawned process "pchgdage8080.exe" with commandline "%APPDATA%\Mozilla\Firefox\Profiles\g4h7miqt.default\gmp-gmpopenh264\1.7.1\gmpopenh264.info" (UID: 00019588-00002704) Spawned process "pchgdage8080.exe" with commandline "%APPDATA%\Mozilla\Firefox\Profiles\g4h7miqt.default\datareporting\session-state.json" (UID: 00019651-00002328)28:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790297788481,"unified_at":"2026-09-25T00:56:28.481Z","metadata":{"hashes":{"sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","sha1":"34fb03a35e723d27e99776ed3e81967229b3afe1","md5":"b3d3da12ca3b9efd042953caa6c3b8cd","sha512":"c3e48a9f61f297ecbee593fdb0de6d4f256cf008406ce1844a6d72c3a6a40d714359ab304bbf24bcd57bf99293f03e733aed0c5c43192f4315b449559a4d7195","ssdeep":"24576:Id2D4s/6j4pvOmB5h8DlVeZUEJt90nPx103CdnKQOds8EDJK5:FDH6k1jZUElqg3zQOds8EDJK5","ssdeep_chunks":["24576:Id2D4s/","24576:d2D4s/6","24576:2D4s/6j","24576:D4s/6j4","24576:4s/6j4p","24576:s/6j4pv","24576:/6j4pvO","24576:6j4pvOm","24576:j4pvOmB","24576:4pvOmB5","24576:pvOmB5h","24576:vOmB5h8","24576:OmB5h8D","24576:mB5h8Dl","24576:B5h8DlV","24576:5h8DlVe","24576:h8DlVeZ","24576:8DlVeZU","24576:DlVeZUE","24576:lVeZUEJ","24576:VeZUEJt","24576:eZUEJt9","24576:ZUEJt90","24576:UEJt90n","24576:EJt90nP","24576:Jt90nPx","24576:t90nPx1","24576:90nPx10","24576:0nPx103","24576:nPx103C","24576:Px103Cd","24576:x103Cdn","24576:103CdnK","24576:03CdnKQ","24576:3CdnKQO","24576:CdnKQOd","24576:dnKQOds","24576:nKQOds8","24576:KQOds8E","24576:QOds8ED","24576:Ods8EDJ","24576:ds8EDJK","24576:s8EDJK5","49152:Id2D4s/","49152:d2D4s/6","49152:2D4s/6j","49152:D4s/6j4","49152:4s/6j4p","49152:s/6j4pv","49152:/6j4pvO","49152:6j4pvOm","49152:j4pvOmB","49152:4pvOmB5","49152:pvOmB5h","49152:vOmB5h8","49152:OmB5h8D","49152:mB5h8Dl","49152:B5h8DlV","49152:5h8DlVe","49152:h8DlVeZ","49152:8DlVeZU","49152:DlVeZUE","49152:lVeZUEJ","49152:VeZUEJt","49152:eZUEJt9","49152:ZUEJt90","49152:UEJt90n","49152:EJt90nP","49152:Jt90nPx","49152:t90nPx1","49152:90nPx10","49152:0nPx103","49152:nPx103C","49152:Px103Cd","49152:x103Cdn","49152:103CdnK","49152:03CdnKQ","49152:3CdnKQO","49152:CdnKQOd","49152:dnKQOds","49152:nKQOds8","49152:KQOds8E","49152:QOds8ED","49152:Ods8EDJ","49152:ds8EDJK","49152:s8EDJK5","24576:FDH6k1j","24576:DH6k1jZ","24576:H6k1jZU","24576:6k1jZUE","24576:k1jZUEl","24576:1jZUElq","24576:jZUElqg","24576:ZUElqg3","24576:UElqg3z","24576:Elqg3zQ","24576:lqg3zQO","24576:qg3zQOd","24576:g3zQOds","24576:3zQOds8","24576:zQOds8E"],"imphash":"27f610a2966ffaa9958098af7bf71994"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1274736,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1553170849000,"last_seen":1658426577000,"last_multi_scan":1658426577000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["alma","almanahe","backdoor","botnet","chir","clop","criminal","crypt","cryptlocker","downloader","downloadsponsor","dropper","gael","genkryptik","kryptik","locker","lockergoga","neshta","ransomware","stealer","trojan","tufik","virut","zegost","zurgop"]},"stats":{"av":{"malicious_count":23,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":11},"sandbox_signatures":{"informative_count":24,"suspicious_count":19,"malicious_count":7,"total":50},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypren.tpWS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Clopran.Exp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Tiggre","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/LockerGoga.jccbu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.LockerGoga.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/LockerGoga.A.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.LockerGoga (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.LockerGoga.B trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.LockerGoga","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005474b11 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agentb.jker","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.bvg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.fmrldy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-FHZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Ransom.GoGalocker","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.LockerGoga.1274736","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom.01E4CF6C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom.01E4CF6C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.GAK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Encoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win32.8820","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"suspicious","value":"Found a string that may be used as part of an injection method"},{"type":"suspicious","value":"Scans for the windows taskbar (may be used for explorer injection)"}],"sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1116","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"tactic":"Discovery","technique":"Network Service Scanning","attack_id":"T1046","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1046","identifiers":[{"type":"suspicious","value":"Detected increased number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00014902-00002848-39379-2-01108C4B\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014902-00002848-39379-60-0112825F\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00019085-00003932-37014-75--004D0C10\n SetUnhandledExceptionFilter@KERNEL32.dll at 42973-111-000000010000F3F0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00019085-00003932-37014-288--004D23C0\n GetVersionExA@KERNEL32.DLL at 00019085-00003932-37014-440--004D1246\n GetVersionExW@KERNEL32.dll at 42973-312-000000010000DC40\n GetVersionExA@KERNEL32.dll at 42973-464-000000010000EDBA","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExA@KERNEL32.DLL directly followed by \"cmp dword ptr [rsp+30h], 02h\" and \"jne FFFFFFFFFFB2EDEBh\" at 00019085-00003932-37014-440--004D1246\n Found API call GetVersionExA@KERNEL32.dll directly followed by \"cmp dword ptr [rsp+30h], 02h\" and \"jne 000000010000EDEBh\" at 42973-464-000000010000EDBA","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00014902-00002848-39379-83-0107CCF0\n GetProcessHeap@KERNEL32.DLL at 00014902-00002848-39379-84-010C6E80\n GetProcessHeap@KERNEL32.DLL at 00019085-00003932-37014-325--004D29E8\n GetProcessHeap@KERNEL32.dll at 42973-349-000000010000D618\n GetProcessHeap@KERNEL32.dll at 42973-562-000000010000E3F0\n GetProcessHeap@KERNEL32.dll at 42973-567-000000010000E0DC","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"pchgdage6182.exe\" queries volume information of \"C:\\\" at 00015313-00002440-00000046-26257365593\n \"pchgdage6182.exe\" queries volume information of \"%USERPROFILE%\\Documents\\Database1.accdb\" at 00015313-00002440-00000046-26307078049","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"pchgdage6182.exe\" queries volume information of \"C:\\\" at 00015313-00002440-00000046-26257365593","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"pchgdage6182.