21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T47f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Crypren Sample 7bcd69b30851… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7bcd69b30851…. Malware family: Trojan.Crypren. Threat score 100/100. 26/29 AV engines flagged this file. 8 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","keywords":["Malicious","Trojan.Crypren","malware analysis","sandbox report","threat intelligence","7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Crypren","antivirusDetections":{"malicious":26,"total":29},"behavioralIndicators":{"malicious":8,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:Td55,"zzbdrimp6701.exe" queries volume information of "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml" at 00010164-00003096-0000010C-23621407487 "zzbdrimp6701.exe" queries volume information of "C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml" at 00010164-00003096-0000010C-23997762230 "zzbdrimp6701.exe" queries volume information of "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml" at 00010164-00003096-0000010C-24450393986 "zzbdrimp6701.exe" queries volume information of "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml" at 00010164-00003096-0000010C-24631721950 "zzbdrimp6701.exe" queries volume information of "C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml" at 00010164-00003096-0000010C-24820406330 "zzbdrimp6701.exe" queries volume information of "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml" at 00010164-00003096-0000010C-24990577596 "zzbdrimp6701.exe" queries volume information of "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml" at 00010164-00003096-0000010C-25293676396 "zzbdrimp6701.exe" queries volume information of "C:\MSOCache\All Users\{91140000-0012-0000-0000-0000000FF1CE}-C\StandardrWW.xml" at 00010164-00003096-0000010C-25557436210 "zzbdrimp6701.exe" queries volume information of "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab" at 00010164-00003096-0000010C-25915175036 "zzbdrimp6701.exe" queries volume information of "C:\MSOCache\All Users\{91140000-0012-0000-0000-0000000FF1CE}-C\OWOW64WW.cab" at 00010164-00003096-0000010C-33683112818 "zzbdrimp6701.exe" queries volume information of "C:\MSOCache\All Users\{91140000-0012-0000-0000-0000000FF1CE}-C\StandardrWW.msi" at 00010164-00003096-0000010C-39126656667 "zzbdrimp6701.exe" queries volume information of "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml" at 00010171-00001344-0000010C-23527723431 "zzbdrimp6701.exe" queries volume information of "C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml" at 00010171-00001344-0000010C-23650100477 "zzbdrimp6701.exe" queries volume information of "C:\MSOCache\All Users\{91140000-0012-0000-0000-0000000FF1CE}-C\Setup.xml" at 00010171-00001344-0000010C-23850804721 "zzbdrimp6701.exe" queries volume information of "C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml" at 00010171-00001344-0000010C-24469539992 "zzbdrimp6701.exe" queries volume information of "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml" at 00010171-00001344-0000010C-24612913388 "zzbdrimp6701.exe" queries volume information of "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml" at 00010171-00001344-0000010C-24749792385 "zzbdrimp6701.exe" queries volume information of "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml" at 00010171-00001344-0000010C-24860670163 "zzbdrimp6701.exe" queries volume information of "C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml" at 00010171-00001344-0000010C-25019365882 "zzbdrimp6701.exe" queries volume information of "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml" at 00010171-00001344-0000010C-2517677991623:T5d3,"\Sessions\1\BaseNamedObjects\MX-zzbdrimp" "MX-zzbdrimp" "\Sessions\1\BaseNamedObjects\DBWinMutex" "\Sessions\1\BaseNamedObjects\Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" "\Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0001" "\Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0005" "\Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0006" "\Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0010" "\Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0013" "\Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0016" "\Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0020" "\Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0023" "\Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0026" "\Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" "\Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0004" "Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0026" "Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" "Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0010" "Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0023"24:T7c1,Spawned process "cmd.exe" with commandline "/c move /y C:\7bcd69b3085126f7e97406889f78ab74e87230c11812b79406 ..." (UID: 00010013-00003660) Spawned process "zzbdrimp6701.exe" with commandline "-m" (UID: 00010026-00001068) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00010164-00003096) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00010171-00001344) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00010177-00001664) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00010755-00004024) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00011130-00003936) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00012149-00002564) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00012309-00003252) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00012604-00002980) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00012836-00003136) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00012986-00003944) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00013205-00003104) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00013427-00003116) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00013551-00002792) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00013803-00003068) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00014024-00004092) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00014265-00000968) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00014460-00003308) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00014770-00001284)25:T7c1,Spawned process "cmd.exe" with commandline "/c move /y C:\7bcd69b3085126f7e97406889f78ab74e87230c11812b79406 ..." (UID: 00010013-00003660) Spawned process "zzbdrimp6701.exe" with commandline "-m" (UID: 00010026-00001068) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00010164-00003096) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00010171-00001344) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00010177-00001664) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00010755-00004024) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00011130-00003936) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00012149-00002564) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00012309-00003252) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00012604-00002980) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00012836-00003136) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00012986-00003944) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00013205-00003104) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00013427-00003116) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00013551-00002792) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00013803-00003068) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00014024-00004092) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00014265-00000968) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00014460-00003308) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00014770-00001284)26:T76a,"zzbdrimp6701.exe" queried