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\PCHGDAGE6182.EXE\")\n \"pchgdage6182.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\PCHGDAGE6182.EXE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"crl.sectigo.com\"\n \"ocsp.sectigo.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"dismhost.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\BaseNamedObjects\\Global\\WdsSetupLogInit\"\n \"\\BaseNamedObjects\\Global\\SetupLog\"\n \"\\BaseNamedObjects\\DBWinMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"DISMHOST.EXE.5C938DA0.bin\" as clean (type is \"PE32+ executable (GUI) x86-64 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$22","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"DismHost.exe\" (UID: 00019085-00003932) was launched with modified environment variables: \"CommonProgramFiles, Path, LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, TEMP, APPDATA, USERPROFILE, TMP, ProgramFiles, USERNAME\"\n Process \"DismHost.exe\" (UID: 00019085-00003932) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432, LOGONSERVER, PROMPT, VXDIR, HOMEPATH, HOMEDRIVE\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"pchgdage6182.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"pchgdage6182.exe\" with commandline \"-w\" (UID: 00015313-00002440)\n Spawned process \"DismHost.exe\" with commandline \"{81140F74-22CC-4127-AEB0-FAF2EB489E76}\" (UID: 00019085-00003932)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"pchgdage6182.exe\" with commandline \"-w\" (UID: 00015313-00002440)\n Spawned process \"DismHost.exe\" with commandline \"{81140F74-22CC-4127-AEB0-FAF2EB489E76}\" (UID: 00019085-00003932)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Sectigo RSA Code Signing CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: CF:93:3A:62:95:98:E5:E1:92:DA:20:86:E6:11:0A:D1:97:4F:8E:C3; see report for more information)\n The input sample is signed with a certificate issued by \"CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE\" (SHA1: EA:B0:40:68:9A:0D:80:5B:5D:6F:D6:54:FC:16:8C:FF:00:B7:8B:E3; see report for more information)\n The input sample is signed with a certificate issued by \"CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US\" (SHA1: 94:C9:5D:A1:E8:50:BD:85:20:9A:4A:2A:F3:E1:FB:16:04:F9:BB:66; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1116","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"pchgdage6182.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"DISMHOST.EXE.5C938DA0.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"\n \"READ-ME-NOW.txt\" has type \"ASCII text with CRLF line terminators\"\n \"dism.log\" has type \"UTF-8 Unicode (with BOM) text with very long lines with CRLF line terminators\"\n \"desktop.ini\" has type \"empty\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$23","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$24","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"pchgdage6182.exe\" opened \"\\Device\\KsecDD\"\n \"DismHost.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00014902-00002848-00000033-15799130324\n \"pchgdage6182.exe\" at 00015313-00002440-00000033-20528717502\n \"DismHost.exe\" at 00019085-00003932-00000033-150556690253","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"$25","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"pchgdage6182.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"DismHost.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceExW@KERNEL32.DLL at 00019085-00003932-37014-287--004D213C\n LoadResource@KERNEL32.DLL at 00019085-00003932-37014-293--004D256C\n FindResourceExW@KERNEL32.dll at 42973-311-000000010000DEC4\n LoadResource@KERNEL32.dll at 42973-317-000000010000DA94","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"pchgdage6182.exe\" read file \"%APPDATA%\\Microsoft\\Windows\\Libraries\\desktop.ini\"\n \"pchgdage6182.exe\" read file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"pchgdage6182.exe\" read file \"C:\\Users\\Public\\desktop.ini\"\n \"pchgdage6182.exe\" read file \"C:\\Users\\Public\\Documents\\desktop.ini\"\n \"pchgdage6182.exe\" read file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"pchgdage6182.exe\" read file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \"pchgdage6182.exe\" read file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"pchgdage6182.exe\" read file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"pchgdage6182.exe\" read file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"\n \"pchgdage6182.exe\" read file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"\n \"pchgdage6182.exe\" read file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"pchgdage6182.exe\" read file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"DISMHOST.EXE.5C938DA0.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$26","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"%TEMP%\\pchgdage6182.exe\" marked \"%APPDATA%\\Microsoft\\Windows\\Recent\\fastfuzzer.lnk\" for deletion\n \"%TEMP%\\pchgdage6182.exe\" marked \"%APPDATA%\\Microsoft\\Windows\\Recent\\fuzzer_winupdt.lnk\" for deletion\n \"%TEMP%\\pchgdage6182.exe\" marked \"%APPDATA%\\Microsoft\\Windows\\Recent\\slowfuzzer.lnk\" for deletion\n \"%TEMP%\\pchgdage6182.exe\" marked \"%APPDATA%\\Microsoft\\Windows\\Recent\\VxFuzzer-b7753aaeab5c87f441281cafa2cb8c70ade0420b.lnk\" for deletion\n \"%TEMP%\\pchgdage6182.exe\" marked \"%APPDATA%\\Microsoft\\Windows\\Recent\\VxFuzzer.lnk\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"C:\\7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125.exe\" with delete access\n \"pchgdage6182.exe\" opened \"%APPDATA%\\Microsoft\\Windows\\Recent\\fastfuzzer.lnk\" with delete access\n \"pchgdage6182.exe\" opened \"%APPDATA%\\Microsoft\\Windows\\Recent\\fuzzer_winupdt.lnk\" with delete access\n \"pchgdage6182.exe\" opened \"%APPDATA%\\Microsoft\\Windows\\Recent\\slowfuzzer.lnk\" with delete access\n \"pchgdage6182.exe\" opened \"%APPDATA%\\Microsoft\\Windows\\Recent\\VxFuzzer-b7753aaeab5c87f441281cafa2cb8c70ade0420b.lnk\" with delete access\n \"pchgdage6182.exe\" opened \"%APPDATA%\\Microsoft\\Windows\\Recent\\VxFuzzer.lnk\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"DISMHOST.EXE.5C938DA0.bin\" claimed CRC 141269 while the actual is CRC 1313544","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"SetSecurityDescriptorDacl\n GetDriveTypeW\n CreateFileMappingA\n GetFileAttributesW\n MapViewOfFileEx\n UnhandledExceptionFilter\n GetTempPathW\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryExW\n CreateThread\n ExitThread\n TerminateProcess\n GetModuleHandleExW\n LoadLibraryW\n GetVersionExW\n GetTickCount\n VirtualProtect\n GetStartupInfoW\n DeleteFileW\n FindFirstFileExA\n FindNextFileW\n FindNextFileA\n FindFirstFileExW\n GetProcAddress\n CreateFileW\n CreateFileA\n GetCommandLineW\n GetCommandLineA\n GetModuleHandleA\n GetModuleHandleW\n GetFileAttributesExW\n WriteFile\n CreateProcessW\n Sleep\n VirtualAlloc\n OutputDebugStringW\n OutputDebugStringA\n GetVersionExA\n MapViewOfFile\n CreateFileMappingW\n FindResourceExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"711171007a3b7000ab8b02007f950200fc8c0200729602006cc805001ecd6d007d266d00\" to virtual address \"0x76D807E4\" (part of module \"USER32.DLL\")\n \"pchgdage6182.exe\" wrote bytes \"711171007a3b7000ab8b02007f950200fc8c0200729602006cc805001ecd6d007d266d00\" to virtual address \"0x76D807E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"pchgdage6182.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125.bin\" (Offset: 522435)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"49/69 Antivirus vendors marked sample as malicious (71% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"49/69 Antivirus vendors marked sample as malicious (71% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"49/69 Antivirus vendors marked spawned process \"pchgdage6182.exe\" (PID: 2440) as malicious (classified as \"Trojan.Generic\" with 71% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\".exe\" wrote 32 bytes to a remote process \"%TEMP%\\pchgdage6182.exe\" (Handle: 188)\n \".exe\" wrote 52 bytes to a remote process \"%TEMP%\\pchgdage6182.exe\" (Handle: 188)\n \".exe\" wrote 4 bytes to a remote process \"%TEMP%\\pchgdage6182.exe\" (Handle: 188)\n \".exe\" wrote 8 bytes to a remote process \"%TEMP%\\pchgdage6182.exe\" (Handle: 188)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"pchgdage8080.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\".exe\" is creating a new process (Name: \"%TEMP%\\pchgdage8080.exe\", Handle: 156)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method)","origin":"File/Memory","mitre_attack_id":"T1055","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"pchgdage8080.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Scans for the windows taskbar (may be used for explorer injection)","description":"\"pchgdage8080.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-17","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"suspicious","category":"Network Related","name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.240.1/32, 192.168.240.26/32, 192.168.240.37/32, 192.168.240.38/31, 192.168.240.59/32, 192.168.240.66/32, 192.168.240.68/32, 192.168.240.73/32, 192.168.240.74/32, 192.168.240.76/32, 192.168.240.82/32, 192.168.240.84/31, 192.168.240.86/32, 192.168.240.88/32, 192.168.240.235/32, ...\"","origin":"Network Traffic","mitre_attack_id":"T1046","relevance":10,"id":"network-32","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate was explicitly revoked by its issuer. (0x800b010c)","origin":"Certificate Data","mitre_attack_id":"T1116","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$27","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"The input sample contains a known anti-VM trick"},{"detail":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]}]},"activity":{"stats":{"process_count":89,"spawned_processes_count":89,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":3,"imported_dlls_count":67,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":252,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["alma","almanahe","backdoor","botnet","chir","clop","criminal","crypt","cryptlocker","downloader","downloadsponsor","dropper","gael","genkryptik","kryptik","locker","lockergoga","neshta","ransomware","stealer","trojan","tufik","virut","zegost","zurgop"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"5c937f260388388a1556812b","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["USA"],"submit_name":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125.exe","analysis_start_time":"2019-03-21T12:01:16+00:00","indicators_count":{"informative":24,"suspicious":21,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true},{"id":"5c937f25028838279c94b3ce","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["USA"],"submit_name":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125.exe","analysis_start_time":"2019-03-21T12:16:15+00:00","indicators_count":{"informative":16,"suspicious":17,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"crl.sectigo.com","address":"151.139.128.10","ttl":134,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Sectigo Limited","registrar_name_servers":"NS1.AS48447.NET","registrar_creation_date":"2018-08-16T17:53:22+00:00","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"domain":"ocsp.sectigo.com","address":"23.219.160.58","ttl":3424,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Sectigo Limited","registrar_name_servers":"NS1.AS48447.NET","registrar_creation_date":"2018-08-16T17:53:22+00:00","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}],"processes":[{"pid":4152,"ppid":0,"name":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125.exe","command_line":"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"C:\\7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125.exe","uid":"00010187-00004152","icon":"$28"},{"pid":2132,"ppid":4152,"name":"pchgdage8080.exe","command_line":"-w","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010187-00004152","uid":"00010328-00002132"},{"pid":3944,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w