SystemProcessInformation at 00010164-00003096-00000105-23622463201 "zzbdrimp6701.exe" queried SystemProcessInformation at 00010164-00003096-00000105-23623201533 "zzbdrimp6701.exe" queried SystemProcessInformation at 00010164-00003096-00000105-23999503344 "zzbdrimp6701.exe" queried SystemProcessInformation at 00010164-00003096-00000105-24000473650 "zzbdrimp6701.exe" queried SystemProcessInformation at 00010164-00003096-00000105-24451803618 "zzbdrimp6701.exe" queried SystemProcessInformation at 00010164-00003096-00000105-24452896222 "zzbdrimp6701.exe" queried SystemProcessInformation at 00010164-00003096-00000105-24632826045 "zzbdrimp6701.exe" queried SystemProcessInformation at 00010164-00003096-00000105-24633634479 "zzbdrimp6701.exe" queried SystemProcessInformation at 00010164-00003096-00000105-24822380997 "zzbdrimp6701.exe" queried SystemProcessInformation at 00010164-00003096-00000105-24823364343 "zzbdrimp6701.exe" queried SystemProcessInformation at 00010164-00003096-00000105-24991938206 "zzbdrimp6701.exe" queried SystemProcessInformation at 00010164-00003096-00000105-24993149942 "zzbdrimp6701.exe" queried SystemProcessInformation at 00010164-00003096-00000105-25295273352 "zzbdrimp6701.exe" queried SystemProcessInformation at 00010164-00003096-00000105-25296215003 "zzbdrimp6701.exe" queried SystemProcessInformation at 00010164-00003096-00000105-25558632678 "zzbdrimp6701.exe" queried SystemProcessInformation at 00010164-00003096-00000105-25559423497 "zzbdrimp6701.exe" queried SystemProcessInformation at 00010164-00003096-00000105-25916610190 "zzbdrimp6701.exe" queried SystemProcessInformation at 00010164-00003096-00000105-25917939184 "zzbdrimp6701.exe" queried SystemProcessInformation at 00010164-00003096-00000105-33684135120 "zzbdrimp6701.exe" queried SystemProcessInformation at 00010164-00003096-00000105-3368535426627:T932,Found dropped filename "org-netbeans-modules-sampler.jar.locked" which has been seen in the context of ransomware (Indicator: .Locked) Found dropped filename "DW20.EXE.locked" which has been seen in the context of ransomware (Indicator: .Locked) Found dropped filename "Flow2_01.PNG.locked" which has been seen in the context of ransomware (Indicator: .Locked) Found dropped filename "org-netbeans-core-multiview.jar.locked" which has been seen in the context of ransomware (Indicator: .Locked) Found dropped filename "Stone_11.PNG.locked" which has been seen in the context of ransomware (Indicator: .Locked) Found dropped filename "ArroG_09.drt.locked" which has been seen in the context of ransomware (Indicator: .Locked) Found dropped filename "Petal9.png.locked" which has been seen in the context of ransomware (Indicator: .Locked) Found dropped filename "Spring8.png.locked" which has been seen in the context of ransomware (Indicator: .Locked) Found dropped filename "Piece9.png.locked" which has been seen in the context of ransomware (Indicator: .Locked) Found dropped filename "FruV2_04.PNG.locked" which has been seen in the context of ransomware (Indicator: .Locked) Found dropped filename "org-openide-nodes_zh_CN.jar.locked" which has been seen in the context of ransomware (Indicator: .Locked) Found dropped filename "BD14981_.GIF.locked" which has been seen in the context of ransomware (Indicator: .Locked) Found dropped filename "MSPUB.HXS.locked" which has been seen in the context of ransomware (Indicator: .Locked) Found dropped filename "FD02115_.WMF.locked" which has been seen in the context of ransomware (Indicator: .Locked) Found dropped filename "green03.png.locked" which has been seen in the context of ransomware (Indicator: .Locked) Found dropped filename "Icon1_13.drt.locked" which has been seen in the context of ransomware (Indicator: .Locked) Found dropped filename "Trip2.png.locked" which has been seen in the context of ransomware (Indicator: .Locked) Found dropped filename "ThinA_17.PNG.locked" which has been seen in the context of ransomware (Indicator: .Locked) Found dropped filename "madang.ini.locked" which has been seen in the context of ransomware (Indicator: .Locked) Found dropped filename "Shoes_09.drt.locked" which has been seen in the context of ransomware (Indicator: .Locked)28:T9bd,"zzbdrimp6701.exe" opened "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml" with delete access "zzbdrimp6701.exe" opened "C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml" with delete access "zzbdrimp6701.exe" opened "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access "zzbdrimp6701.exe" opened "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml" with delete access "zzbdrimp6701.exe" opened "C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml" with delete access "zzbdrimp6701.exe" opened "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access "zzbdrimp6701.exe" opened "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access "zzbdrimp6701.exe" opened "C:\MSOCache\All Users\{91140000-0012-0000-0000-0000000FF1CE}-C\StandardrWW.xml" with delete access "zzbdrimp6701.exe" opened "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab" with delete access "zzbdrimp6701.exe" opened "C:\MSOCache\All Users\{91140000-0012-0000-0000-0000000FF1CE}-C\OWOW64WW.cab" with delete access "zzbdrimp6701.exe" opened "C:\MSOCache\All Users\{91140000-0012-0000-0000-0000000FF1CE}-C\StandardrWW.msi" with delete access "zzbdrimp6701.exe" opened "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml" with delete access "zzbdrimp6701.exe" opened "C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml" with delete access "zzbdrimp6701.exe" opened "C:\MSOCache\All Users\{91140000-0012-0000-0000-0000000FF1CE}-C\Setup.xml" with delete access "zzbdrimp6701.exe" opened "C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml" with delete access "zzbdrimp6701.exe" opened "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access "zzbdrimp6701.exe" opened "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml" with delete access "zzbdrimp6701.exe" opened "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.xml" with delete access "zzbdrimp6701.exe" opened "C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access "zzbdrimp6701.exe" opened "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml" with delete access29:T1ce2,43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 1068) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3096) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 1344) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 1664) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 4024) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3936) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 2564) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3252) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 2980) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3136) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3944) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3104) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3116) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 2792) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3068) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 4092) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 968) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3308) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 1284) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3220) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3000) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3140) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3960) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 112) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 2788) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3208) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3660) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 1784) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 1044) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3336) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 1360) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3888) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3972) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3620) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 2352) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3520) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3488) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 1740) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 1376) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 1056) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 480) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3088) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 4012) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3652) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 2208) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3560) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 2740) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3728) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 108) as malicious (classified as "Trojan.Ransom" with 65% detection rate) 43/66 Antivirus vendors marked spawned process "zzbdrimp6701.exe" (PID: 3004) as malicious (classified as "Trojan.Ransom" with 65% detection rate)2a:T5dc,".exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\zzbdrimp6701.exe" (Handle: 252) ".exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\zzbdrimp6701.exe" (Handle: 252) ".exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\zzbdrimp6701.exe" (Handle: 252) "zzbdrimp6701.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\zzbdrimp6701.exe" (Handle: 312) "zzbdrimp6701.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\zzbdrimp6701.exe" (Handle: 312) "zzbdrimp6701.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\zzbdrimp6701.exe" (Handle: 312) "zzbdrimp6701.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\zzbdrimp6701.exe" (Handle: 320) "zzbdrimp6701.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\zzbdrimp6701.exe" (Handle: 320) "zzbdrimp6701.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\zzbdrimp6701.exe" (Handle: 320) "zzbdrimp6701.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\zzbdrimp6701.exe" (Handle: 316) "zzbdrimp6701.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\zzbdrimp6701.exe" (Handle: 316) "zzbdrimp6701.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\zzbdrimp6701.exe" (Handle: 316)2b:T1466,Spawned process ".exe" (UID: 00009877-00002272) Spawned process "cmd.exe" with commandline "/c move /y C:\7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26.exe %TEMP%\zzbdrimp6701.exe" (UID: 00010013-00003660) Spawned process "zzbdrimp6701.exe" with commandline "-m" (UID: 00010026-00001068) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00010164-00003096) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00010171-00001344) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00010177-00001664) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00010755-00004024) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00011130-00003936) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00012149-00002564) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00012309-00003252) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00012604-00002980) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00012836-00003136) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00012986-00003944) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00013205-00003104) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00013427-00003116) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00013551-00002792) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00013803-00003068) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00014024-00004092) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00014265-00000968) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00014460-00003308) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00014770-00001284) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00014937-00003220) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00015183-00003000) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00015372-00003140) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00015528-00003960) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00015788-00000112) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00016008-00002788) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00016189-00003208) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00016664-00003660) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00016912-00001784) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00017133-00001044) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00017322-00003336) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00017839-00001360) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00018178-00003888) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00018424-00003972) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00018560-00003620) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00018853-00002352) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00019116-00003520) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00019264-00003488) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00019491-00001740) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00019999-00001376) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00020217-00001056) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00020439-00000480) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00020784-00003088) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00020982-00004012) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00021140-00003652) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00021418-00002208) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00021809-00003560) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00022123-00002740) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00022320-00003728) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00022688-00000108) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00022971-00003004) Spawned process "zzbdrimp6701.exe" with commandline "-i SM-zzbdrimp -s" (UID: 