Z:\\7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125.exe","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00013568-00003944"},{"pid":3516,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00013568-00003516"},{"pid":2404,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%PROGRAMFILES%\\7-Zip\\7-zip.chm\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00013907-00002404"},{"pid":3064,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00013909-00003064"},{"pid":3184,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d\\2d.x3d\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00014240-00003184"},{"pid":3156,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\nl-nl\\ui-strings.js\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00014243-00003156"},{"pid":4416,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\hu-hu\\ui-strings.js\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00014578-00004416"},{"pid":756,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\nb-no\\ui-strings.js\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00014579-00000756"},{"pid":3792,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\root\\ui-strings.js\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00014912-00003792"},{"pid":3984,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%COMMONPROGRAMFILES%\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00014916-00003984"},{"pid":3264,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%PROGRAMFILES%\\HNC\\Shared80\\Clipart\\CommonClipart\\TR_Road\\madang.ini\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00015131-00003264"},{"pid":3268,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%PROGRAMFILES%\\HNC\\Shared80\\Clipart\\CommonClipart\\TR_Rest\\madang.ini\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00015250-00003268"},{"pid":3232,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%PROGRAMFILES%\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00015259-00003232"},{"pid":3004,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%PROGRAMFILES%\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00015466-00003004"},{"pid":4296,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w %LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\ms\\FileSync.LocalizedResources.dll.mui","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00015583-00004296"},{"pid":2656,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\1F2HR9E2\\--10365204[1].gif\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00015597-00002656"},{"pid":4048,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0QPGGJBR\\11738[1].js\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00015798-00004048"},{"pid":3364,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\JKW6IVR1\\1.2.0.min[1].js\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00015915-00003364"},{"pid":4052,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\FX20RZHB\\-torba-yasa-resmi-gazete-de-yayimlandi-10367987[1].jpg\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00015937-00004052"},{"pid":3836,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w %LOCALAPPDATA%\\Programs\\Python\\Python36-32\\tcl\\tcl8\\8.6\\http-2.8.9.tm","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00016131-00003836"},{"pid":3608,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w %LOCALAPPDATA%\\Programs\\Python\\Python36-32\\tcl\\tcl8.6\\opt0.4\\optparse.tcl","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00016247-00003608"},{"pid":4424,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%PUBLIC%\\Videos\\Sample Videos\\Wildlife.wmv\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00016269-00004424"},{"pid":1000,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%PUBLIC%\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00016464-00001000"},{"pid":4700,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%PUBLIC%\\Pictures\\Sample Pictures\\Chrysanthemum.jpg\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00016577-00004700"},{"pid":4768,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%PUBLIC%\\Music\\Sample Music\\AlbumArtSmall.jpg\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00016605-00004768"},{"pid":4876,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w %PUBLIC%\\Libraries\\RecordedTV.library-ms","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00016798-00004876"},{"pid":4864,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w %USERPROFILE%\\ntuser.dat.LOG1","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00016911-00004864"},{"pid":4832,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%USERPROFILE%\\Searches\\Indexed Locations.search-ms\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00016966-00004832"},{"pid":4868,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%USERPROFILE%\\Favorites\\Windows Live\\Get Windows Live.url\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00017132-00004868"},{"pid":4740,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%USERPROFILE%\\Favorites\\MSN Websites\\MSN Autos.url\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00017242-00004740"},{"pid":4924,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%USERPROFILE%\\Favorites\\Microsoft Websites\\IE Add-on site.url\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00017309-00004924"},{"pid":5020,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%USERPROFILE%\\Favorites\\Links for United States\\GobiernoUSA.gov.url\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00017466-00005020"},{"pid":5028,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%USERPROFILE%\\Favorites\\Links\\Suggested Sites.url\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00017577-00005028"},{"pid":5164,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w %USERPROFILE%\\Downloads\\0dZxapFIdAxD.exe","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00017644-00005164"},{"pid":5016,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w %LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\mr\\FileSync.LocalizedResources.dll.mui","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00017801-00005016"},{"pid":5040,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w %USERPROFILE%\\Documents\\Database1.accdb","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00017909-00005040"},{"pid":5268,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00017977-00005268"},{"pid":5388,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%USERPROFILE%\\Documents\\hancom\\Hancom