00023225-00003624)2c:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790335301602,"unified_at":"2026-09-25T11:21:41.602Z","metadata":{"hashes":{"sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","sha1":"b2a701225c8c7f839be3c5009d52b4421063d93e","md5":"7e3f8b6b7ac0565bfcbf0a1e3e6fcfbc","sha512":"20e47f1bce3635c43816c806e5ffdf349ed07c2dd65b5f4e025a3a1343121932f6537ecc7028d842775e9cbeef6ba8110dee8ce0b6dc25dc63772cd840d62e59","ssdeep":"24576:VnJVtmfwkmE2j2uD3bMUPMGOc0dfe3WuEK2/0vPY0uZTp+Xksy:jVtmfwkmE2jrcHdfelcYPMZTp+Xksy","ssdeep_chunks":["24576:VnJVtmf","24576:nJVtmfw","24576:JVtmfwk","24576:Vtmfwkm","24576:tmfwkmE","24576:mfwkmE2","24576:fwkmE2j","24576:wkmE2j2","24576:kmE2j2u","24576:mE2j2uD","24576:E2j2uD3","24576:2j2uD3b","24576:j2uD3bM","24576:2uD3bMU","24576:uD3bMUP","24576:D3bMUPM","24576:3bMUPMG","24576:bMUPMGO","24576:MUPMGOc","24576:UPMGOc0","24576:PMGOc0d","24576:MGOc0df","24576:GOc0dfe","24576:Oc0dfe3","24576:c0dfe3W","24576:0dfe3Wu","24576:dfe3WuE","24576:fe3WuEK","24576:e3WuEK2","24576:3WuEK2/","24576:WuEK2/0","24576:uEK2/0v","24576:EK2/0vP","24576:K2/0vPY","24576:2/0vPY0","24576:/0vPY0u","24576:0vPY0uZ","24576:vPY0uZT","24576:PY0uZTp","24576:Y0uZTp+","24576:0uZTp+X","24576:uZTp+Xk","24576:ZTp+Xks","24576:Tp+Xksy","49152:VnJVtmf","49152:nJVtmfw","49152:JVtmfwk","49152:Vtmfwkm","49152:tmfwkmE","49152:mfwkmE2","49152:fwkmE2j","49152:wkmE2j2","49152:kmE2j2u","49152:mE2j2uD","49152:E2j2uD3","49152:2j2uD3b","49152:j2uD3bM","49152:2uD3bMU","49152:uD3bMUP","49152:D3bMUPM","49152:3bMUPMG","49152:bMUPMGO","49152:MUPMGOc","49152:UPMGOc0","49152:PMGOc0d","49152:MGOc0df","49152:GOc0dfe","49152:Oc0dfe3","49152:c0dfe3W","49152:0dfe3Wu","49152:dfe3WuE","49152:fe3WuEK","49152:e3WuEK2","49152:3WuEK2/","49152:WuEK2/0","49152:uEK2/0v","49152:EK2/0vP","49152:K2/0vPY","49152:2/0vPY0","49152:/0vPY0u","49152:0vPY0uZ","49152:vPY0uZT","49152:PY0uZTp","49152:Y0uZTp+","49152:0uZTp+X","49152:uZTp+Xk","49152:ZTp+Xks","49152:Tp+Xksy","24576:jVtmfwk","24576:wkmE2jr","24576:kmE2jrc","24576:mE2jrcH","24576:E2jrcHd","24576:2jrcHdf","24576:jrcHdfe","24576:rcHdfel","24576:cHdfelc","24576:HdfelcY","24576:dfelcYP","24576:felcYPM","24576:elcYPMZ","24576:lcYPMZT","24576:cYPMZTp","24576:YPMZTp+","24576:PMZTp+X","24576:MZTp+Xk"],"imphash":"39a85c613973fb6d8d786a3deb3c0666"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1249144,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1553147686000,"last_seen":1693915283000,"last_multi_scan":1693915283000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["clop","criminal","downloadsponsor","genkryptik","kryptik","locker","lockergoga","neshta","ransomware","stealer","zurgop","rietspoof"]},"stats":{"av":{"malicious_count":26,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":10},"sandbox_signatures":{"informative_count":15,"suspicious_count":13,"malicious_count":8,"total":36},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypren.tpXh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Alisa.Exp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Crypren","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/LockerGoga.qvkng","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.CAH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Ransomware.Lockergoga-6918486-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"MalCert.A (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.LockerGoga.D trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/LockerGoga.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00549b471 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Crypren.afeu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransom-O.l","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypren.fofvue","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-FHG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.LockerGoga.1249144","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom.8F9672D2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom.8F9672D2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/LockerGoga.C.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.BIP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanRansom.Crypren","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Crypren.Win32.877","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Crypren","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1116","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Monitors specific registry key for changes"}],"sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"tactic":"Discovery","technique":"Network Service Scanning","attack_id":"T1046","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1046","identifiers":[{"type":"suspicious","value":"Detected increased number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00009877-00002272-47671-2-00B0A82B","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$22","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"crl.sectigo.com\"\n \"ocsp.sectigo.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$23","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c move /y C:\\7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26.exe %TEMP%\\zzbdrimp6701.exe\" on 2019-3-21.13:01:14.945","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$24","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$25","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Sectigo RSA Code Signing CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: AC:B3:8D:45:10:8C:4F:0C:88:94:04:06:46:13:7C:95:E9:BB:39:D8; see report for more information)\n The input sample is signed with a certificate issued by \"CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE\" (SHA1: EA:B0:40:68:9A:0D:80:5B:5D:6F:D6:54:FC:16:8C:FF:00:B7:8B:E3; see report for more information)\n The input sample is signed with a certificate issued by \"CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US\" (SHA1: 94:C9:5D:A1:E8:50:BD:85:20:9A:4A:2A:F3:E1:FB:16:04:F9:BB:66; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1116","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"zzbdrimp6701.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"org-netbeans-modules-sampler.jar.locked\" has type \"data\"\n \"DW20.EXE.locked\" has type \"data\"\n \"Flow2_01.PNG.locked\" has type \"data\"\n \"org-netbeans-core-multiview.jar.locked\" has type \"data\"\n \"Stone_11.PNG.locked\" has type \"data\"\n \"ArroG_09.drt.locked\" has type \"data\"\n \"Petal9.png.locked\" has type \"data\"\n \"Spring8.png.locked\" has type \"data\"\n \"Piece9.png.locked\" has type \"data\"\n \"FruV2_04.PNG.locked\" has type \"data\"\n \"org-openide-nodes_zh_CN.jar.locked\" has type \"data\"\n \"BD14981_.GIF.locked\" has type \"PGP\\011Secret Sub-key -\"\n \"MSPUB.HXS.locked\" has type \"data\"\n \"FD02115_.WMF.locked\" has type \"data\"\n \"green03.png.locked\" has type \"SysEx File -\"\n \"Icon1_13.drt.locked\" has type \"data\"\n \"Trip2.png.locked\" has type \"data\"\n \"ThinA_17.PNG.locked\" has type \"data\"\n \"madang.ini.locked\" has type \"data\"\n \"Shoes_09.drt.locked\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \".exe\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \".exe\" touched file \"%WINDIR%\\System32\\cmd.exe\"\n \".exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"zzbdrimp6701.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"zzbdrimp6701.exe\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \"zzbdrimp6701.exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"MayarChenot@protonmail.com\nQicifomuEjijika@o2.pl\"\n Pattern match: \"https://sectigo.com/CPS0C\"\n Pattern match: \"crl.sectigo.com/SectigoRSACodeSigningCA.crl0s\"\n Pattern match: \"crt.sectigo.com/SectigoRSACodeSigningCA.crt0#\"\n Pattern match: \"http://ocsp.sectigo.com0\"\n Pattern match: \"crl.usertrust.com/AddTrustExternalCARoot.crl05\"\n Pattern match: \"http://ocsp.usertrust.com0\"\n Pattern match: \"http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v\"\n Pattern match: \"crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%\"\n Heuristic match: \"crl.sectigo.com\"\n Heuristic match: \"ocsp.sectigo.com\"\n Heuristic match: \"MayarChenot@protonmail.com\nQicifomuEjijika@o2.pl\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"zzbdrimp6701.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00009877-00002272-00000105-4810789276\n \"zzbdrimp6701.exe\" at 00010026-00001068-00000105-9887747907\n \"zzbdrimp6701.exe\" at 00010164-00003096-00000105-17290004683\n \"zzbdrimp6701.exe\" at 00010171-00001344-00000105-14988363538\n \"zzbdrimp6701.exe\" at 00010177-00001664-00000105-19457830645\n \"zzbdrimp6701.exe\" at 00010755-00004024-00000105-36780956481\n \"zzbdrimp6701.exe\" at 00011130-00003936-00000105-49830626570\n \"zzbdrimp6701.exe\" at 00012149-00002564-00000105-85418170046","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$26","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"zzbdrimp6701.