Office 2010 SE (English Edition) - 3PC-1User (Download) Keys.html\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00018137-00005388"},{"pid":5564,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%USERPROFILE%\\Documents\\Amazon Downloader Logs\\Amazon_Downloader_Log_20171206-225712_1810e9e0-1a8d-457c-be3a-737de50dc6bb.txt\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00018243-00005564"},{"pid":5556,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w %USERPROFILE%\\Contacts\\%OSUSER%.contact","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00018310-00005556"},{"pid":5604,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Wireshark\\recent","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00018470-00005604"},{"pid":5240,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Mozilla\\Firefox\\profiles.ini","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00018589-00005240"},{"pid":5124,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\addonStartup.json.lz4","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00018645-00005124"},{"pid":5808,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00018802-00005808"},{"pid":5776,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\storage\\default\\https+++my.visualstudio.com\\.metadata-v2","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00018921-00005776"},{"pid":5084,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\storage\\default\\https+++my.visualstudio.com\\idb\\301792106ttes.sqlite","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00018984-00005084"},{"pid":5192,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\storage\\default\\about+newtab\\idb\\3312185054sbndi_pspte.sqlite","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00019135-00005192"},{"pid":5144,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\storage\\default\\about+newtab\\idb\\3312185054sbndi_pspte.files\\2","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00019253-00005144"},{"pid":5228,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\sessionstore-backups\\previous.jsonlz4","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00019316-00005228"},{"pid":2732,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\gmp-widevinecdm\\1.4.8.1008\\LICENSE.txt","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00019486-00002732"},{"pid":2704,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\gmp-gmpopenh264\\1.7.1\\gmpopenh264.info","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00019588-00002704"},{"pid":2328,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\datareporting\\session-state.json","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00019651-00002328"},{"pid":5660,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\datareporting\\archived\\2019-02\\1549034870597.ef6d52dc-f84f-4f9d-90f2-3beba78f3e8e.main.jsonlz4","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00019821-00005660"},{"pid":5244,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\datareporting\\archived\\2018-07\\1531823570744.7d424ee4-2785-40d9-b236-29bbec47087e.main.jsonlz4","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00019925-00005244"},{"pid":5000,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\crashes\\store.json.mozlz4","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00019989-00005000"},{"pid":2652,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\blocklists\\addons.json","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00020154-00002652"},{"pid":5924,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Microsoft\\Windows Photo Viewer\\Windows Photo Viewer Wallpaper.jpg\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00020258-00005924"},{"pid":5356,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00020324-00005356"},{"pid":5480,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00020488-00005480"},{"pid":2372,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00020594-00002372"},{"pid":5332,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Microsoft\\Windows\\Libraries\\Documents.library-ms","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00020661-00005332"},{"pid":5488,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Microsoft\\Windows\\Cookies\\013SKKWU.txt","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00020825-00005488"},{"pid":5440,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%COMMONPROGRAMFILES%\\microsoft shared\\ink\\sr-Latn-CS\\tipresx.dll.mui\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00020926-00005440"},{"pid":5484,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w %LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\mn\\FileSync.LocalizedResources.dll.mui","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00020995-00005484"},{"pid":6060,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w %LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\ml-in\\FileSync.LocalizedResources.dll.mui","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00021161-00006060"},{"pid":5900,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Microsoft\\Templates\\LiveContent\\Managed\\SmartArt Graphics\\1033\\TM01793888[[fn=Architecture]].glox\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00021269-00005900"},{"pid":5888,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Microsoft\\Templates\\LiveContent\\Managed\\Document Themes\\1033\\TM01790490[[fn=Decatur]].thmx\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00021329-00005888"},{"pid":5984,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Microsoft\\Protect\\S-1-5-21-2092356043-4041700817-663127204-1001\\65622a90-4702-4320-ac8c-2e34346853f9","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00021502-00005984"},{"pid":6072,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Microsoft\\Outlook\\Outlook.srs","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00021602-00006072"},{"pid":6084,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Microsoft\\Office\\MSO1033.acl","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00021659-00006084"},{"pid":5972,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Microsoft\\MMC\\taskschd","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00021843-00005972"},{"pid":5272,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Microsoft\\Internet Explorer\\Internet Explorer Wallpaper.bmp\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00021937-00005272"},{"pid":5312,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ro-ro\\ui-strings.js\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00021996-00005312"},{"pid":5608,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%COMMONPROGRAMFILES%\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00022174-00005608"},{"pid":5452,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w %LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\mk\\FileSync.LocalizedResources.dll.mui","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00022269-00005452"},{"pid":5752,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w %LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\mi-nz\\FileSync.LocalizedResources.dll.mui","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00022329-00005752"},{"pid":5708,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00022510-00005708"},{"pid":5504,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Microsoft\\Access\\AccessCache.accdb","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00022602-00005504"},{"pid":5692,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\airappinstaller\\airappinstaller.exe\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00022669-00005692"},{"pid":5060,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00022847-00005060"},{"pid":6096,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#www.toshiba.com\\settings.sol\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00022934-00006096"},{"pid":6092,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#bleacherreport.com\\settings.sol\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00023009-00006092"},{"pid":6132,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w \"%COMMONPROGRAMFILES%\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00023190-00006132"},{"pid":2228,"ppid":2132,"name":"pchgdage8080.exe","command_line":"-w %LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\lv\\FileSync.LocalizedResources.dll.mui","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00023274-00002228"},{"pid":6140,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\Macromedia\\Flash Player\\#SharedObjects\\MU9EJJ9F\\bleacherreport.com\\vendor\\akamai\\amp.premier\\AkamaiPremierPlayer.swf\\akamaipremierplayer.userData.sol\"","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00023342-00006140"},{"pid":5628,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\HNC\\User\\Shared90\\HwpTemplate\\Doc\\ENU\\Normal90.hwt","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00023522-00005628"},{"pid":5600,"ppid":2132,"name":"pchgdage8080.exe","command_line":"%APPDATA%\\HNC\\User\\Shared80\\HwpTemplate\\Doc\\ENU\\Normal80.hwt","sha256":"7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125","normalized_path":"%TEMP%\\pchgdage8080.exe","parent_uid":"00010328-00002132","uid":"00023605-00005600"}],"all_imported_dlls":["uxtheme.dll","linkinfo.dll","dui70.dll","version.dll","devrtl.dll","wow64.dll","kernel32.dll","api-ms-win-core-synch-l1-2-0.dll","duser.dll","cryptsp.dll","apphelp.dll","setupapi.dll","xmllite.dll","DismProv.dll","msctf.dll","Wldap32.dll","profapi.dll","wdscore.dll","msvcrt.dll","lpk.dll","imm32.dll","propsys.dll","dbghelp.dll","KernelBase.dll","ntmarta.dll","dwmapi.dll","cscapi.dll","DrUpdate.dll","wow64cpu.dll","usp10.dll","oleaut32.dll","slc.dll","DismCorePS.dll","SSShim.dll","ntdll.dll","SearchFolder.dll","ExplorerFrame.dll","OSProvider.dll","shlwapi.dll","ole32.dll","cfgmgr32.dll","shellstyle.dll","drvstore.dll","sechost.dll","comctl32.dll","wow64win.dll","shell32.dll","RpcRtRemote.dll","oleacc.dll","oleaccrc.dll","LogProvider.dll","DmiProvider.dll","user32.dll","advapi32.dll","rpcrt4.dll","cryptbase.dll","rsaenh.dll","clbcatq.dll","devobj.dll","CbsCore.dll","mpr.dll","SPInf.dll","gdi32.dll","sspicli.dll","ntshrui.dll","srvcli.dll","rpcss.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"DISMHOST.EXE.5C938DA0.bin","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"name":"dism.log","sha256":"b443dd19393926a395702a7aee27efd9f7312e932f26ce835bc09a03a663c952","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"name":"READ-ME-NOW.txt","sha256":"108299b515b525b9f004700c63766452a42687f5dd6c3c6b2def6ddfac3a80c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]}],"files_written":[{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%TEMP%\\pchgdage6182.exe","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\Database1.lnk","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000019.db","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Libraries\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Libraries","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Libraries\\Documents.library-ms","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\Users\\Public","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PUBLIC%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Searches\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Contacts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Downloads\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Saved Games\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Documents\\Database1.accdb","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%USERPROFILE%\\Downloads\\VxFuzzer-b7753aaeab5c87f441281cafa2cb8c70ade0420b","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%USERPROFILE%\\Downloads\\VxFuzzer-b7753aaeab5c87f441281cafa2cb8c70ade0420b\\fastfuzzer.au3","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%USERPROFILE%\\Downloads","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%WINDIR%\\Resources\\Themes\\Aero\\Shell\\NormalColor\\shellstyle.dll","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%WINDIR%\\SysWOW64\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\oleaccrc.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\fuzzer_winupdt.log","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\Local Disk (C).lnk","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%USERPROFILE%\\Desktop\\VxFuzzer","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Desktop\\VxFuzzer\\slowfuzzer.au3","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Desktop","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PUBLIC%\\Desktop","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PUBLIC%\\Desktop\\VxFuzzer","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%WINDIR%\\TEMP\\FEA2231A-27B2-4439-B1B8-588818E82C04\\en-US\\dismhost.