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"zzbdrimp6701.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"mayarchenot@protonmail.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\".exe\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 252)\n \".exe\" is creating a new process (Name: \"%TEMP%\\zzbdrimp6701.exe\", Handle: 252)\n \"zzbdrimp6701.exe\" is creating a new process (Name: \"%TEMP%\\zzbdrimp6701.exe\", Handle: 312)\n \"zzbdrimp6701.exe\" is creating a new process (Name: \"%TEMP%\\zzbdrimp6701.exe\", Handle: 320)\n \"zzbdrimp6701.exe\" is creating a new process (Name: \"%TEMP%\\zzbdrimp6701.exe\", Handle: 316)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 0)\n \".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 0)\n \"zzbdrimp6701.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 0)\n \"zzbdrimp6701.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 0)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"suspicious","category":"Network Related","name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.240.1/32, 192.168.240.32/32, 192.168.240.38/32, 192.168.240.222/32, 192.168.240.248/32, ...\"","origin":"Network Traffic","mitre_attack_id":"T1046","relevance":10,"id":"network-32","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The analysis extracted file with a known ransomware suffix","description":"$27","origin":"Binary File","relevance":10,"id":"binary-22","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 559 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$28","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"SetSecurityDescriptorDacl\n OpenProcessToken\n GetDriveTypeW\n FindFirstFileW\n GetFileAttributesW\n MapViewOfFileEx\n UnhandledExceptionFilter\n OpenFileMappingA\n WriteFile\n OutputDebugStringA\n DeviceIoControl\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryExW\n CreateThread\n ExitThread\n TerminateProcess\n GetModuleHandleExW\n LoadLibraryW\n GetVersionExW\n GetTickCount\n VirtualProtect\n OpenProcess\n GetStartupInfoW\n DeleteFileW\n FindFirstFileExA\n FindNextFileW\n CreateFileMappingA\n FindNextFileA\n GetProcAddress\n CreateFileW\n GetCommandLineW\n GetCommandLineA\n GetModuleHandleA\n GetModuleHandleW\n GetFileAttributesExW\n CreateProcessA\n CreateProcessW\n Sleep\n VirtualAlloc\n WSAStartup","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"c04e287720542977e0652977b5382a770000000000d0c47500000000c5eac4750000000088eac47500000000e9681e7582282a77ee292a7700000000d2691e75000000007dbbc4750000000009be1e7500000000ba18c47500000000\" to virtual address \"0x75871000\" (part of module \"NSI.DLL\")\n \"zzbdrimp6701.exe\" wrote bytes \"c04e287720542977e0652977b5382a770000000000d0c47500000000c5eac4750000000088eac47500000000e9681e7582282a77ee292a7700000000d2691e75000000007dbbc4750000000009be1e7500000000ba18c47500000000\" to virtual address \"0x75871000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26.bin\" (Offset: 529267)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"43/66 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"43/66 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"$29","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"zzbdrimp6701.exe\" allocated memory in \"%TEMP%\\zzbdrimp6701.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$2a","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2b","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate was explicitly revoked by its issuer. (0x800b010c)","origin":"Certificate Data","mitre_attack_id":"T1116","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"The analysis extracted file with a known ransomware suffix"}],"sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]}]},"activity":{"stats":{"process_count":53,"spawned_processes_count":53,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":66,"imported_dlls_count":36,"dropped_files_count":0,"extracted_files_count":39,"files_written_count":8,"files_deleted_count":0,"registry_keys_created_count":32,"registry_keys_modified_count":0,"registry_keys_deleted_count":102,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":134,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["clop","criminal","downloadsponsor","genkryptik","kryptik","locker","lockergoga","neshta","ransomware","stealer","zurgop","rietspoof"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"5c9378ab0388385a7656812c","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Ransom","contacted_countries":["USA"],"submit_name":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26.exe","analysis_start_time":"2019-03-21T11:59:59+00:00","indicators_count":{"informative":15,"suspicious":14,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"5c932724038838119956812b","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Ransom","contacted_countries":["USA"],"submit_name":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","analysis_start_time":"2019-04-10T09:11:41+00:00","indicators_count":{"informative":14,"suspicious":13,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"crl.sectigo.com","address":"151.139.128.10","ttl":2152,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Sectigo Limited","registrar_name_servers":"NS1.AS48447.NET","registrar_creation_date":"2018-08-16T17:53:22+00:00","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"domain":"ocsp.sectigo.com","address":"23.219.160.58","ttl":2703,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Sectigo Limited","registrar_name_servers":"NS1.AS48447.NET","registrar_creation_date":"2018-08-16T17:53:22+00:00","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}],"processes":[{"pid":2272,"ppid":0,"name":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26.exe","command_line":"","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"C:\\7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26.exe","uid":"00009877-00002272","icon":"$2c"},{"pid":3660,"ppid":2272,"name":"cmd.exe","command_line":"/c move /y C:\\7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26.exe %TEMP%\\zzbdrimp6701.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00009877-00002272","uid":"00010013-00003660"},{"pid":1068,"ppid":2272,"name":"zzbdrimp6701.exe","command_line":"-m","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00009877-00002272","uid":"00010026-00001068"},{"pid":3096,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00010164-00003096"},{"pid":1344,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00010171-00001344"},{"pid":1664,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00010177-00001664"},{"pid":4024,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00010755-00004024"},{"pid":3936,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00011130-00003936"},{"pid":2564,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00012149-00002564"},{"pid":3252,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00012309-00003252"},{"pid":2980,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00012604-00002980"},{"pid":3136,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00012836-00003136"},{"pid":3944,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00012986-00003944"},{"pid":3104,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00013205-00003104"},{"pid":3116,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00013427-00003116"},{"pid":2792,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00013551-00002792"},{"pid":3068,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00013803-00003068"},{"pid":4092,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00014024-00004092"},{"pid":968,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00014265-00000968"},{"pid":3308,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00014460-00003308"},{"pid":1284,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00014770-00001284"},{"pid":3220,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00014937-00003220"},{"pid":3000,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00015183-00003000"},{"pid":3140,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00015372-00003140"},{"pid":3960,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00015528-00003960"},{"pid":112,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00015788-00000112"},{"pid":2788,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00016008-00002788"},{"pid":3208,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00016189-00003208"},{"pid":3660,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00016664-00003660"},{"pid":1784,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00016912-00001784"},{"pid":1044,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00017133-00001044"},{"pid":3336,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00017322-00003336"},{"pid":1360,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00017839-00001360"},{"pid":3888,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00018178-00003888"},{"pid":3972,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00018424-00003972"},{"pid":3620,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00018560-00003620"},{"pid":2352,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00018853-00002352"},{"pid":3520,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00019116-00003520"},{"pid":3488,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00019264-00003488"},{"pid":1740,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00019491-00001740"},{"pid":1376,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00019999-00001376"},{"pid":1056,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00020217-00001056"},{"pid":480,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00020439-00000480"},{"pid":3088,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00020784-00003088"},{"pid":4012,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00020982-00004012"},{"pid":3652,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00021140-00003652"},{"pid":2208,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00021418-00002208"},{"pid":3560,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00021809-00003560"},{"pid":2740,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00022123-00002740"},{"pid":3728,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00022320-00003728"},{"pid":108,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00022688-00000108"},{"pid":3004,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00022971-00003004"},{"pid":3624,"ppid":1068,"name":"zzbdrimp6701.exe","command_line":"-i SM-zzbdrimp -s","sha256":"7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26","normalized_path":"%TEMP%\\zzbdrimp6701.exe","parent_uid":"00010026-00001068","uid":"00023225-00003624"}],"all_imported_dlls":["ole32.dll","rpcrt4.dll","msctf.dll","RstrtMgr.dll","msvcrt.dll","sechost.dll","nsi.dll","imm32.dll","api-ms-win-core-synch-l1-2-0.dll","cryptbase.dll","ncrypt.dll","ntdll.dll","usp10.dll","ws2_32.dll","rsaenh.dll","bcrypt.dll","bcryptprimitives.dll","shlwapi.dll","user32.dll","advapi32.dll","rpcss.dll","winbrand.dll","oleaut32.dll","kernel32.dll","uxtheme.dll","msasn1.dll","KernelBase.dll","gdi32.dll","lpk.dll","shell32.dll","cryptsp.dll","apphelp.dll","wow64.dll","sspicli.dll","wow64cpu.dll","wow64win.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"README_LOCKED.txt","sha256":"b686c88bce6629088ce1044b30ad1d5b978fd754601b8b463bc1f611b01d05d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"mk.txt.locked","sha256":"366e3a4491f39e0ff076d07a88df7f8d2009329c5f514923b9c3a7ac66f36286","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"name":"AdobeID.pdf.locked","sha256":"d45615c207b16228dc496b46f3865329078c36e8db20c3f1ec4ce344ff1b615c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"name":"main-selector.css.locked","sha256":"7d605dba158904995b3e8ee735f1bed25f8700d874d0f48f6d4390a162340018","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"name":"ui-strings.js.locked","sha256":"03a4895e03933445e7b74105b22c900c4b59064f7aa26523e05cc3184922c08b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"name":"ControlCommand.au3.locked","sha256":"ef314a53147df8c8344561a4ef98a42d73b66d37aec41dfbe42cd853d41af030","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"name":"_IEFrameGetObjByName.au3.locked","sha256":"eba3d2bf063357f3e49d9f1431c3c737aa10cd52c8190afcefad71598c4f6a3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"name":"BacG2_08.PNG.locked","sha256":"1a15d1f2387d2c6360f3a96064474c71aadd6e6a7f6436ee0b4117b81a97c20b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"name":"ExtA_08.PNG.locked","sha256":"668e80a6a2e9c367994df9195a06c2b3834a4ac441b703411d03bfbe99aabbd9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"name":"Sh2D1_22.PNG.locked","sha256":"dbf4d9a49517815fcadc6afc9c631bfa7a9d9bc377b996170a89dcb833fa8b1e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"name":"Sh2D1_34.PNG.locked","sha256":"b0100a8834e796d9d1bf5d2c809160da9b4808d4e46c0d51f852d1503b83205a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"name":"Sh2D1_35.PNG.locked","sha256":"4942f7ddbe224545b91b4137d065eab64dda0d6a946ddd55a2b6111f659ab65d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"name":"FoodD_06.PNG.locked","sha256":"5f9df1266dfb2d63d62050aa88237d5b19d6ae1b57df470c850223179fc63f43","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"name":"FoodC_00.PNG.locked","sha256":"226f0df3a1cf60f69803dc6c26f0459337ee9beb89a97ef3cb20291f42009241","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"name":"FoodC_04.PNG.locked","sha256":"5156e38a77fb4259bbf40722d94f0acdf5878e67eef8e3a5665392f15896f1eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"name":"FoodC_08.PNG.locked","sha256":"21931774271aadc6177a04504278ae8c21186e84e1f25b3c97827ddb0e11262e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"name":"Food1_01.PNG.locked","sha256":"7c43a1175777169b978e73317b8301fcd817af9784405d8a8e4aa179d3e07f31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"name":"Food1_09.PNG.locked","sha256":"fcff5bbad1764af89dab3cf0f510843ccf9fe0ae2feae4d8aaf0b672fb35f566","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"name":"Anniv_03.PNG.locked","sha256":"3d23359be445dfe6064de23b5d1fcf50fc0ec60ce408d8ac3d1975603f4e7736","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"name":"IOthe_21.PNG.locked","sha256":"e61993c9df3bb1c01c9aa328e969851d25b22f7fa8b714e8da7b49d01b2b755a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"name":"MasterDescriptor.x-none.xml.locked","sha256":"e75c6f315b90f71ee0539da5bced0c971a3083c0b3753c6cbc0c8c15b4af4935","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"DeploymentConfig.0.xml.locked","sha256":"f47ac07640b38bb82eaf793cabec65585944bb5508ad7ab72babdc4d5f225cea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"DeploymentConfig.1.xml.locked","sha256":"4182f334554ccab569d50f6f2fb55dd3c7a22168d0e9e0e09ea791d04d42128a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"DeploymentConfig.2.xml.locked","sha256":"54c74853dfe256ffd031e76b95d958f0587b832623f0194277023b31746c96bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"MasterDescriptor.en-us.xml.locked","sha256":"feffb5ff42792b6780a479e37b35f2d9d51471688377f6711f8e34187773f902","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"behavior.xml.locked","sha256":"ecffd45f34c7ecd37ddcee7ca609271831