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%WINDIR%\\TEMP\\FEA2231A-27B2-4439-B1B8-588818E82C04\\en\\dismhost.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%WINDIR%\\System32\\kernel32.dll","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"C:\\BVTBin\\Tests\\installpackage\\csilogfile.log","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%WINDIR%\\Logs\\DISM\\dism.log","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%WINDIR%\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.23505_none_681aa442f6fed7f0\\CbsCore.dll","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%WINDIR%\\Temp\\FEA2231A-27B2-4439-B1B8-588818E82C04\\en-US\\DmiProvider.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%WINDIR%\\inf\\oem10.inf","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%WINDIR%\\System32\\DriverStore\\FileRepository\\vboxvideo.inf_amd64_neutral_9bc3c1389d21f9ef\\VBoxVideo.inf","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%WINDIR%\\System32\\DriverStore\\FileRepository\\vboxvideo.inf_amd64_neutral_9bc3c1389d21f9ef\\vboxvideo.PNF","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%WINDIR%\\inf\\oem9.inf","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\READ-ME-NOW.txt","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\share\\READ-ME-NOW.txt","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\$Recycle.Bin","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"C:\\Documents and Settings","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\found.000","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"C:\\found.000\\dir0000.chk","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"C:\\MSOCache","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\MSOCache\\All Users","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"C:\\PerfLogs","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\PerfLogs\\Admin","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\7-Zip","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"},{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Common Files","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%COMMONPROGRAMFILES%\\DESIGNER","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ClickToRun","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\DW","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION\\1033","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EURO","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Filters","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Help","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ar-SA","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\bg-BG","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"path":"%TEMP%\\pchgdage8080.exe","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\All Control Panel Items.lnk","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\Appearance and Personalization.lnk","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PUBLIC%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Downloads\\desktop.jpg","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%WINDIR%\\System32\\en-US\\oleaccrc.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\Downloads.lnk","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\Network and Internet.lnk","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\System and Security.lnk","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Esl","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\ENU","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\locales","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AIR","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Browser","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Browser\\WCChromeExtn","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\IDTemplates","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\IDTemplates\\ENU","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Javascripts","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Legal","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Legal\\ENU","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Locale","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Locale\\en_US","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\AcroForm","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\AcroForm\\PMP","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\ENU","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Multimedia","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Multimedia\\MPP","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\pi_brokers","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d\\prc","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Tracker","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%SAMPLEDIR%\\7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125.exe.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\7-zip.chm.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\nl-nl\\ui-strings.js.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d\\2d.x3d.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\hu-hu\\ui-strings.js.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\nb-no\\ui-strings.js.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\root\\ui-strings.js.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Clipart\\CommonClipart\\TR_Road\\madang.ini.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Clipart\\CommonClipart\\TR_Rest\\madang.ini.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\ms\\FileSync.LocalizedResources.dll.mui.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\1F2HR9E2\\--10365204[1].gif.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0QPGGJBR\\11738[1].js.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\JKW6IVR1\\1.2.0.min[1].js.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\FX20RZHB\\-torba-yasa-resmi-gazete-de-yayimlandi-10367987[1].jpg.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%LOCALAPPDATA%\\Programs\\Python\\Python36-32\\tcl\\tcl8\\8.6\\http-2.8.9.tm.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%LOCALAPPDATA%\\Programs\\Python\\Python36-32\\tcl\\tcl8.6\\opt0.4\\optparse.tcl.