905f833b7f852b84b3662ef990c353","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"resource.xml.locked","sha256":"42b0dd90d59008ebe14828e1f85671210b89013d9efbe5d7bd3bd3db3a5766b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"tasks.xml.locked","sha256":"07afea4d0d20e4c0f37342fa96558b0e6dae214011ea0b46f7dd987042112bdc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"ilrcache.xml.locked","sha256":"b40609ffa26912d0b47f5ae5c909cdeb4a02bbeb847b2f303de25c053c631d21","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"imcrcache.xml.locked","sha256":"5c29c25bd9c2bed2a19830a8337993f23b22bcd5cf50142901dca88f17f57a68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"cversions.2.db.locked","sha256":"c7b48aa6735937e0fc036957ea4e31b6e3c65028c7534ca67aedd3a5c421087d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"energy-report-2017-12-05.xml.locked","sha256":"820712b8b52b4b7f41b3822a75bd6b7acc6ca15a830d579d84732ad881bfcc5d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"energy-report-2018-02-20.xml.locked","sha256":"1a92b8b435a782dfcd4c10bfe0c2108837eaee00bc2121294418a2f7c7db1a1f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"energy-report-latest.xml.locked","sha256":"591a15df05b4c1cd550ea5efe0ed05738ab4e8a952d06483456a9e9f9b336661","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"active-update.xml.locked","sha256":"efb4e520480c5dafd575911afa8c42379dee540abd0078a33670b6967d3272b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"updates.xml.locked","sha256":"4172ebb126749445c07b774b40cdfb7f04e25581a51e6d59631360121397aad1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"SoftBlue.jpg.locked","sha256":"39e6dcbd0524f838e377ed044d9f59e0dc6f4d2028476ec77f9f0f9b785093a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"base_kor.xml.locked","sha256":"b3df6cd672781f7ef101f8ac29509abefed9746e1f7ad009bfe0f5a9864dd9d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"ResultReport.xml.locked","sha256":"45e9ce7be539bb94a9c7f289bdf98beee6183277567d5eda97371032117ceeba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]}],"files_written":[{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"path":"C:\\Documents and Settings","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"path":"%TEMP%\\zzbdrimp6701.exe","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"path":"%TEMP%\\zzbdrimp3307.exe","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0001\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0002\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0003\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0004\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0005\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0006\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0007\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0008\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0009\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0010\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0011\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0012\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0013\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0014\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0015\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0016\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0017\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0018\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0019\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0020\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0021\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0022\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0023\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0024\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0025\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0026\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0027\\","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0028\\","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\REGFILESHASH\\REGFILESHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\REGFILES0000\\REGFILES0000","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0004\\REGFILESHASH\\REGFILESHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0004\\REGFILES0000\\REGFILES0000","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0004\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0004\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0004\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0013\\REGFILESHASH\\REGFILESHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0013\\REGFILES0000\\REGFILES0000","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0013\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0013\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0013\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0007\\REGFILESHASH\\REGFILESHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0007\\REGFILES0000\\REGFILES0000","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0007\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0007\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0007\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0002\\REGFILESHASH\\REGFILESHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0002\\REGFILES0000\\REGFILES0000","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0002\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0002\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0002\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0006\\REGFILESHASH\\REGFILESHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0006\\REGFILES0000\\REGFILES0000","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0006\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0006\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0006\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0022\\REGFILESHASH\\REGFILESHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0022\\REGFILES0000\\REGFILES0000","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0022\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0022\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0022\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0001\\REGFILESHASH\\REGFILESHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0001\\REGFILES0000\\REGFILES0000","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0001\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0001\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0001\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0005\\REGFILESHASH\\REGFILESHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0005\\REGFILES0000\\REGFILES0000","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0005\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0005\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0005\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0009\\REGFILESHASH\\REGFILESHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0009\\REGFILES0000\\REGFILES0000","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0009\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0009\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0009\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0010\\REGFILESHASH\\REGFILESHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0010\\REGFILES0000\\REGFILES0000","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0010\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0010\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0010\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0012\\REGFILESHASH\\REGFILESHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0012\\REGFILES0000\\REGFILES0000