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\Wildlife.wmv.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PUBLIC%\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\AlbumArtSmall.jpg.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PUBLIC%\\Libraries\\RecordedTV.library-ms.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG1.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\Get Windows Live.url.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSN Autos.url.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\IE Add-on site.url.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\GobiernoUSA.gov.url.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Suggested Sites.url.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Downloads\\0dZxapFIdAxD.exe.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\mr\\FileSync.LocalizedResources.dll.mui.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Documents\\Database1.accdb.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Documents\\hancom\\Hancom Office 2010 SE (English Edition) - 3PC-1User (Download) Keys.html.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Documents\\Amazon Downloader Logs\\Amazon_Downloader_Log_20171206-225712_1810e9e0-1a8d-457c-be3a-737de50dc6bb.txt.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%USERPROFILE%\\Contacts\\%OSUSER%.contact.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Wireshark\\recent.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\profiles.ini.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\addonStartup.json.lz4.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\storage\\default\\https+++my.visualstudio.com\\.metadata-v2.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\storage\\default\\https+++my.visualstudio.com\\idb\\301792106ttes.sqlite.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\storage\\default\\about+newtab\\idb\\3312185054sbndi_pspte.sqlite.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\storage\\default\\about+newtab\\idb\\3312185054sbndi_pspte.files\\2.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\sessionstore-backups\\previous.jsonlz4.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\gmp-widevinecdm\\1.4.8.1008\\LICENSE.txt.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\gmp-gmpopenh264\\1.7.1\\gmpopenh264.info.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\datareporting\\session-state.json.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\datareporting\\archived\\2019-02\\1549034870597.ef6d52dc-f84f-4f9d-90f2-3beba78f3e8e.main.jsonlz4.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\datareporting\\archived\\2018-07\\1531823570744.7d424ee4-2785-40d9-b236-29bbec47087e.main.jsonlz4.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\crashes\\store.json.mozlz4.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\blocklists\\addons.json.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\Windows Photo Viewer\\Windows Photo Viewer Wallpaper.jpg.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Libraries\\Documents.library-ms.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\013SKKWU.txt.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\ink\\sr-Latn-CS\\tipresx.dll.mui.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\mn\\FileSync.LocalizedResources.dll.mui.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\ml-in\\FileSync.LocalizedResources.dll.mui.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\LiveContent\\Managed\\SmartArt Graphics\\1033\\TM01793888[[fn=Architecture]].glox.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\LiveContent\\Managed\\Document Themes\\1033\\TM01790490[[fn=Decatur]].thmx.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\Protect\\S-1-5-21-2092356043-4041700817-663127204-1001\\65622a90-4702-4320-ac8c-2e34346853f9.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\Outlook\\Outlook.srs.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\Office\\MSO1033.acl.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\MMC\\taskschd.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Internet Explorer Wallpaper.bmp.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\nls\\ro-ro\\ui-strings.js.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\mk\\FileSync.LocalizedResources.dll.mui.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\mi-nz\\FileSync.LocalizedResources.dll.mui.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Microsoft\\Access\\AccessCache.accdb.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\airappinstaller\\airappinstaller.exe.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#www.toshiba.com\\settings.sol.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#bleacherreport.com\\settings.sol.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\lv\\FileSync.LocalizedResources.dll.mui.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\#SharedObjects\\MU9EJJ9F\\bleacherreport.com\\vendor\\akamai\\amp.premier\\AkamaiPremierPlayer.swf\\akamaipremierplayer.userData.sol.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\HNC\\User\\Shared90\\HwpTemplate\\Doc\\ENU\\Normal90.hwt.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]},{"path":"%APPDATA%\\HNC\\User\\Shared80\\HwpTemplate\\Doc\\ENU\\Normal80.hwt.locked","sources":[{"report_type":"sandbox","report_id":"5c937f25028838279c94b3ce"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\Global\\WdsSetupLogInit","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"name":"\\BaseNamedObjects\\Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]},{"name":"\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5c937f260388388a1556812b"}]}]}},"report_ids":{"sandbox_job_ids":["5c937f260388388a1556812b","5c937f25028838279c94b3ce"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 7852b47e7a9e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7852b47e7a9e…. Malware family: Trojan.Generic. Threat score 100/100. 23/29 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 7852b47e7a9e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7852b47e7a9e…. Malware family: Trojan.Generic. Threat score 100/100. 23/29 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 7852b47e7a9e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7852b47e7a9e…. Malware family: Trojan.Generic. Threat score 100/100. 23/29 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]