","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0012\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0012\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0012\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0014\\REGFILESHASH\\REGFILESHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0014\\REGFILES0000\\REGFILES0000","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0014\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0014\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0014\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0016\\REGFILESHASH\\REGFILESHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0016\\REGFILES0000\\REGFILES0000","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0016\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0016\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0016\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0017\\REGFILESHASH\\REGFILESHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0017\\REGFILES0000\\REGFILES0000","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0017\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0017\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0017\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0018\\REGFILESHASH\\REGFILESHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0018\\REGFILES0000\\REGFILES0000","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0018\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0018\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0018\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0003\\REGFILESHASH\\REGFILESHASH","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0003\\REGFILES0000\\REGFILES0000","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0003\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0003\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0003\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0008\\REGFILESHASH\\REGFILESHASH","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0008\\REGFILES0000\\REGFILES0000","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0008\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0008\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0008\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0011\\REGFILESHASH\\REGFILESHASH","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0011\\REGFILES0000\\REGFILES0000","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0011\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0011\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0011\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0015\\REGFILESHASH\\REGFILESHASH","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0015\\REGFILES0000\\REGFILES0000","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0015\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0015\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0015\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0019\\REGFILESHASH\\REGFILESHASH","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0019\\REGFILES0000\\REGFILES0000","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\MX-zzbdrimp","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"MX-zzbdrimp","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0001","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0005","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0006","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0010","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0013","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0016","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0020","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0023","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0026","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0004","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0026","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0010","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0023","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0001","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0016","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0013","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0005","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0004","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0020","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0006","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0002","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0007","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0009","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0012","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0014","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0017","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0018","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0022","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0025","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0014","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0002","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0017","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0009","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0007","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0012","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0018","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0022","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0025","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0003","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0008","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0011","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0015","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0019","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0021","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0024","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0008","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0003","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0024","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0011","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0015","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0021","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0019","sources":[{"report_type":"sandbox","report_id":"5c9378ab0388385a7656812c"},{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0027","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0027","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0028","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0029","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0029","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0028","sources":[{"report_type":"sandbox","report_id":"5c932724038838119956812b"}]}]}},"report_ids":{"sandbox_job_ids":["5c9378ab0388385a7656812c","5c932724038838119956812b"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Crypren Sample 7bcd69b30851… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7bcd69b30851…. Malware family: Trojan.Crypren. Threat score 100/100. 26/29 AV engines flagged this file. 8 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Crypren Sample 7bcd69b30851… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7bcd69b30851…. Malware family: Trojan.Crypren. Threat score 100/100. 26/29 AV engines flagged this file. 8 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Crypren Sample 7bcd69b30851… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7bcd69b30851…. Malware family: Trojan.Crypren. Threat score 100/100. 26/29 AV engines flagged this file. 8 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]